Loading story…
Red Hat released RHSA-2026:66000, an Important-rated update for Red Hat Enterprise Linux 8, fixing seven Linux kernel vulnerabilities in cryptographic request handling, Netfilter conntrack and SYN proxy processing, rhashtable iteration, SMB DFS referrals, NVMe-over-RDMA inline-data handling, and bridge fast-leave behavior. The fixed release, 4.18.0-553.160.1.el8_10, is available for x86_64, s390x, ppc64le, and aarch64 systems, including applicable Extended Life Cycle and CodeReady Linux Builder repositories.
Notable fixes include a stack out-of-bounds write in SIP/SDP NAT processing (CVE-2026-53002), a potential use-after-free caused by a stale TCP-header pointer in Netfilter SYN proxy handling (CVE-2026-64007), a use-after-free in rhashtable iterator restarts (CVE-2026-64563), and insufficient validation of SMB DFS referral PathConsumed values (CVE-2026-68343). AlmaLinux 8 has issued a corresponding update for the same seven CVEs; no known exploitation was reported in the referenced notices. Administrators should update affected kernel packages and reboot systems to load the patched kernel.
See real exploitation activity before you spend the cycle.
22 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:67720 for RHEL EUS 9.6 and RHSA-2026:67723 for RHEL 9.2, addressing separate sets of 11 and 10 kernel CVEs, respectively. Both notices state that no known exploits were available.
Red Hat published RHSA-2026:67277 to patch an unspecified vulnerability affecting RHEL 10 kernel-related packages.
Red Hat published RHSA-2026:67114 to patch an unspecified vulnerability affecting RHEL 10 and RHEL EUS 10.0 kernel package variants.
Miracle Linux published AXSA-2026-1815 for Miracle Linux 8 kernel packages, addressing 14 CVEs including CVE-2024-57849, CVE-2025-71132, and multiple 2026 kernel vulnerabilities.
Rocky Linux published RLSA-2026:66355 and Oracle Linux published ELSA-2026-66355-0 to patch the unspecified kernel vulnerability affecting their Linux 10 distributions.
Red Hat issued Important-rated RHSA-2026:66325 for RHEL 8, updating the kernel to 4.18.0-553.162.1.el8_10 and fixing 15 CVEs across SCSI, networking, Netfilter, SCTP, TIPC, key-management, and ixgbevf components. Systems require a reboot after installation.
A patch for the unspecified vulnerability affecting CentOS 9 kernel packages and related tooling was published.
Oracle Linux published ELSA-2026-64808-0 for Oracle Linux 9 kernel packages, addressing eight CVEs including CVE-2025-38004 and seven CVEs assigned in 2026.
A kernel patch for the unspecified vulnerability affecting RHEL 10.2 was published under RHSA-2026:66355.
Red Hat issued Important-rated RHSA-2026:66000 for RHEL 8, updating the kernel to 4.18.0-553.160.1.el8_10 and fixing seven CVEs, including CVE-2026-43493, CVE-2026-53002, and CVE-2026-64007. Updated systems must be rebooted for the fixes to take effect.
AlmaLinux published a kernel patch for AlmaLinux 9 under ALSA-2026:64808, covering the vulnerability information associated with the advisory 64808 update.
Vulnerability information was published for an unspecified kernel issue affecting RHEL 10.2, Rocky Linux 10, and Oracle Linux 10. The supplied notices state that no known exploits were available.
An unspecified vulnerability affecting RHEL 10 kernel-related packages was published.
The Linux kernel upstream published an advisory for CVE-2026-64007, involving a stale TCP-header pointer in Netfilter SYN proxy processing after skb_ensure_writable().
The Linux kernel upstream published an advisory for CVE-2026-53091, a GSO packet-processing issue in qdisc_pkt_len_segs_init(). The remediation pulls required headers with pskb_may_pull() and drops malformed GSO packets earlier.
An unspecified vulnerability affecting RHEL 10 and RHEL EUS 10.0 kernel package variants was published.
Vulnerability information was published for 11 CVEs affecting RHEL EUS 9.6 kernel packages, including CVE-2026-46117, CVE-2026-53000, CVE-2026-63887, and CVE-2026-68166.
Vulnerability information was published for seven Linux kernel flaws later addressed in RHEL 8 by RHSA-2026:66000, including pcrypt, Netfilter, rhashtable, SMB, NVMe-over-RDMA, and bridge issues.
Vulnerability information for a set of ten kernel CVEs affecting RHEL 9.2 was published, including CVE-2026-43114, CVE-2026-45998, CVE-2026-53006, and CVE-2026-64304.
A vulnerability affecting CentOS 9 kernel packages and related tooling was published. The supplied notice does not identify the CVE.
Vulnerability information dated June 8, 2025 was published for the kernel update later tracked as ELSA-2026-64808 for Oracle Linux 9 and ALSA-2026:64808 for AlmaLinux 9; the Oracle notice includes CVE-2025-38004 and seven 2026 CVEs.
Vulnerability information for CVE-2024-57849 was published, describing a local kernel issue with potentially high confidentiality, integrity, and availability impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
29 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8.8 SAP and Telecommunications Update Services, RHEL 9 and 9.4 support channels, and RHEL 10 offerings. The advisories address memory-corruption, use-after-free, out-of-bounds read/write, integer-overflow, information-disclosure, and denial-of-service vulnerabilities that could cause service disruption or, in some cases, privilege escalation. Affected packages span x86_64, s390x, ppc64le, and aarch64 systems, including SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder channels. Notable fixes include MPTCP use-after-free flaw `CVE-2025-40133`, corrected in RHEL 10 through RHSA-2026:2282, and `CVE-2025-68811`, an `svcrdma` copy-offset defect that could cause `memcpy` operations outside the current page and was fixed across supported RHEL 9 and 10 releases. Other patched issues include `CVE-2025-68349`, `CVE-2026-22998`, and `CVE-2026-23074`; RHEL 8.8 customers should deploy kernel version `4.18.0-477.130.1.el8_8`. Red Hat requires systems to be rebooted after installation for the kernel fixes to take effect.
Aug 26, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026