Loading story…
Red Hat released updated Red Hat Enterprise Linux 9 and OpenShift Dev Spaces 3 container images incorporating kernel security fixes from RHSA-2025:2627. The refreshed images cover x86_64, ARM64, IBM Z (s390x), and little-endian Power (ppc64le) variants, including applicable EUS, ELS, AUS, and SAP offerings. Red Hat instructed customers to update image references in Dockerfiles and automation and rebuild all dependent container images.
The fixes include CVE-2024-50302, a Linux kernel HID-core vulnerability in which an uninitialized report buffer could expose kernel memory through a specially crafted HID report. The upstream remediation zero-initializes the buffer at allocation; the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog. The advisories also backport fixes for additional kernel flaws involving null-pointer dereferences, use-after-free and dangling-pointer conditions, uninitialized buffers, and out-of-bounds access.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHBA-2025:3020 for OpenShift Dev Spaces 3 images on x86_64, ppc64le, and s390x. The update included backported RHSA-2025:2627 security fixes for seven listed CVEs, including CVE-2024-50302, and Red Hat advised customers to upgrade and rebuild dependent images.
Red Hat issued RHBA-2025:2783, updating RHEL 9 container images for x86_64, ARM64, s390x, and ppc64le. The images incorporated RHSA-2025:2627 backported fixes for six Linux kernel CVEs, including CVE-2024-50302; Red Hat advised users to upgrade and rebuild dependent images.
CISA added CVE-2024-50302 to its Known Exploited Vulnerabilities Catalog, indicating the Linux kernel HID-core issue was known to be exploited.
An upstream CVE announcement described the Linux kernel HID-core flaw CVE-2024-50302, in which an uninitialized HID report buffer could disclose kernel memory. The upstream remediation zero-initializes the buffer when it is allocated.
Red Hat addressed CVE-2024-50302 through security advisories for numerous RHEL 6, 7, 8, and 9 offerings and OpenShift Container Platform 4.12 through 4.18. The fixes included RHSA-2025:2473 through RHSA-2025:2646 and OpenShift advisories including RHSA-2025:2441, RHSA-2025:2701, and RHSA-2025:3301.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:8162**, a Moderate-severity update for Red Hat Enterprise Linux 9, remediating 14 Linux-kernel vulnerabilities across standard RHEL 9 and associated EUS, ELS, SAP, and CodeReady Linux Builder offerings. The fixes address issues including local information disclosure on Intel Atom processors, an out-of-bounds write in `sch_multiq`, a use-after-free condition in the Ionic driver, and several NULL-pointer dereference and networking flaws, including `CVE-2023-52658`, `CVE-2021-47385`, and `CVE-2024-35989`. Affected systems span x86_64, aarch64, ppc64le, and s390x architectures; administrators must reboot after installing the updated kernel. Red Hat also published refreshed RHEL 9 container images under RHBA-2024:8242, RHBA-2024:8412, RHBA-2024:8441, and RHBA-2024:8578, backporting the RHSA-2024:8162 kernel security fixes into UBI-derived, language-runtime, S2I, support-tools, and Go Toolset images. Organizations should pull the revised images from the Red Hat Container Registry, update base-image references in Dockerfiles and build scripts, and rebuild and redeploy all dependent container images.
Aug 26, 2026
Red Hat released updated OpenShift Dev Spaces 3 container images through the Red Hat Container Registry, incorporating backported security fixes from `RHSA-2023:7077`. The updated dashboard, plugin-registry, and UDI images are available for `x86_64`, `ppc64le`, and `s390x`; organizations should upgrade the images and rebuild dependent container images. The remediation covers numerous Linux kernel issues, including `CVE-2022-3594`, which can let a remote attacker force excessive logging through the Realtek `r8152` USB Ethernet driver, and local denial-of-service flaws in the VMware graphics driver: `CVE-2022-40133` and `CVE-2022-38457`. It also includes `CVE-2022-45869`, a KVM race condition that can allow a low-privileged nested-virtualization guest user to crash or corrupt host memory. Where updates cannot be applied immediately, Red Hat recommends blacklisting unneeded `r8152` or `vmwgfx` kernel modules and disabling nested virtualization for the KVM issue.
Aug 26, 2026
Red Hat released **RHSA-2024:0461**, an Important RHEL 9 kernel update that remediates 17 vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The flaws include use-after-free, out-of-bounds access, integer-overflow, and NULL-pointer-dereference issues, including `CVE-2022-36402` in the `vmwgfx` graphics driver, which could let a local user with DRM-device access crash a host, and `CVE-2023-6679` in the DPLL subsystem, which can cause denial of service. The update applies to supported RHEL 9 variants on x86_64, ARM64, IBM Z, and Power little-endian systems; affected hosts require a reboot after installation. Red Hat also refreshed RHEL 9 container images through **RHBA-2024:0611** and Red Hat OpenStack Platform 17.1 container images through **RHBA-2024:0688**, incorporating the kernel security fixes and related remediation from RHSA-2024:0448. The container updates cover multiple RHEL 9 image variants, including EUS, AUS, SAP, extended-lifecycle, and four-year update offerings, and address issues such as eBPF-verification flaws and an AMD SEV-ES local privilege-escalation vulnerability. Organizations should pull the updated images, update base-image references in Dockerfiles and build automation, rebuild dependent images, and deploy the refreshed artifacts.
Aug 26, 2026