Skip to content
OpenAdvisories
Critical RHSA-2026:1494 13 CVEs

Red Hat Security Advisory: kernel security update

Published Jan 29, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 47

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream bpftool-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel-matched 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-aarch64 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-s390x 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-x86_64 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel-matched 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-doc 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-tools-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel-matched 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream python3-perf-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-abi-stablelists 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-core 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-core 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules-extra 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-aarch64 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-s390x 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-x86_64 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules-extra 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-libs 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-core 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules-extra 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos perf-debuginfo 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf 0:5.14.0-70.163.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf-debuginfo 0:5.14.0-70.163.1.el9_0

Vulnerabilities 13

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-37849

    KVM: arm64: Tear down vGIC on failed vCPU creation

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39971

    i40e: fix idx validation in config queues msg

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-49290

    mac80211: fix potential double free on mesh join

    In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on mesh join While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a pote…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49581

    be2net: Fix buffer overflow in be_get_module_eeprom

    In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module suppor…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49667

    net: bonding: fix use-after-free after 802.3ad slave unbind

    In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53539

    RDMA/rxe: Fix incomplete state save in rxe_requester

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37789

    net: openvswitch: fix nested key length validation in the set() action

    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38051

    smb: client: Fix use-after-free in cifs_fill_dirent

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40248

    vsock: Ignore signal/timeout on connect() if already established

    In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40277

    drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2023-53034

    ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

    In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40154

    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

    In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2347727
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2347982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2348269
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360239
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363315
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2365271
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2401510
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404108
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418872
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419954
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1494.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-49290
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49290
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49290
  • article
    https://lore.kernel.org/linux-cve-announce/2025022633-CVE-2022-49290-42e8@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-49581
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49581
  • article
    https://lore.kernel.org/linux-cve-announce/2025022608-CVE-2022-49581-b9dc@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-49667
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49667
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49667
  • article
    https://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49667-4710@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53034
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53034
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53034
  • article
    https://lore.kernel.org/linux-cve-announce/2025041650-CVE-2023-53034-8c3b@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53539
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53539
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53539
  • article
    https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53539-4411@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-37789
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-37789
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-37789
  • article
    https://lore.kernel.org/linux-cve-announce/2025050119-CVE-2025-37789-3f0b@gregkh/T