Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 20

• Critical 9.8
  CVE-2026-46195

  smb: client: validate dacloffset before building DACL pointers

  In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Critical 9.4
  CVE-2026-31685

  netfilter: ip6t_eui64: reject invalid MAC header for all packets

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 25, 2026
• Critical 9.1
  CVE-2026-23455

  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2026
• High 8.8
  CVE-2026-31408

  Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 6, 2026
• High 8.8
  CVE-2026-31709

  smb: client: validate the whole DACL before rewriting it in cifsacl

  In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incomin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2026
• High 8.8
  CVE-2026-43110

  wifi: brcmfmac: validate bsscfg indices in IF events

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.8
  CVE-2026-43158

  xfs: fix freemap adjustments when adding xattrs to leaf blocks

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.2
  CVE-2026-43190

  netfilter: xt_tcpmss: check remaining length before reading optlen

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.1
  CVE-2026-43051

  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

  In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2025-38653

  proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

  In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2025
• High 7.8
  CVE-2025-68183

  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025
• High 7.8
  CVE-2025-68724

  crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

  In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.8
  CVE-2025-71089

  iommu: disable SVA when CONFIG_X86 is set

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2026-23392

  netfilter: nf_tables: release flowtable after rcu grace period on error

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 25, 2026
• High 7.8
  CVE-2026-43023

  Bluetooth: SCO: fix race conditions in sco_sock_connect()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-43303

  mm/page_alloc: clear page->private in free_pages_prepare()

  In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• Unscored —
  CVE-2025-68366

  nbd: defer config unlock in nbd_genl_connect

  In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• Unscored —
  CVE-2026-31684

  net: sched: act_csum: validate nested VLAN headers

  In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 25, 2026
• Unscored —
  CVE-2026-43020

  Bluetooth: MGMT: validate LTK enc_size on load

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• Unscored —
  CVE-2026-43027

  netfilter: nf_conntrack_helper: pass helper to expect cleanup

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2390372
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424881
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461759
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464496
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468091
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21556.json
• report
  https://access.redhat.com/security/cve/CVE-2025-38653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38653
• article
  https://lore.kernel.org/linux-cve-announce/2025082238-CVE-2025-38653-35ba@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68183
• article
  https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68366
• article
  https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2025-68366-b367@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68724
• article
  https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2025-68724-4d3c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-71089
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71089