Skip to content
OpenAdvisories
Critical RHSA-2026:0453 9 CVEs

Red Hat Security Advisory: kernel security update

Published Jan 14, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 kernel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-abi-stablelists 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-uki-virt 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-aarch64 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-ppc64le 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-s390x 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-x86_64 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-doc 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt-addons 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel-matched 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-core 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-extra 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf-debuginfo 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rtla 0:6.12.0-124.27.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rv 0:6.12.0-124.27.1.el10_1

Vulnerabilities 9

  • Critical 9.8
    CVE-2025-40176

    tls: wait for pending async decryptions if tls_strp_msg_hold fails

    In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39806

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

    In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39966

    iommufd: Fix race during abort for file descriptors

    In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40277

    drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-40240

    sctp: avoid NULL dereference when chunk data buffer is missing

    In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2025-39840

    audit: fix out-of-bounds read in audit_compare_dname_path()

    In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2025-39905

    net: phylink: add lock for serializing concurrent pl->phydev writes with resolver

    In the Linux kernel, the following vulnerability has been resolved: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_ph…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39843

    mm: slub: avoid wake up kswapd in set_track_prepare

    In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68287

    usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dw…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395807
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396936
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396941
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418832
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419954
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422788
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0453.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-39806
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39806
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39806
  • article
    https://lore.kernel.org/linux-cve-announce/2025091613-CVE-2025-39806-f74d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39840
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39840
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39840
  • article
    https://lore.kernel.org/linux-cve-announce/2025091902-CVE-2025-39840-bad6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39843
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39843
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39843
  • article
    https://lore.kernel.org/linux-cve-announce/2025091903-CVE-2025-39843-0702@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39905
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39905
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39905
  • article
    https://lore.kernel.org/linux-cve-announce/2025100108-CVE-2025-39905-157f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39966
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39966
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39966
  • article
    https://lore.kernel.org/linux-cve-announce/2025101553-CVE-2025-39966-736b@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40176
  • article
    https://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40176-f2e3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40240
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40240
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40240
  • article
    https://kernelcve.org/list/?q=CVE-2025-40240