Loading story…
Red Hat released Moderate-severity kernel updates for RHEL 9.2 supported streams and the RHEL 9.2 Real Time kernel, addressing memory-safety flaws in KVM virtualization, Bluetooth socket handling, s390 virtualization, and the mlx5e network driver. The fixes include CVE-2024-26598, a use-after-free in KVM VGIC ITS LPI translation-cache handling caused by a race between cache lookup and invalidation, and CVE-2023-52667, a potential double-free in mlx5e function fs_any_create_groups.
RHSA-2024:3855 covers affected RHEL 9.2 deployments across x86_64, aarch64, ppc64le, and s390x, while RHSA-2024:3854 supplies kernel-rt-5.14.0-284.69.1.rt14.354.el9_2 for eligible RHEL 9.2 real-time systems. Red Hat also included CVE-2024-26598 in a later RHEL 8.6 kernel update, RHSA-2024:8161, alongside CVE-2024-26830, CVE-2024-35884, and CVE-2021-47560. Administrators should install the applicable updated kernel packages and reboot systems to activate the mitigations.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Moderate-security advisory RHSA-2024:8161 for supported RHEL 8.6 offerings, providing kernel 4.18.0-372.126.1.el8_6. The update fixed CVE-2024-26598 along with CVE-2024-26830, CVE-2024-35884, and CVE-2021-47560.
Red Hat published Moderate-security advisory RHSA-2024:3855 for RHEL 9.2 supported update streams, providing kernel-5.14.0-284.69.1.el9_2. It remediated CVE-2023-5090, CVE-2023-51779, CVE-2024-26598, CVE-2023-52639, and CVE-2023-52667.
Red Hat published Moderate-security advisory RHSA-2024:3854 for RHEL 9.2 Extended Update Support kernel-rt packages. The update fixed CVE-2023-5090, CVE-2023-51779, CVE-2024-26598, and CVE-2023-52667 in kernel-rt 5.14.0-284.69.1.rt14.354.el9_2.
Zack Miele reported Red Hat Bug 2281350 to track CVE-2023-52667, a potential double-free in the Linux kernel mlx5e fs_any_create_groups function. Red Hat classified the issue as medium severity and priority.
Fedora fixed CVE-2024-26598, a potential use-after-free in KVM VGIC ITS LPI translation-cache handling, in its 6.6.14 stable kernel update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026