Loading story…
Red Hat released RPM Package Manager updates for Red Hat Enterprise Linux 8 to remediate CVE-2021-35937, CVE-2021-35938, and CVE-2021-35939, three moderate-severity flaws that could allow a local unprivileged attacker to obtain root privileges. The vulnerabilities stem from incomplete unsafe-symlink protections and race conditions during package installation: a TOCTOU condition in symlink checks, races while RPM applies ownership, permissions, or file capabilities, and insufficient validation of intermediary directories in a target path.
The fixes are distributed through advisories including RHSA-2024:0424 for RHEL 8.6 lifecycle and update-service channels, which supplies rpm-4.14.3-26.el8_6, and RHSA-2024:0647 for supported RHEL 8 and Extended Life Cycle 8.10 variants, which supplies rpm-4.14.3-28.el8_9. Affected architectures include x86_64, s390x, ppc64le, and aarch64; Red Hat also issued related fixes for applicable OpenShift and Red Hat OpenShift Data Foundation components. Organizations should apply the appropriate RPM updates and restart applications linked against the RPM library after installation; Red Hat lists no separate qualifying mitigation.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:0647 for RHEL 8, fixing CVE-2021-35937, CVE-2021-35938, and CVE-2021-35939. The advisory supplied rpm-4.14.3-28.el8_9 and applied to supported RHEL 8 architectures and Extended Life Cycle 8.10 variants.
Red Hat issued RHSA-2024:0582 to fix CVE-2021-35937, CVE-2021-35938, and CVE-2021-35939 for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat issued fixes for CVE-2021-35937, CVE-2021-35938, and CVE-2021-35939 in RHEL 9, RHEL 9.0 EUS, and RHEL 9.2 EUS through RHSA-2024:0463, RHSA-2024:0435, and RHSA-2024:0453, respectively.
Red Hat published RHSA-2024:0424 for RHEL 8.6 lifecycle and update-service channels. The RPM update fixed CVE-2021-35937, CVE-2021-35938, and CVE-2021-35939, supplying RPM version 4.14.3-26.el8_6.
RPM maintainers considered the TOCTOU directory-symlink safety flaw tracked as CVE-2021-35937 fixed in RPM 4.18, which was in alpha during May 2022. The remediation required substantial RPM-internal refactoring rather than a standalone patch.
CVE-2021-35939, an RPM improper-link-resolution flaw stemming from incomplete prior unsafe-symlink protections, was publicly disclosed.
CVE-2021-35938, a symbolic-link race condition in RPM that could permit local privilege escalation, was publicly disclosed.
Red Hat issued RHSA-2024:1477, fixing the three RPM vulnerabilities in OpenShift Container Platform 4.13 windows-machine-config-operator-bundle and windows-machine-config-rhel9-operator components.
Red Hat issued RHSA-2024:1383, fixing the three RPM vulnerabilities in the RHODF-4.15-RHEL-9 cephcsi-rhel9 and mcg-core-rhel9 components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026