Loading story…
Red Hat released RHSA-2024:4107, a Moderate-severity kernel security and bug-fix update for Red Hat Enterprise Linux 8.6 deployments using Advanced Update Support, Telecommunications Update Service, Extended Life Cycle Long Life, and SAP update channels. The advisory delivers kernel version 4.18.0-372.109.1.el8_6 and remediates CVE-2022-1048, an ALSA PCM use-after-free race in snd_pcm_hw_free that a low-privileged local user could potentially use to crash a system or escalate privileges on systems exposing a relevant sound device.
The update also addresses CVE-2024-26993, a reference leak in sysfs_break_active_protection(), and CVE-2024-26642 in netfilter nf_tables. Red Hat assessed CVE-2024-26993 as preliminarily low impact, with no active exploitation or demonstrated impact reported. Administrators should install the updated kernel packages and reboot affected systems to activate the fixes; preventing the snd-pcm module from loading can mitigate CVE-2022-1048 where patching cannot occur immediately.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:3618 for Red Hat Enterprise Linux 8 kernel packages and RHSA-2024:3627 for RHEL 8 kernel-rt packages, remediating the sysfs reference-leak vulnerability CVE-2024-26993.
The Linux kernel CVE team assigned CVE-2024-26993 to a sysfs vulnerability involving a reference leak in sysfs_break_active_protection().
Red Hat issued RHSA-2022:7444 for RHEL 8 kernel-rt and RHSA-2022:7683 for the RHEL 8 kernel, fixing the ALSA PCM use-after-free vulnerability CVE-2022-1048.
Red Hat released Moderate-severity advisory RHSA-2024:4107 for supported RHEL 8.6 update channels. The kernel update fixes CVE-2022-1048, CVE-2024-26642, and CVE-2024-26993; affected systems require a reboot after installation.
Red Hat issued RHSA-2022:8267 for the RHEL 9 kernel and RHSA-2022:7933 for RHEL 9 kernel-rt, addressing CVE-2022-1048.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for RHEL 9.6 and RHEL 10.0 that address multiple vulnerabilities across NFSD, NFS, KVM on ARM64, ALSA UMP, Intel ASoC, libceph, and other kernel subsystems. RHSA-2026:0804 provides kernel `5.14.0-570.79.1.el9_6` for RHEL 9.6 support channels and is rated Important, while Moderate-rated RHSA-2026:1236 provides kernel `6.12.0-55.55.1.el10_0` for RHEL 10.0, including applicable EUS and CodeReady Linux Builder repositories across supported architectures. The updates remediate **CVE-2025-37891**, an ALSA Universal MIDI Packet conversion flaw in which a four-byte buffer could receive up to six bytes of malformed SysEx data, potentially causing memory corruption; the upstream correction expands the buffer to six bytes. Red Hat also previously updated RHEL 8 kernels through RHSA-2025:21917 to fix an NFS write-update race condition, **CVE-2025-39697**, and an i40e driver index-validation flaw, **CVE-2025-39971**. Administrators should deploy the applicable kernel packages and reboot affected systems for fixes to take effect.
Aug 25, 2026
Red Hat released Moderate-severity Linux kernel updates for supported **RHEL 8** and **RHEL 9** channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory. Key fixes include **CVE-2025-39751**, a buffer overflow in the ALSA HDA CA0132 driver's `add_tuning_control()` function caused by unbounded `sprintf`; **CVE-2025-39849**, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and **CVE-2022-50087**, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build `4.18.0-553.80.1.el8_10`, RHEL 8.8 SAP/TUS build `4.18.0-477.116.1.el8_8`, or RHEL 8.6 build `4.18.0-372.166.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Important RHEL 8 kernel and `kpatch-patch` updates addressing **CVE-2023-0266**, an ALSA PCM control-element use-after-free vulnerability, and **CVE-2023-0461**, a use-after-free flaw in kernel network ULP handling for listening sockets. The fixes cover RHEL 8.4 EUS, AUS, TUS, Extended Life Cycle Long Life, SAP, and Real Time channels across x86_64, s390x, ppc64le, and aarch64, including kernel version `4.18.0-305.86.2.el8_4` and Real Time version `4.18.0-305.86.2.rt7.160.el8_4` packages. Red Hat also issued a live-patch update for RHEL 8.1 SAP Solutions systems that remediates CVE-2023-0461 and **CVE-2023-1390**, a remotely triggerable denial-of-service flaw in the TIPC module. CVE-2023-1390 can allow an attacker to send two small UDP packets to hosts configured with a UDP TIPC bearer, driving CPU use to 100% and making systems unresponsive. Administrators should install the applicable kernel updates and reboot systems where required; `kpatch-patch` packages apply supported fixes to running kernels without a conventional reboot.
Aug 26, 2026