Loading story…
Red Hat released RHSA-2024:9942, a Moderate-severity kernel update for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The update delivers kernel version 5.14.0-70.121.1.el9_0 and addresses four CVEs, including CVE-2022-48796, an IOMMU device-probe race that can trigger a use-after-free when deferred probing accesses a freed dev->iommu structure.
The advisory also fixes CVE-2024-26671, a blk-mq sbitmap wakeup race that can cause I/O hangs and affect availability, as well as an MPTCP path-manager use-after-free (CVE-2024-46858) and CVE-2022-49270. Administrators running affected RHEL 9.0 SAP Solutions Update Services systems should install the updated kernel and reboot hosts to activate the fixes.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2024:9942 and RHSA-2024:9943 for RHEL 9.0 Update Services for SAP Solutions. RHSA-2024:9942 updated kernel packages to 5.14.0-70.121.1.el9_0 and addressed CVE-2024-26671, CVE-2022-48796, and CVE-2024-46858; affected systems require a reboot.
Red Hat released RHSA-2024:2950 for RHEL 8 kernel-rt and RHSA-2024:3138 for RHEL 8 kernel, addressing the blk-mq sbitmap wakeup race.
Red Hat issued RHSA-2024:2394 to fix the blk-mq I/O-hang race in Red Hat Enterprise Linux 9 kernels.
Red Hat published its CVE record for CVE-2024-26671, a moderate Linux kernel blk-mq sbitmap wakeup race that can cause I/O hangs and affect availability.
Red Hat addressed the IOMMU device-probe use-after-free vulnerability through RHSA-2024:6297 for RHEL 8.6 Advanced Mission Critical Update Support, SAP Solutions Update Services, and Telecommunications Update Service.
Red Hat issued RHSA-2024:10262 to fix CVE-2024-26671 in the RHEL 8.8 Extended Update Support kernel.
Red Hat issued RHSA-2024:8613 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:8614 for kernel-rt, fixing CVE-2024-26671.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel and real-time kernel updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, delivering `kernel` version `5.14.0-70.105.1.el9_0` for x86_64, ppc64le, aarch64, and s390x, and `kernel-rt` version `5.14.0-70.105.1.rt21.177.el9_0` for x86_64. The updates remediate **CVE-2024-0193**, a Netfilter use-after-free vulnerability in which local unprivileged users could potentially escalate privileges by triggering double deactivation during pipapo-set removal and catchall-element garbage collection. The advisories also address **CVE-2023-52434**, an SMB client out-of-bounds flaw caused by inadequate validation of SMB2 create-context offsets and lengths; Red Hat rates it 5.9 CVSS and considers adjacent-network denial of service the most likely impact. The standard kernel update additionally fixes a KVM use-after-free issue and a Netfilter protocol-number sanitization weakness, while the real-time update includes the latter Netfilter flaw. Administrators should apply the applicable packages and reboot affected systems for the fixes to take effect; preventing the `cifs` module from loading can mitigate the SMB issue until patching is complete.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9.0 SAP Solutions, RHEL 9.2 SAP and associated offerings, and RHEL 10/10.2 variants. The advisories remediate vulnerabilities in networking, HID, SCTP, ALSA audio, RDMA, KVM, event polling, TLS, cryptographic, and Wi-Fi code, including buffer overflows, use-after-free conditions, and recursion that could exhaust kernel resources. Key fixes include `CVE-2025-38614` in eventpoll, `CVE-2025-39864` in cfg80211, `CVE-2025-39903` affecting NUMA memory-node handling, and `CVE-2025-39946` in TLS stream handling. Affected organizations should deploy the applicable kernel packages—`5.14.0-70.151.1.el9_0` for RHEL 9.0 SAP, `5.14.0-70.151.1.rt21.223.el9_0` for its real-time kernel, and `5.14.0-284.144.1.el9_2` for RHEL 9.2 SAP—across x86_64, aarch64, ppc64le, and s390x systems as applicable. Red Hat requires a reboot after installation for mitigations to take effect; its kernel maintenance also includes a resolved Intel SOF HDA issue, `CVE-2022-50050`, where unsafe handling of `snprintf()` output could lead to a buffer overflow.
Aug 27, 2026
Red Hat released **RHSA-2024:6990**, an Important security update for the real-time kernel on Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on x86_64. The update delivers `kernel-rt-5.14.0-70.117.1.rt21.189.el9_0`, addressing 11 Linux kernel vulnerabilities across sparse-memory handling, networking, ACPICA, RDMA, vsock, perf, SUNRPC, and mac80211 Wi-Fi components. Red Hat did not report active exploitation of the flaws. Notable fixes include **CVE-2023-52489**, a locally exploitable sparse-memory race condition that can compromise availability through denial of service when compaction processes device-memory PFNs, and **CVE-2024-40995**, which can trigger an infinite loop and system-wide task hangs in the traffic-control action API when multiple actions use the same index. The advisory also includes a fix for **CVE-2021-47393** affecting the `mlxreg-fan` hardware-monitoring driver. Administrators should install the updated kernel-rt package and reboot affected systems to activate the fixes.
Aug 26, 2026