Skip to content
OpenAdvisories
Critical RHSA-2026:0535 11 CVEs

Red Hat Security Advisory: kernel security update

Published Jan 14, 2026 · Updated Sep 25, 2026

Ecosystem: Red Hat

Fixed packages 71

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream bpftool-debuginfo 0:7.0.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-devel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-devel-matched 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-devel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-devel-matched 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-devel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-devel-matched 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-aarch64 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-s390x 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-x86_64 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-devel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-devel-matched 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-doc 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-tools-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-devel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-devel-matched 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream perf 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream perf-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python3-perf-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream rtla 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos bpftool 0:7.0.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos bpftool-debuginfo 0:7.0.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules-extra 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules-extra 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-abi-stablelists 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules-extra 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-uki-virt 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-aarch64 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-s390x 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-x86_64 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules-extra 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools-libs 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-uki-virt 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules-core 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules-extra 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos perf-debuginfo 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos python3-perf 0:5.14.0-284.152.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos python3-perf-debuginfo 0:5.14.0-284.152.1.el9_2

Vulnerabilities 11

  • Critical 9.8
    CVE-2025-38724

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-40176

    tls: wait for pending async decryptions if tls_strp_msg_hold fails

    In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68285

    libceph: fix potential use-after-free in have_mon_and_osd_map()

    In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-53675

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses

    In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39982

    Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53539

    RDMA/rxe: Fix incomplete state save in rxe_requester

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39825

    smb: client: fix race with concurrent opens in rename(2)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-53680

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-39925

    can: j1939: implement NETDEV_UNREGISTER notification handler

    In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not ha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50447

    Bluetooth: hci_conn: Fix crash on hci_create_cis_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix crash on hci_create_cis_sync When attempting to connect multiple ISO sockets without using DEFER_SETUP may result in the following crash: BUG: KASAN: null-ptr-deref i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68287

    usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dw…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393172
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400629
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400804
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2401510
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402213
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402293
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422788
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422801
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0535.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-50447
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50447
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50447
  • article
    https://lore.kernel.org/linux-cve-announce/2025100115-CVE-2022-50447-4de6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53539
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53539
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53539
  • article
    https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53539-4411@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53675
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53675
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53675
  • article
    https://lore.kernel.org/linux-cve-announce/2025100707-CVE-2023-53675-e7ac@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53680
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53680
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53680
  • article
    https://lore.kernel.org/linux-cve-announce/2025100708-CVE-2023-53680-501d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38724
  • article
    https://lore.kernel.org/linux-cve-announce/2025090401-CVE-2025-38724-5309@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39825
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39825
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39825
  • article
    https://lore.kernel.org/linux-cve-announce/2025091616-CVE-2025-39825-8a7a@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39925
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39925