Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 11

• Critical 9.8
  CVE-2026-31402 Public exploit

  nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

  In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2026
• High 8.8
  CVE-2026-23193

  scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Simi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 14, 2026
• High 7.8
  CVE-2025-39981

  Bluetooth: MGMT: Fix possible UAFs

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2025
• High 7.8
  CVE-2025-68800

  mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not chan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2026-23066

  rxrpc: Fix recvmsg() unconditional requeue

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• High 7.8
  CVE-2026-23111 Public exploit

  netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 13, 2026
• High 7.8
  CVE-2026-23171

  bonding: fix use-after-free due to enslave fail after slave array update

  In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 14, 2026
• High 7.8
  CVE-2026-23231 Public exploit

  netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hook…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 4, 2026
• High 7.1
  CVE-2026-23204

  net/sched: cls_u32: use skb_header_pointer_careful()

  In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a rep…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 14, 2026
• Unscored —
  CVE-2026-23097

  migrate: correct lock ordering for hugetlb file folios

  In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• Unscored —
  CVE-2026-23144

  mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 14, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2404105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436802
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436805
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454844
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10108.json
• report
  https://access.redhat.com/security/cve/CVE-2025-39981
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39981
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39981
• article
  https://lore.kernel.org/linux-cve-announce/2025101559-CVE-2025-39981-fe1d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68800
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68800
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68800
• article
  https://lore.kernel.org/linux-cve-announce/2026011307-CVE-2025-68800-39d2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23066
• article
  https://lore.kernel.org/linux-cve-announce/2026020416-CVE-2026-23066-8e44@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23097
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23097
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23097
• article
  https://kernelcve.org/list/?q=CVE-2026-23097
• article
  https://lore.kernel.org/linux-cve-announce/2026020427-CVE-2026-23097-a591@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23111
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23111
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23111
• article
  https://lore.kernel.org/linux-cve-announce/2026021300-CVE-2026-23111-9762@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23144
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23144
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23144
• article
  https://lore.kernel.org/linux-cve-announce/2026021417-CVE-2026-23144-297b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23171