Loading story…
Red Hat released kernel security updates for multiple RHEL 8.4, 9/9.4, and 10.0 support channels, addressing vulnerabilities in networking, NFS, USB audio, Wi-Fi, Bluetooth, storage, cryptography, EFI handling, and speculative-execution mitigations. The advisories include builds 4.18.0-305.182.1.el8_4 for RHEL 8.4 AUS and long-life systems, 5.14.0-427.100.1.el9_4 for RHEL 9.4, and 6.12.0-55.52.1.el10_0 for RHEL 10.0 Extended Update Support and related channels.
Among the fixed issues is CVE-2025-39697, a Moderate-severity NFS write-path use-after-free race that an authenticated client with write access to an NFS export could exploit through carefully timed concurrent writes to crash the kernel, causing remote denial of service. Updates also remediate the ALSA USB-audio out-of-bounds flaw CVE-2022-48701 and other bounds-checking, use-after-free, and protocol-handling defects; Red Hat advises customers to reboot after installation so the patched kernel is loaded. Disabling automatic loading of the NFS kernel module can reduce exposure to CVE-2025-39697 where NFS is not required.
See real exploitation activity before you spend the cycle.
21 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued the Moderate RHSA-2026:0271 kernel update for RHEL 10.0 Extended Update Support and related channels. The kernel 6.12.0-55.52.1.el10_0 update fixes eight vulnerabilities, including CVE-2025-40300 and several out-of-bounds and use-after-free flaws; systems require a reboot.
Red Hat issued the Important RHSA-2025:23463 kernel update for RHEL 8.4 AUS and Extended Life Cycle Long-Life Add-On systems. Kernel 4.18.0-305.182.1.el8_4 remediates 14 vulnerabilities across networking, USB audio, Bluetooth, storage, RDMA, NFS, SCTP, and TCP components.
Red Hat released the Moderate RHSA-2025:21760 update for RHEL 9.4 support channels, providing kernel 5.14.0-427.100.1.el9_4 and fixing nine CVEs, including the NFS race CVE-2025-39697 and VMSCAPE mitigation CVE-2025-40300.
Red Hat released the Moderate RHSA-2025:21112 kernel update for RHEL 9, fixing 13 vulnerabilities including CVE-2025-39697, CVE-2025-40300, and flaws in SunRPC, virtio-vsock, EFI, Wi-Fi, SCSI, and cryptographic components.
RHSA-2025:19106 released fixed RHEL 10 kernel packages for the NFS write-path race condition tracked as CVE-2025-39697.
Red Hat issued Moderate-severity advisory RHSA-2025:17776 for RHEL 10 kernel packages, fixing HID core CVE-2025-38556, ath12k Wi-Fi CVE-2025-39761, and ALSA USB-audio CVE-2025-39757. The update affects RHEL 10 and CodeReady Linux Builder deployments across supported architectures and requires a reboot after installation.
Red Hat issued Moderate-severity advisory RHSA-2025:17760 for RHEL 9 kernel packages, fixing four vulnerabilities in HID core, eventpoll, ALSA USB audio, and the seqiv crypto component. The update applies across RHEL 9 support streams and requires a reboot after installation.
Red Hat published its record for CVE-2025-39697, a Moderate NFS write-path use-after-free race that can allow an NFS client with write access to crash a kernel and cause remote denial of service.
Linux upstream published the CVE-2025-38614 announcement for a semi-unbounded recursion vulnerability in eventpoll (epoll) instance graphs. The flaw could permit graph recursion to roughly 500 levels; the fix enforces EP_MAX_NESTS path limits using improved subtree and upward-depth checks.
Red Hat issued Moderate-severity advisory RHSA-2025:3935 for RHEL 9.4 update channels, providing kernel 5.14.0-427.65.1.el9_4. The update fixes 13 CVEs affecting networking, Wi-Fi, storage, virtualization, NFS, interrupt-controller, and USB-audio components and requires a reboot.
Red Hat tracked CVE-2024-50192, a medium-severity Linux irqchip/gic-v4 race in which userspace could request a VPE affinity change after the VPE was unmapped while its doorbell interrupt remained visible. The upstream fix checks vmapp_count and rejects VMOVP operations when the VPE is no longer mapped.
The Linux kernel upstream advisory announced CVE-2022-48701, an out-of-bounds vulnerability in the ALSA USB-audio __snd_usb_parse_audio_interface() function.
Red Hat Bugzilla recorded CVE-2024-27048, a medium-severity flaw in the Broadcom brcm80211 Wi-Fi driver caused by improper handling of a pmk_op allocation failure. Red Hat later addressed it through RHEL 8, RHEL 9, and RHEL 9.4 EUS kernel advisories.
Marco Benatto reported CVE-2024-26614, a Linux kernel TCP issue involving initialization of accept_queue spinlocks. Red Hat tracked the issue as low severity under bug 2269211; fixes were later provided upstream, in Fedora stable kernels, and through RHEL 8 and RHEL 9 advisories.
Zack Miele reported Red Hat Bug 2267916 for CVE-2021-47101, a low-severity uninitialized-value flaw in the Linux ASIX USB Ethernet driver's asix_mdio_read() function. The issue was resolved upstream and is listed as fixed in Linux kernel versions 5.15.12 and 5.16.
RHSA-2025:23445 released fixed RHEL 8.2 Advanced Update Support kernel packages addressing CVE-2025-39697.
RHSA-2025:22752 released fixed kernel packages for CVE-2025-39697 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On systems.
RHSA-2025:22006 released kernel fixes for CVE-2025-39697 in RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Solutions streams.
Red Hat released RHSA-2025:21917 for RHEL 8 kernel packages and RHSA-2025:21920 for RHEL 8 kernel-rt packages, both addressing CVE-2025-39697.
RHSA-2025:21118 released fixed RHEL 10 kernel packages addressing CVE-2025-39697.
Red Hat addressed the ALSA USB-audio out-of-bounds flaw through multiple RHSA advisories affecting RHEL 7, 8, and 9 extended-lifecycle, update-support, SAP, telecommunications, and mission-critical offerings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
14 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate- and Important-severity Linux kernel security updates across RHEL 8 and RHEL 9 support channels, including Real Time, NFV, SAP Solutions, Extended Life Cycle, Extended Update Support, and Application Update Services offerings. The advisories address vulnerabilities in NFS server processing, SMB/CIFS rename handling, memory-failure recovery, TCP Fast Open, Wi-Fi, Bluetooth, USB audio, EFI variables, SCTP, IPv6 routing, ext4, and network drivers. Updated packages include `4.18.0-553.87.1.el8_10` for RHEL 8.10, `4.18.0-477.120.1.el8_8` for selected RHEL 8.8 channels, `5.14.0-284.148.1.el9_2` for RHEL 9.2 SAP-related channels, and `5.14.0-570.69.1.el9_6` for RHEL 9.6. The updates include a fix for **CVE-2023-53513**, an NBD `nbd_ioctl` validation flaw in which an oversized ioctl argument could cause signed integer overflow during block-write processing and unexpected behavior when narrowed on 64-bit systems. Red Hat also shipped the corresponding real-time kernel build, `4.18.0-553.87.1.rt7.428.el8_10`, for affected RHEL 8 real-time deployments. Organizations should apply the appropriate kernel packages for their subscribed architecture and support channel, then reboot systems to activate the fixes; the advisories do not state that the listed issues are under active exploitation.
Aug 28, 2026
Red Hat released kernel security updates for RHEL 9.6 and RHEL 10.0 that address multiple vulnerabilities across NFSD, NFS, KVM on ARM64, ALSA UMP, Intel ASoC, libceph, and other kernel subsystems. RHSA-2026:0804 provides kernel `5.14.0-570.79.1.el9_6` for RHEL 9.6 support channels and is rated Important, while Moderate-rated RHSA-2026:1236 provides kernel `6.12.0-55.55.1.el10_0` for RHEL 10.0, including applicable EUS and CodeReady Linux Builder repositories across supported architectures. The updates remediate **CVE-2025-37891**, an ALSA Universal MIDI Packet conversion flaw in which a four-byte buffer could receive up to six bytes of malformed SysEx data, potentially causing memory corruption; the upstream correction expands the buffer to six bytes. Red Hat also previously updated RHEL 8 kernels through RHSA-2025:21917 to fix an NFS write-update race condition, **CVE-2025-39697**, and an i40e driver index-validation flaw, **CVE-2025-39971**. Administrators should deploy the applicable kernel packages and reboot affected systems for fixes to take effect.
Aug 25, 2026
Red Hat released Moderate-severity Linux kernel updates for supported **RHEL 8** and **RHEL 9** channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory. Key fixes include **CVE-2025-39751**, a buffer overflow in the ALSA HDA CA0132 driver's `add_tuning_control()` function caused by unbounded `sprintf`; **CVE-2025-39849**, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and **CVE-2022-50087**, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build `4.18.0-553.80.1.el8_10`, RHEL 8.8 SAP/TUS build `4.18.0-477.116.1.el8_8`, or RHEL 8.6 build `4.18.0-372.166.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026