Loading story…
Red Hat released RHSA-2024:8162, a Moderate-severity update for Red Hat Enterprise Linux 9, remediating 14 Linux-kernel vulnerabilities across standard RHEL 9 and associated EUS, ELS, SAP, and CodeReady Linux Builder offerings. The fixes address issues including local information disclosure on Intel Atom processors, an out-of-bounds write in sch_multiq, a use-after-free condition in the Ionic driver, and several NULL-pointer dereference and networking flaws, including CVE-2023-52658, CVE-2021-47385, and CVE-2024-35989. Affected systems span x86_64, aarch64, ppc64le, and s390x architectures; administrators must reboot after installing the updated kernel.
Red Hat also published refreshed RHEL 9 container images under RHBA-2024:8242, RHBA-2024:8412, RHBA-2024:8441, and RHBA-2024:8578, backporting the RHSA-2024:8162 kernel security fixes into UBI-derived, language-runtime, S2I, support-tools, and Go Toolset images. Organizations should pull the revised images from the Red Hat Container Registry, update base-image references in Dockerfiles and build scripts, and rebuild and redeploy all dependent container images.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHBA-2024:8578, updating RHEL 9 container images with backported security fixes referenced by RHSA-2024:8162. The advisory instructed users to obtain updated images and rebuild dependent container images.
RHBA-2024:8441 updated the RHEL 9 rhel9/support-tools container image with backported RHSA-2024:8162 security fixes. Red Hat advised users to upgrade and rebuild downstream images derived from it.
Red Hat issued RHBA-2024:8412 to provide updated RHEL 9 container images incorporating backported fixes associated with RHSA-2024:8162. Users were advised to update image references and rebuild dependent images.
RHBA-2024:8242 updated the RHEL 9 rhel9/go-toolset container image with backported security fixes from RHSA-2024:8162. Red Hat advised users to upgrade the image and rebuild dependent containers.
Red Hat issued RHBA-2024:8165, updating the rhdh/rhdh-hub-rhel9 container image for Red Hat Developer Hub 1.3 on RHEL 9 with backported RHSA-2024:8162 security fixes. Users were advised to upgrade the image and rebuild dependent container images.
Red Hat issued Moderate-severity advisory RHSA-2024:8162 for an updated RHEL 9 kernel. It remediated 14 vulnerabilities, including CVE-2023-52658, CVE-2024-35989, and CVE-2021-47385, and required systems to reboot after installation.
Red Hat reported CVE-2024-42079, a medium-severity GFS2 race condition in which unmounting can leave sd_jdesc NULL and cause gfs2_log_flush to dereference it. The upstream fix adds locking and a NULL check; Red Hat addressed the flaw in RHEL 9 via RHSA-2024:8162 and in RHEL 8 via RHSA-2024:8856 and RHSA-2024:8870.
Red Hat reported CVE-2024-35989, a dmaengine idxd driver flaw that can cause a kernel oops when the module is removed on single-CPU systems.
Red Hat recorded CVE-2024-27403, a Linux kernel netfilter nft_flow_offload vulnerability resolved by resetting the destination field in a route object after flow setup. The issue was later addressed for RHEL 9 through RHSA-2024:8162, as well as certain RHEL EUS and SAP offerings.
Red Hat reported CVE-2023-52658, involving net/mlx5 switchdev mode and namespace inconsistency handling. The remediation reverts the affected net/mlx5 change.
Red Hat documented CVE-2024-38556, a Linux kernel net/mlx5 flaw involving command-queue semaphore acquisition without a timeout. The upstream remediation adds a timeout, and Red Hat addressed the issue through RHSA-2024:8162 and RHEL 9.2 EUS advisories RHSA-2024:5364 and RHSA-2024:5365.
Red Hat documented CVE-2024-39483, a Linux kernel KVM/SVM issue in which an NMI-window request could incorrectly trigger a WARN when virtual NMI support was enabled but NMIs were not genuinely masked. The fix restricts the warning to vCPUs already handling an NMI, and was distributed for RHEL 9 through RHSA-2024:8162.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:0461**, an Important RHEL 9 kernel update that remediates 17 vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The flaws include use-after-free, out-of-bounds access, integer-overflow, and NULL-pointer-dereference issues, including `CVE-2022-36402` in the `vmwgfx` graphics driver, which could let a local user with DRM-device access crash a host, and `CVE-2023-6679` in the DPLL subsystem, which can cause denial of service. The update applies to supported RHEL 9 variants on x86_64, ARM64, IBM Z, and Power little-endian systems; affected hosts require a reboot after installation. Red Hat also refreshed RHEL 9 container images through **RHBA-2024:0611** and Red Hat OpenStack Platform 17.1 container images through **RHBA-2024:0688**, incorporating the kernel security fixes and related remediation from RHSA-2024:0448. The container updates cover multiple RHEL 9 image variants, including EUS, AUS, SAP, extended-lifecycle, and four-year update offerings, and address issues such as eBPF-verification flaws and an AMD SEV-ES local privilege-escalation vulnerability. Organizations should pull the updated images, update base-image references in Dockerfiles and build automation, rebuild dependent images, and deploy the refreshed artifacts.
Aug 26, 2026
Red Hat released kernel and container-image updates to remediate a broad set of Linux kernel vulnerabilities across **RHEL 8** and **RHEL 9**. The flaws include memory-safety defects, use-after-free and out-of-bounds conditions, NULL-pointer dereferences, race conditions, deadlocks, information disclosure, and denial-of-service risks across subsystems such as USB, HID, RDMA, networking, BPF, Bluetooth, filesystems, storage, graphics, and virtualization. Examples include `CVE-2024-26933`, a USB-core deadlock, `CVE-2024-26717`, a NULL dereference in the HID I2C driver, and `CVE-2024-26743`, an RDMA/qedr error-flow flaw. The fixes were delivered through RHEL kernel advisories including `RHSA-2024:9315` for RHEL 9, and through refreshed RHEL 8 base and middleware container images tied to `RHSA-2024:7000`, including Flatpak SDK, Go Toolset, Support Tools, Camel K Operator, and RHPAM Kogito Builder images. Organizations should apply the updated RHEL kernel packages and reboot affected hosts; for containers, pull the revised images, update Dockerfiles or build scripts to use current tags, and rebuild and redeploy all downstream images. Red Hat later corrected `RHSA-2024:9315` to remove `CVE-2023-52490`, which had been incorrectly listed as fixed, without changing the packages.
Aug 26, 2026
Red Hat released updated RHEL 8 container images for `gcc-toolset-12-toolchain`, `gcc-toolset-13-toolchain`, and the Camel K RHEL 8 operator, incorporating the kernel security fixes delivered through RHSA-2024:5101. The updates address numerous backported kernel defects across memory management, networking, filesystems, drivers, and architecture-specific code, including `CVE-2024-36886`, a TIPC message-reassembly use-after-free that may enable remote code execution. Organizations using the affected base images should upgrade them and rebuild downstream images; Camel K users on OpenShift 4.11 and 4.12 should also update image references in Dockerfiles and automation. Separate RHEL 9.2 Extended Update Support kernel and real-time kernel updates remediate `CVE-2023-6240` (the Marvin RSA-decryption side channel), TLS flaws `CVE-2024-26582` and `CVE-2024-26584`, and `CVE-2024-26586`, a stack-corruption issue in mlxsw Spectrum ACL TCAM handling. Red Hat also issued fixes across supported RHEL 8 and 9 streams for networking defects including `CVE-2024-38555` in `net/mlx5` command-completion error handling and `CVE-2024-26837` in bridge switchdev multicast-database event replay. Administrators must reboot updated RHEL 9.2 systems for the kernel fixes to take effect.
Aug 26, 2026