Loading story…
Red Hat released Important kernel updates to fix CVE-2026-74581, a use-after-free flaw in the Linux IPv6 FIB rule lookup path. In fib6_rule_suppress, a stale res->rt6 pointer can be returned after its associated rt6_info route object has been freed and later released again, creating a potential kernel crash or privilege-escalation condition. Exploitation requires the ability to configure IPv6 routing or FIB rules; the issue is classified as CWE-416.
The remediation is included in RHEL 9 kernel updates, including RHSA-2026:59723 and applicable kernel-rt updates, and in selected RHEL 8.4 AUS and Extended Life Cycle/Long-Life support channels through advisories including RHSA-2026:59994 and RHSA-2026:60485. Administrators should update affected kernel packages and reboot to activate the fix. Blacklisting IPv6 modules does not mitigate affected kernels with IPv6 built in; organizations that do not require IPv6 can consider disabling it through kernel command-line configuration. Related Oracle Linux and AlmaLinux 9 kernel updates also incorporate the broader RHEL 9 kernel fixes; available notices reported no known public exploits.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:61351 for RHEL 10 and RHEL EUS 10.0, updating standard, real-time, 64K-page-size, debug, module, development, tool, and zfcpdump kernel package variants. The referenced record does not identify the underlying CVE or vulnerability class and reports no known public exploits.
Red Hat published Important advisory RHSA-2026:60485 to fix CVE-2026-74581 in affected RHEL 8 kernel packages. The update covers kernel components including kernel-core, kernel-modules, kernel-devel, and kernel tools.
Rocky Linux published RLSA-2026:59821 and RLSA-2026:59737 for Rocky Linux 8 kernel and kernel-rt packages. The advisories address eight kernel vulnerabilities, including CVE-2026-63886, CVE-2026-64320, the ipset race CVE-2026-64189, and Synaptics RMI4 flaws.
Red Hat issued Important advisory RHSA-2026:60438 to remediate CVE-2026-74581 in affected RHEL 9 kernel-rt packages, including the Real Time Linux Kernel components.
AlmaLinux published ALSA-2026:59723 for kernel packages across its AlmaLinux 9 repositories. The update addresses 13 CVEs, including race-condition, use-after-free, and out-of-bounds memory-safety issues.
Oracle Linux released ELSA-2026-59723 for Oracle Linux 9 and 9.8 BaseOS Patch systems. The kernel update addresses the same 13 CVEs covered by RHSA-2026:59723, including CVE-2026-74581.
Red Hat issued Important advisory RHSA-2026:59994 for RHEL 8.4 Extended Life Cycle Long Life and Server AUS systems, fixing CVE-2026-74581 through updated kernel packages. Systems must be rebooted for the remediation to take effect.
Red Hat issued RHSA-2026:59723, an Important RHEL 9 kernel update addressing 13 CVEs, including CVE-2026-74581, CVE-2026-53185, and several Netfilter, SCTP, I2C, and Synaptics driver flaws. A reboot is required after installation.
The Linux kernel upstream advisory for CVE-2026-74581 was published. The issue could be triggered by a local attacker able to configure IPv6 routing or FIB rules, potentially causing a kernel crash or privilege escalation.
CVE-2026-74581 was published as a use-after-free flaw in Linux IPv6 FIB rule lookup. A stale res->rt6 pointer in fib6_rule_suppress can result in operations on freed route memory.
CVE-2026-63886, an iSCSI target CHAP_R length-validation flaw that can lead to unsafe Base64 decoding, was published.
CVE-2026-23003, affecting Linux kernel IPv6 tunneling, was published. The flaw can be exploited locally with low privileges to cause a high availability impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity kernel security updates for supported Red Hat Enterprise Linux 8 and 9 channels, including RHEL 8.6 and 8.8 Extended Update Support and RHEL 9.2 EUS. The updates address **CVE-2024-26735**, a flaw in IPv6 Segment Routing that can cause use-after-free and null-pointer-dereference conditions, and **CVE-2024-26643**, an `nf_tables` handling issue involving anonymous sets with timeouts during unbinding. RHSA-2024:3461 also remediates additional kernel issues in `nft_ct`, IP tunneling, CIFS, and sysfs for RHEL 9.2 support variants. Administrators should install the applicable kernel packages from Red Hat's advisories and reboot affected hosts to activate the fixes. RHEL 9.2 deployments receive kernel version `5.14.0-284.67.1.el9_2`; RHEL 8.6 EUS systems receive kernel version `4.18.0-372.105.1.el8_6`, which also includes fixes for Spectre-BHB mitigation on AmpereOne, an `emac` driver use-after-free, and Linux bridge frame-handling data races.
Aug 27, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released **RHSA-2024:0461** for Red Hat Enterprise Linux 9, updating the kernel to remediate 17 security vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The Important-rated advisory affects RHEL 9 and supported update-service variants on x86_64, ARM64, IBM Z, and IBM Power little-endian systems; administrators must reboot after applying the updated kernel. Among the fixes is **CVE-2023-3777**, a CVSS 7.8 use-after-free flaw in the Linux `nf_tables` netfilter component. A local attacker with `CAP_NET_ADMIN` in a user or network namespace could exploit improper bound-chain validation in `nf_tables_delrule()` to escalate privileges. Red Hat fixed affected RHEL 9 and selected RHEL 9 Extended Update Support kernel and real-time kernel packages, while RHEL 6, 7, and 8 are not affected; pending patching, organizations can prevent the netfilter module from loading and, where operationally feasible, disable user namespaces on non-containerized systems.
Aug 26, 2026