Loading story…
Red Hat released Moderate-severity kernel updates for RHEL 9.2 servicing streams, including Extended Update Support, Update Services for SAP Solutions, and Extended Life Cycle offerings, to remediate CVE-2024-25744 and CVE-2023-52628. CVE-2024-25744 allows an untrusted virtual-machine monitor to trigger int80 system-call handling at arbitrary points in affected Linux kernels, impacting Intel TDX confidential-computing and AMD memory-encryption-related code; upstream fixed it in Linux 6.6.7.
CVE-2023-52628 is a four-byte out-of-bounds stack write in netfilter/nftables extended-header processing, with potential remote reachability requiring environment-specific validation. RHSA-2024:2845 supplies kernel version 5.14.0-284.66.1.el9_2 for supported RHEL 9.2 architectures, while RHSA-2024:2846 provides the real-time kernel 5.14.0-284.66.1.rt14.351.el9_2 for affected x86_64 deployments; administrators must reboot after installing the updates.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2024:2846 for the RHEL 9.2 Real Time kernel packages. The kernel-rt 5.14.0-284.66.1.rt14.351.el9_2 update fixes CVE-2024-25744 and CVE-2023-52628 on affected x86_64 systems.
Red Hat issued Moderate-severity advisory RHSA-2024:2845 for RHEL 9.2 servicing streams, providing kernel 5.14.0-284.66.1.el9_2. The update remediates both CVE-2024-25744 and CVE-2023-52628, and requires a reboot after installation.
The Linux kernel CVE team assigned CVE-2023-52628 to a netfilter/nftables extended-header flaw involving a four-byte out-of-bounds stack write.
The Linux kernel issue later tracked as CVE-2024-25744 and Red Hat Bugzilla 2263875 was reported. It allows an untrusted VMM to trigger int80 system-call handling at arbitrary points in affected confidential-computing and memory-encryption code paths.
Upstream Linux kernel version 6.6.7 fixed CVE-2024-25744, with the fix associated with commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30. Fedora also received the remediation through its 6.6.7 stable-kernel updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-severity kernel updates for **RHEL 9.2** support channels, including Extended Update Support, Extended Life Cycle, AUS, SAP, and Real Time Linux offerings. The fixes address ten Linux-kernel vulnerabilities spanning memory corruption, out-of-bounds access, use-after-free conditions, NULL-pointer dereferences, SCTP validation, conntrack, NVMe-over-TCP, kTLS, and USB-storage components. The updates include **CVE-2023-6610**, an out-of-bounds read in the SMB client debug path that can be triggered by an unknown SMB frame when `CONFIG_CIFS_DEBUG2` is enabled, potentially causing a crash or leaking kernel information. They also remediate **CVE-2023-45862**, an out-of-bounds memory condition in the ENE UB6250 USB card-reader driver. Organizations using affected RHEL 9.2 systems should install `kernel-5.14.0-284.52.1.el9_2` or `kernel-rt-5.14.0-284.52.1.rt14.337.el9_2`, as applicable, and reboot to activate the patches.
Aug 26, 2026
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026