Skip to content
OpenAdvisories
Critical RHSA-2026:1690 19 CVEs

Red Hat Security Advisory: kernel security update

Published Feb 3, 2026 · Updated Aug 27, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 kernel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-abi-stablelists 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-uki-virt 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-aarch64 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-ppc64le 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-s390x 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-x86_64 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-doc 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt-addons 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel-matched 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-core 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-extra 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf-debuginfo 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rtla 0:6.12.0-124.31.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rv 0:6.12.0-124.31.1.el10_1

Vulnerabilities 19

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68301

    net: atlantic: fix fragment overflow handling in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-40318

    Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38349

    eventpoll: don't decrement ep refcount while still holding the ep mutex

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38453

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU

    In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Co…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38568

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

    In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38731

    drm/xe: Fix vm_bind_ioctl double free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40248

    vsock: Ignore signal/timeout on connect() if already established

    In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40251

    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

    In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.6
    CVE-2025-40301

    Bluetooth: hci_event: validate skb length for unknown CC opcode

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-37819

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40154

    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

    In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40294

    Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68305

    Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2365032
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2381870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383516
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2389507
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393488
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414506
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414523
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418872
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418892
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419891
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419896
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419920
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422836
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422840
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1690.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-37819
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-37819
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-37819
  • article
    https://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37819-a3b9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38022
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38022
  • article
    https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38349
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38349
  • article
    https://lore.kernel.org/linux-cve-announce/2025071819-CVE-2025-38349-ee39@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38453
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38453
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38453
  • article
    https://lore.kernel.org/linux-cve-announce/2025072505-CVE-2025-38453-69b1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38568
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38568