Loading story…
Red Hat released RHSA-2024:11313 for Red Hat Enterprise Linux 9.4 support channels, updating the kernel to 5.14.0-427.49.1.el9_4. The update remediates four vulnerabilities: CVE-2021-47384, a w83793 hardware-monitoring driver NULL-pointer dereference that can cause system instability; CVE-2024-38627, a double-free in STM device registration; CVE-2024-39499, a VMCI event-delivery speculative information-leak risk; and CVE-2024-40989, an ARM64 KVM teardown flaw that can leave vCPUs with dangling redistributor-region pointers.
The advisory applies across supported RHEL 9.4 x86_64, ARM64, IBM Z/s390x, and Power little-endian deployments, including EUS, AUS, SAP Update Services, and Extended Life Cycle channels. Red Hat rates the advisory Moderate; the w83793 flaw has a CVSS 3.1 score of 5.5 and requires local, low-privileged access, while the other fixes address memory-safety, speculative-execution, and virtualization risks. Organizations should deploy the updated kernel packages and reboot affected systems for the fixes to take effect.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 and RHSA-2024:7001 for RHEL 8 kernel and kernel-rt packages, and RHSA-2024:6993 for RHEL 8.8 EUS, addressing the w83793 NULL-pointer dereference.
CVE-2024-40989 was reported in ARM64 KVM teardown logic, where vCPUs could retain dangling pointers to a removed GIC redistributor region.
CVE-2024-39499 was reported in the Linux kernel VMCI event_deliver() path, where a user-controlled event value could be used as an unsanitized index and potentially enable speculative information leakage.
Patrick Del Bello reported CVE-2024-38627, a double-free condition in the Linux kernel STM class function stm_register_device().
The upstream Linux kernel advisory for CVE-2021-47384 was published. The w83793 hwmon-driver flaw could trigger a NULL-pointer dereference, and its fix removes an unnecessary structure field.
Red Hat published RHSA-2024:11313, delivering kernel version 5.14.0-427.49.1.el9_4 for RHEL 9.4 support channels. The update fixes CVE-2021-47384, CVE-2024-38627, CVE-2024-39499, and CVE-2024-40989; affected systems require a reboot after installation.
Red Hat released RHSA-2024:9315 for the RHEL 9 kernel package, addressing CVE-2021-47384.
Red Hat released RHSA-2024:8613 and RHSA-2024:8614 for RHEL 9.2 Extended Update Support kernel and kernel-rt packages to address CVE-2021-47384.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released moderate-severity advisory **RHSA-2025:8796** for supported RHEL 9.4 update channels, delivering kernel version `5.14.0-427.72.1.el9_4`. The update applies across x86_64, aarch64, ppc64le, and s390x deployments in EUS, AUS, SAP, extended-life-cycle, and CodeReady Linux Builder repositories. Administrators must reboot affected systems after installing the updated kernel. The advisory remediates kernel issues including `CVE-2024-26921`, which could release an IPv4 defragmentation socket while still in use; `CVE-2024-26645`, a tracing-map insertion race condition that can cause local denial of service; `CVE-2024-27042`, a potential out-of-bounds access in AMDGPU discovery-register initialization; `CVE-2024-35930`, a possible LPFC SCSI-driver memory leak; and `CVE-2024-36933`, an NSH GSO packet-header handling flaw. It also addresses a PowerPC vector-operation issue and references `CVE-2023-54114`; RHEL 9 kernel-rt remains listed as affected by `CVE-2024-26645` without a corresponding erratum.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released **RHSA-2025:3021**, a Moderate-severity kernel update for Red Hat Enterprise Linux 9.4 support channels. The update remediates six issues spanning RDMA SRP target initialization, ACPI extended logging, mlx5e aRFS handling, PCI power management, and memory-control-group concurrency. Affected deployments should install the applicable `5.14.0-427.60.1.el9_4` kernel packages and reboot to activate the new kernel. The update includes the fix for **CVE-2024-26872**, in which the RDMA SRP target driver could register an event handler before an `srpt` device was fully initialized; upstream fixes defer registration until setup completes. It also carries the ACPI extlog code correction associated with **CVE-2023-52605**, a potential NULL-pointer dereference during cleanup that could cause a local denial of service, although that CVE was subsequently rejected upstream. The advisory applies across RHEL 9.4 x86_64, aarch64, ppc64le, and s390x channels, including EUS, ELS, AUS, SAP-related services, and associated CodeReady Linux Builder repositories.
Aug 26, 2026