Skip to content
OpenAdvisories
Critical RHSA-2026:0576 13 CVEs

Red Hat Security Advisory: kernel security update

Published Jan 15, 2026 · Updated Sep 25, 2026

Ecosystem: Red Hat

Fixed packages 47

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream bpftool-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel-matched 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-aarch64 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-s390x 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-x86_64 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel-matched 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-doc 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-tools-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel-matched 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream python3-perf-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-abi-stablelists 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-core 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-core 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules-extra 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-aarch64 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-s390x 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-x86_64 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules-extra 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-libs 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-core 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules-extra 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos perf-debuginfo 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf 0:5.14.0-70.161.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf-debuginfo 0:5.14.0-70.161.1.el9_0

Vulnerabilities 13

  • Critical 9.8
    CVE-2025-38724

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68285

    libceph: fix potential use-after-free in have_mon_and_osd_map()

    In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-53675

    scsi: ses: Fix possible desc_ptr out-of-bounds accesses

    In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39982

    Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2023-53705

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-23142

    sctp: detect and prevent references to a freed transport in sendmsg

    In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the mes…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39825

    smb: client: fix race with concurrent opens in rename(2)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-53680

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-39925

    can: j1939: implement NETDEV_UNREGISTER notification handler

    In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not ha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52638

    can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock

    In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53581

    net/mlx5e: Check for NOT_READY flag state after locking

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition wh…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-35868

    smb: client: fix potential UAF in cifs_stats_proc_write()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_write() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68287

    usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dw…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281745
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363300
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393172
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400629
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2401545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402213
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402293
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2405713
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422788
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422801
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0576.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-52638
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52638
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52638
  • article
    https://lore.kernel.org/linux-cve-announce/2024040334-CVE-2023-52638-26a6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53581
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53581
  • article
    https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53581-80fa@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53675
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53675
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53675
  • article
    https://lore.kernel.org/linux-cve-announce/2025100707-CVE-2023-53675-e7ac@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53680
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53680
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53680
  • article
    https://lore.kernel.org/linux-cve-announce/2025100708-CVE-2023-53680-501d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53705
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53705
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53705
  • article
    https://lore.kernel.org/linux-cve-announce/2025102212-CVE-2023-53705-38d9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2024-35868
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-35868
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-35868
  • article
    https://lore.kernel.org/linux-cve-announce/2024051940-CVE-2024-35868-be7a@gregkh/T