Loading story…
Red Hat released a Moderate-severity kernel update, RHSA-2024:8616, for specified Red Hat Enterprise Linux 8.6 deployments on x86_64 and Power LE (ppc64le). The update delivers kernel version 4.18.0-372.127.1.el8_6 and remediates CVE-2024-40998, an ext4 race in __ext4_fill_super() where sysfs registration could expose a rate-limit setting before ratelimit_state->lock had been initialized. A local low-privileged user could alter the interval during that window and trigger unsafe locking behavior or an availability impact; Red Hat scored the issue 5.5 CVSS v3.1.
The advisory also fixes CVE-2022-48773 in the kernel's xprtrdma RPC-over-RDMA component. Error paths in rpcrdma_ep_create could leave pointers containing error values rather than NULL, allowing rpcrdma_ep_destroy to free invalid pointers and cause a kernel Oops. Organizations using affected RHEL 8.6 kernel packages should install the update and reboot systems to activate the fixes; Red Hat also issued fixes for the ext4 issue across supported RHEL 8 and 9 streams.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:10265 for RHEL 8.4 ELL, AUS, TUS, and SAP update-service offerings, providing kernel version 4.18.0-305.145.1.el8_4. The update fixes CVE-2022-48773 and the MPTCP path-manager use-after-free vulnerability CVE-2024-46858.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for RHEL 8 kernel-rt, fixing the ext4 initialization-order flaw in CVE-2024-40998.
Red Hat released RHSA-2024:8617 for RHEL 9 and RHSA-2024:8613 and RHSA-2024:8614 for RHEL 9.2 Extended Update Support kernel and kernel-rt packages, addressing CVE-2024-40998.
Red Hat issued RHSA-2024:8616 for specified RHEL 8.6 update-service offerings. The kernel update fixed both CVE-2024-40998 and the xprtrdma invalid-pointer error-handling flaw tracked as CVE-2022-48773.
Red Hat released RHSA-2024:8107 to fix CVE-2024-40998 in the RHEL 8.8 Extended Update Support kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2022:5626** for Red Hat Enterprise Linux 8.4 Extended Update Support, delivering kernel `4.18.0-305.57.1.el8_4` for x86_64, s390x, ppc64le, and aarch64. The update remediates six kernel vulnerabilities, including **CVE-2022-32250**, a netfilter use-after-free write that can enable local root escalation, and **CVE-2022-1729**, affecting `perf_event_open`. It also addresses cgroup migration permission handling in **CVE-2021-4197**, which can let a less-privileged process induce a privileged process to write through an attacker-created file descriptor, and **CVE-2021-4203**, a socket credential race that can crash the system or disclose kernel information. Red Hat also issued **RHBA-2022:5744** to update Red Hat OpenStack Platform 16.2 container images, incorporating the kernel security fixes for x86_64 and IBM Power ppc64le deployments. Organizations should install the applicable RHEL kernel update and reboot hosts for remediation to take effect; OpenStack Platform users should upgrade the supplied container images and rebuild dependent images.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Moderate-severity kernel security updates for supported Red Hat Enterprise Linux 8 and 9 update-service, extended-support, SAP, and specialized deployment channels. The updates remediate memory-safety and reliability flaws across ext4, Intel `iwlwifi`, MD RAID, CIFS, ATM, media, RDMA, networking, memory management, and net-scheduling code, including use-after-free, double-free, out-of-bounds read, overflow, and uninitialized-access conditions. Affected ext4 issues include unsafe processing of extended attributes beyond valid boundaries (`CVE-2025-37738` and `CVE-2025-22121`) and a journal-destruction race that can cause a kernel failure during unmount (`CVE-2025-22113`). Other fixes limit an unterminated firmware-provided string in the `iwlwifi` driver (`CVE-2025-21905`), prevent invalid transparent-huge-page migration-entry dereferencing (`CVE-2025-37958`), validate Clause 45 MDIO PHY addresses (`CVE-2025-38110`), and correct an MD RAID5 use-after-free (`CVE-2022-50022`). Administrators should install the kernel build designated for their exact RHEL release and entitlement channel—examples include `4.18.0-305.165.1.el8_4`, `4.18.0-372.155.1.el8_6`, and `5.14.0-70.140.1.el9_0`—then reboot affected systems to activate the fixes. Red Hat's advisory for the RHEL 8.2 AUS update did not report known exploitation in the wild.
Aug 26, 2026