Loading story…
Red Hat released Moderate-severity kernel updates for Red Hat Enterprise Linux 9 and RHEL 9.4 Extended Update Support that remediate CVE-2024-47675, a use-after-free flaw in bpf_uprobe_multi_link_attach(). If bpf_link_prime() fails, an error path can free an array of bpf_uprobe objects without unregistering them, leaving a freed consumer on the uprobe consumer list and leaking the associated uprobe object.
The fix is included in RHSA-2024:10942 for the RHEL 9.4 kernel 5.14.0-427.48.1.el9_4 and RHSA-2024:11486 for RHEL 9. These advisories also address additional kernel flaws affecting components including BPF, Bluetooth, NFS, XFRM, KVM, ARM64 probes, GICv4, and NUMA scheduling across x86_64, ARM64, IBM z, and Power architectures. Organizations should apply the applicable updated kernel packages and reboot systems for remediation to take effect.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:11486, a Moderate-severity RHEL 9 kernel security advisory covering 17 vulnerabilities across Bluetooth, BPF, NFS, ARM64, XFRM, KVM, GICv4, and NUMA scheduler components. The update included a fix for the BPF use-after-free flaw CVE-2024-47675 and required systems to reboot for the updated kernel to take effect.
Red Hat issued RHSA-2024:10942, a Moderate-severity update for the RHEL 9.4 Extended Update Support kernel:5.14.0 module, shipping build 5.14.0-427.48.1.el9_4. It remediated seven kernel vulnerabilities, including CVE-2024-47675, and required affected systems to reboot after installation.
Red Hat documented remediation for CVE-2024-50099, an ARM64 kernel flaw in LDR/LDRSW literal uprobe simulation that could trigger a BUG(), lockup, or kernel panic. The fix rejects uprobes on those instructions and was addressed for RHEL 8, RHEL 9, and RHEL 9.4 EUS through listed RHSA advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel security updates for **RHEL 9** and **RHEL 10**, addressing a broad set of memory-safety, denial-of-service, information-disclosure, and privilege-escalation risks across subsystems including BPF, KVM, netfilter, MPTCP, SMB, RDMA, NFS, and device drivers. The fixes are delivered through **RHSA-2025:20518** for RHEL 9 and **RHSA-2026:18134** for RHEL 10, covering supported x86_64, aarch64, s390x, and ppc64le variants, including applicable extended-support offerings. Among the remediated flaws, **CVE-2025-21839** affects KVM/x86 handling of the guest DR6 debug register: under certain fast-path VM-exit conditions, particularly in nested VMX deployments, KVM could restore a stale DR6 value and overwrite the guest's current value. **CVE-2024-53216** affects the NFS server (`nfsd`), where cache objects could be released while RCU readers still accessed them, creating a slab use-after-free condition; the fix defers object release until after an RCU grace period. Red Hat requires affected systems to be rebooted after installing the updated kernel for protections to take effect.
Aug 26, 2026