Loading story…
Red Hat released RHSA-2025:3839 for the Real Time Linux Kernel on RHEL 9.0 Update Services for SAP Solutions x86_64, providing kernel-rt-5.14.0-70.130.1.rt21.202.el9_0. The update fixes CVE-2024-53150, an out-of-bounds read in ALSA USB-audio clock-source descriptor handling. A malicious or malformed USB audio device can provide undersized descriptors that cause the kernel to read beyond descriptor bounds; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog after observed exploitation.
The advisory also remediates CVE-2022-49541, an Important-severity double-free in Linux kernel CIFS mount handling. An attacker with local permission to attempt CIFS mounts could trigger memory corruption, denial of service, or potentially privilege escalation and arbitrary code execution after a failed mount. Red Hat advises affected organizations to install the updated kernel-rt packages and reboot systems for both fixes to take effect.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2025:3838 for RHEL 9.0 Update Services for SAP Solutions. The kernel 5.14.0-70.130.1.el9_0 update remediates CVE-2024-53150 and CVE-2022-49541 for x86_64, ppc64le, aarch64, and s390x deployments; affected systems require a reboot.
Red Hat issued the Important-rated RHSA-2025:3839 advisory for RHEL 9.0 Update Services for SAP Solutions on x86_64. The kernel-rt 5.14.0-70.130.1.rt21.202.el9_0 update remediates both CVE-2024-53150 and CVE-2022-49541 and requires a reboot after installation.
CISA added CVE-2024-53150 to its Known Exploited Vulnerabilities catalog, indicating that exploitation of the ALSA USB-audio out-of-bounds read had been observed.
Red Hat identified RHSA-2025:3961 as an additional advisory that remediates CVE-2022-49541, the Linux kernel CIFS failed-mount double-free vulnerability, for RHEL 9.0 Update Services for SAP Solutions.
The Linux kernel ALSA USB-audio driver was found to allow out-of-bounds reads when malformed USB audio clock descriptors use undersized bLength values. The upstream fix added descriptor-length validation, including checks for variable-length UAC2 and UAC3 clock-selector descriptors.
A double-free flaw in the Linux kernel CIFS mounting path can occur after a failed CIFS volume mount. A local user permitted to attempt CIFS mounts could corrupt kernel memory, cause denial of service, or potentially obtain elevated code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel security updates for RHEL 7.7 Advanced Update Support, RHEL 8 Real Time/NFV and 8.10 Extended Life Cycle, and RHEL 9.0 Update Services for SAP Solutions. The updates remediate an uninitialized HID report-buffer flaw (**CVE-2024-50302**), a use-after-free in CAN BCM processing (**CVE-2023-52922**), and out-of-bounds access risks in ALSA USB-audio support for Extigy and Mbox devices (**CVE-2024-53197**). The RHEL 8 `kernel-rt` update also fixes **CVE-2024-57979**, a PPS subsystem use-after-free that can occur when a PPS source is unregistered while character-device operations remain open, potentially causing memory corruption and kernel panic. Organizations should deploy the applicable fixed packages—including `kernel-rt-4.18.0-553.44.1.rt7.385.el8_10`, `kernel-3.10.0-1062.93.1.el7`, or `kernel-rt-5.14.0-70.125.1.rt21.197.el9_0`—and reboot affected hosts to activate the patched kernel; the advisories do not report known in-the-wild exploitation.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released **RHSA-2024:6990**, an Important security update for the real-time kernel on Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on x86_64. The update delivers `kernel-rt-5.14.0-70.117.1.rt21.189.el9_0`, addressing 11 Linux kernel vulnerabilities across sparse-memory handling, networking, ACPICA, RDMA, vsock, perf, SUNRPC, and mac80211 Wi-Fi components. Red Hat did not report active exploitation of the flaws. Notable fixes include **CVE-2023-52489**, a locally exploitable sparse-memory race condition that can compromise availability through denial of service when compaction processes device-memory PFNs, and **CVE-2024-40995**, which can trigger an infinite loop and system-wide task hangs in the traffic-control action API when multiple actions use the same index. The advisory also includes a fix for **CVE-2021-47393** affecting the `mlxreg-fan` hardware-monitoring driver. Administrators should install the updated kernel-rt package and reboot affected systems to activate the fixes.
Aug 26, 2026