Loading story…
Red Hat released updates for Red Hat Enterprise Linux 8 to fix CVE-2021-46939, a moderate-severity Linux kernel tracing flaw that can recursively acquire a spin lock when tracing is re-entered through the function graph tracer. A local attacker or user able to trigger the affected tracing conditions could cause a system deadlock and denial of service, including during suspend/resume testing. Red Hat rated the issue CVSS 5.5; RHEL 9 is not affected, while RHEL 6 and 7 are outside the affected support scope.
Red Hat also issued RHSA-2024:5439 for OpenShift Container Platform 4.15, delivering version 4.15.28 with updated container images and packages. The release remediates the Linux kernel route-management use-after-free vulnerability CVE-2024-36971, Go net/http memory-exhaustion flaw CVE-2023-45290, and Go net/netip IPv4-mapped IPv6 address-handling issue CVE-2024-24790; it also updates Kubernetes to 1.28.12. OpenShift 4.15 customers on x86_64, s390x, ppc64le, and aarch64 should upgrade through their supported release channel or the OpenShift web console.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2024:5439 and released OpenShift Container Platform 4.15.28. The update fixes CVE-2024-36971, CVE-2023-45290, and CVE-2024-24790, and updates Kubernetes to version 1.28.12.
Red Hat released RHEL 8 kernel and kernel-rt updates RHSA-2024:5101 and RHSA-2024:5102 to fix CVE-2021-46939, a tracing-related deadlock that can hang systems and cause denial of service. RHEL 9 kernel packages were listed as not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of OpenShift Container Platform security updates across supported branches, including **4.13.68**, **4.15.66**, **4.16.64**, **4.18.44**, and **4.19.33**, to remediate vulnerabilities in bundled components and container images. The advisories cover deployments on **RHEL 8** and **RHEL 9** across `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat urged customers to upgrade through the appropriate release channel using the OpenShift CLI or web console. The fixes address multiple privilege-escalation and memory-safety issues, notably **CVE-2026-4878** in `libcap`, a TOCTOU race in `cap_set_file()` that can let an attacker influence capability assignment and gain root privileges, and **CVE-2026-35385** in OpenSSH, where use of legacy `scp` with `-O` by root without `-p` can unexpectedly preserve `setuid` or `setgid` bits on downloaded files. Additional patched issues include Linux kernel flaws such as **CVE-2026-43037**, **CVE-2026-46300**, **CVE-2026-46243**, and **CVE-2026-46331`, along with vulnerabilities in `jq` and `rsync`, ranging from denial of service and out-of-bounds reads to local privilege escalation.
Aug 25, 2026
Red Hat released fixes for three Go standard-library denial-of-service vulnerabilities: **CVE-2024-34155** in `go/parser`, **CVE-2024-34156** in `encoding/gob`, and **CVE-2024-34158** in `go/build/constraint`. Applications that parse or decode attacker-controlled input can panic after deeply nested Go literals, gob structures, or legacy `// +build` expressions exhaust stack space. Red Hat rated the issues Important in affected product advisories; no exploitation evidence is identified in the supplied advisories. The fixes were delivered through updated Go toolsets for RHEL 8 and RHEL 9 and propagated to container tooling including Podman, Buildah, CRI-O, and the RHEL 8 container-tools module. Red Hat also issued updated images and packages for OpenShift Container Platform 4.12 through 4.17, OpenShift API for Data Protection, OpenStack Platform, Migration Toolkit for Containers, and several OpenShift operators. Organizations should update affected systems, container tools, and OpenShift clusters through their applicable Red Hat release channels, including all supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE deployments.
Aug 27, 2026
Red Hat released a series of **Important** security updates for Red Hat Enterprise Linux and OpenShift Container Platform to address Linux kernel vulnerabilities including `CVE-2025-40026` in **KVM on x86** and `CVE-2026-52923` in the **SysV IPC checkpoint/restore path**. The KVM flaw affects nested virtualization: after KVM has allowed an L2 guest I/O operation, changes to L1 or host userspace I/O interception during the userspace exit can cause KVM to wrongly re-check intercepts, leave `vcpu->arch.pio.count` non-zero, trigger a `WARN`, and disrupt guest execution. The IPC flaw stems from `ipc_idr_alloc()` passing `ids->next_id` to `idr_alloc()` without enforcing the valid `ipc_mni` range, allowing out-of-range allocation, stale IDR entries, and a potential use-after-free during `/proc/sysvipc/shm` traversal. Affected fixes were published across multiple product streams, including **RHEL 8.4**, **RHEL 8.8**, **RHEL 9.4**, **RHEL 9.6**, and **OpenShift Container Platform 4.18.53**, alongside other kernel CVEs such as `CVE-2025-10263`, `CVE-2026-31787`, and `CVE-2026-53059`. Red Hat rated both headline issues as **Moderate**, but noted that `CVE-2026-52923` has been associated with a reported local privilege-escalation exploit targeting **RHEL 10**, while `CVE-2025-40026` can be mitigated by disabling nested virtualization for `kvm_intel` and `kvm_amd`. Red Hat said updated kernel packages and release images are available for multiple architectures and advised customers to **reboot systems after applying kernel updates** and upgrade OpenShift clusters through the supported release channels.
Aug 25, 2026