Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2026:13936 9 CVEs

Red Hat Security Advisory: kernel security update

Published May 6, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 47

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream bpftool-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel-matched 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-aarch64 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-s390x 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-x86_64 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel-matched 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-doc 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-tools-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel-matched 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream python3-perf-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-abi-stablelists 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-core 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-core 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules-extra 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-aarch64 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-s390x 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-x86_64 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules-extra 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-libs 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-core 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules-extra 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos perf-debuginfo 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf 0:5.14.0-70.178.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf-debuginfo 0:5.14.0-70.178.1.el9_0

Vulnerabilities 9

  • High 7.8
    CVE-2026-31431 Exploited Public exploit EPSS 98%

    crypto: algif_aead - Revert to operating out-of-place

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux Alpine
    KEV May 1, 2026
  • Critical 9.8
    CVE-2026-31402 Public exploit

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-23193

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Simi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-23401

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37861

    scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue

    In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23191

    ALSA: aloop: Fix racy access at PCM trigger

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23243

    RDMA/umad: Reject negative data_len in ib_umad_write

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23097

    migrate: correct lock ordering for hugetlb file folios

    In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43077

    crypto: algif_aead - Fix minimum RX size check for decryption

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2365256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436802
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439947
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448594
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453803
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454844
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2460538
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13936.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-37861
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-37861
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-37861
  • article
    https://lore.kernel.org/linux-cve-announce/2025050922-CVE-2025-37861-ab7f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23097
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23097
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23097
  • article
    https://kernelcve.org/list/?q=CVE-2026-23097
  • article
    https://lore.kernel.org/linux-cve-announce/2026020427-CVE-2026-23097-a591@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23191
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23191
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23191
  • article
    https://lore.kernel.org/linux-cve-announce/2026021433-CVE-2026-23191-f990@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23193
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23193
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23193
  • article
    https://lore.kernel.org/linux-cve-announce/2026021434-CVE-2026-23193-2c6c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23243
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23243
  • article
    https://lore.kernel.org/linux-cve-announce/2026031816-CVE-2026-23243-b88e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23401
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23401
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23401
  • article
    https://lore.kernel.org/linux-cve-announce/2026040108-CVE-2026-23401-956d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31402
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31402
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31402
  • article
    https://lore.kernel.org/linux-cve-announce/2026040327-CVE-2026-31402-3e6a@gregkh/T