Loading story…
Red Hat addressed CVE-2024-35890, a medium-severity Linux kernel flaw in Generic Receive Offload (GRO) caused by incorrect socket-reference ownership transfer while processing packets with fragment lists. A local, low-privileged attacker could trigger kernel bugs or system instability, producing a high availability impact; Red Hat assigned the issue a CVSS v3.1 score of 5.5. Upstream fixes are included in kernel versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9.
Red Hat released patched kernel packages across affected RHEL 8 and RHEL 9 streams, including RHSA-2025:0062 for RHEL 8.8 Extended Update Support and associated service variants. That advisory provides kernel-4.18.0-477.86.1.el8_8 packages for x86_64, s390x, ppc64le, and aarch64 and also remediates CVE-2024-53122. Administrators should install the applicable kernel updates and reboot systems; RHEL 6 is outside support scope and should be treated as affected.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:4352, updating RHEL 8 kernel-rt packages to address CVE-2024-35890.
Red Hat issued RHSA-2024:4211 with Red Hat Enterprise Linux 8 kernel updates addressing CVE-2024-35890.
An automated check reported that the CVE-2024-35890 fix patch had not yet been applied to the source set it examined.
Red Hat issued RHSA-2024:3306, providing RHEL 9 kernel updates that address CVE-2024-35890.
The Linux kernel Generic Receive Offload ownership-transfer issue later tracked as CVE-2024-35890 was reported by ybuenos.
Red Hat issued RHSA-2024:1881 for Red Hat Enterprise Linux 9.2 Extended Update Support, including a fix for CVE-2024-35890.
Red Hat published Important-rated RHSA-2025:0062 for RHEL 8.8 Extended Update Support and related service variants. The advisory shipped kernel version 4.18.0-477.86.1.el8_8, fixing CVE-2024-35890 and CVE-2024-53122; affected systems require a reboot after installation.
RHSA-2024:11485 delivered fixes for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
RHSA-2024:4415 provided RHEL 9.0 Update Services for SAP Solutions kernel updates addressing CVE-2024-35890.
The Linux kernel CVE team assigned CVE-2024-35890 to a GRO ownership-transfer flaw that can retain an skb socket reference and trigger a kernel BUG in skb_orphan. The announcement identified fixes in kernel versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9, and recommended upgrading to a current stable release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
**CVE-2021-47099** affects the Linux kernel's virtual Ethernet (`veth`) driver, allowing shared or cloned socket buffers to enter Generic Receive Offload (GRO) processing. Under a configuration where GRO is enabled on a veth interface, TCP Segmentation Offload is disabled on its peer, and no XDP program is attached, the condition can trigger a `skb_shift` kernel BUG during TCP processing and crash the host. The flaw was introduced by commit `d3256efd8e8b` in Linux 5.13. Upstream fixed the issue in Linux 5.15.12 and 5.16 by avoiding GRO processing for shared or cloned buffers and attempting to unclone them first. Red Hat issued fixes for supported RHEL 8 and RHEL 9 kernel packages, including RHEL 8.6 EUS via RHSA-2024:1877; RHEL 6 and 7 are outside supported remediation scope. Red Hat rates the issue Low with CVSS 6.0, while CVE.org lists a 7.8 score; organizations should deploy current stable kernel updates and validate affected veth-based container and virtual-networking configurations.
Aug 26, 2026