Loading story…
Red Hat released kernel updates for multiple Linux vulnerabilities affecting Red Hat Enterprise Linux (RHEL) 8 and 9 product streams. The issues include CVE-2024-26982, a SquashFS invalid-inode handling flaw that can let a low-privileged local attacker trigger an out-of-bounds read and denial of service; CVE-2024-36939, improper NFS error handling during nfs_net_init(); and CVE-2024-40978, a qedi SCSI-driver bug that can crash the kernel when a debugfs attribute is read because a user-space pointer is passed to sprintf().
Red Hat also addressed CVE-2023-52840, a use-after-free in the Synaptics RMI4 input driver’s rmi_unregister_function() path. The bug can free the function object through put_device() before later dereferencing it, with availability impact possible. Organizations should deploy the applicable updated RHEL kernel packages, including relevant extended-update-support releases; RHEL 9 kernel-rt remained affected for the Synaptics issue at the time of the advisory, while no standalone mitigation was identified for the SquashFS flaw.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for RHEL 8 kernel-rt, fixing CVE-2023-52840.
Red Hat released RHSA-2024:4352 to remediate CVE-2024-26982 in the Red Hat Enterprise Linux 8 kernel-rt package.
Red Hat released RHSA-2024:4211 to fix CVE-2024-26982 in the Red Hat Enterprise Linux 8 kernel.
Rohit Keshri reported CVE-2024-36939 in the Linux kernel NFS subsystem. The issue resulted from nfs_net_init() not handling an error returned by rpc_proc_register().
An upstream Linux kernel advisory resolved CVE-2023-52840, a use-after-free in Synaptics RMI4's rmi_unregister_function(). The fix moves put_device() until after the last use of the freed function object.
Zack Miele reported the Linux kernel Squashfs flaw later assigned CVE-2024-26982. The defect failed to reject inode number zero, enabling an out-of-bounds read and potential local denial of service.
Red Hat addressed CVE-2024-36939 for RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support through security and bug-fix advisories.
CVE-2024-36939 was resolved upstream and fixed in Linux kernel releases 5.4.276, 5.10.217, 5.15.159, 6.1.91, 6.6.31, 6.8.10, and 6.9.
Red Hat addressed CVE-2024-40978 through advisories for RHEL 8, RHEL 9, RHEL 9.0 Update Services for SAP Solutions, and RHEL 9.2 Extended Update Support.
CVE-2024-40978 was identified in the qedi SCSI driver's debugfs read path, where sprintf() directly dereferenced a user-space pointer and could cause a kernel page fault. The remediation uses a local buffer and simple_read_from_buffer() for the copy to user space.
The upstream fix for CVE-2024-26982 was included in Linux kernel versions 6.8.8 and 6.9-rc5.
Red Hat issued RHSA-2025:8248 to remediate CVE-2023-52840 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315 to fix CVE-2023-52840 in the Red Hat Enterprise Linux 9 kernel.
RHSA-2024:6297 fixed CVE-2024-26982 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2024:5255 to address CVE-2024-26982 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Red Hat released RHSA-2024:4928 to fix the Squashfs invalid-inode flaw in the Red Hat Enterprise Linux 9 kernel.
RHSA-2024:4823 and RHSA-2024:4831 remediated CVE-2024-26982 in Red Hat Enterprise Linux 9.2 Extended Update Support kernel and kernel-rt packages, respectively.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates for **RHEL 8**, RHEL 8 Real Time, and **RHEL 9** that address Linux-kernel vulnerabilities ranging from memory-safety defects and denial of service to local privilege escalation and potential remote code execution. Notable issues include the CIFS-client RCE flaw, a GSM multiplexing privilege-escalation race, and use-after-free defects in `nf_tables`/nftables and AMDGPU. `CVE-2023-4244` arises from a race between nftables set garbage collection and transactions, allowing a local attacker to crash a host and potentially disclose kernel information. The updates also remediate `CVE-2023-52434`, in which insufficient validation of SMB2 create-context offsets and lengths in `smb2_parse_contexts()` lets a malicious or malformed SMB server trigger an out-of-bounds access and kernel page fault on an SMB/CIFS client. Red Hat shipped affected fixes through advisories including RHSA-2024:1248, RHSA-2024:1607/1614, RHSA-2024:2950, and RHSA-2024:3138, covering supported x86_64, s390x, ppc64le, and aarch64 streams as applicable; organizations should install the relevant kernel packages, reboot hosts, and rebuild dependent `rhel9/support-tools` and `el9/flatpak-sdk` container images.
Aug 26, 2026