Skip to content
OpenAdvisories
Critical RHSA-2026:21557 18 CVEs

Red Hat Security Advisory: kernel security update

Published May 28, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 kernel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-abi-stablelists 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-uki-virt 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-doc 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt-addons 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf-debuginfo 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rtla 0:6.12.0-211.18.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rv 0:6.12.0-211.18.1.el10_2

Vulnerabilities 18

  • Critical 9.8
    CVE-2024-56645

    can: j1939: j1939_session_new(): fix skb reference counting

    In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-43051

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68183

    ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

    In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43023

    Bluetooth: SCO: fix race conditions in sco_sock_connect()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43116

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43303

    mm/page_alloc: clear page->private in free_pages_prepare()

    In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-43006

    io_uring/rsrc: reject zero-length fixed buffer import

    In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-23375

    mm: thp: deny THP for files on anonymous inodes

    In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_fil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-31684

    net: sched: act_csum: validate nested VLAN headers

    In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43020

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43027

    netfilter: nf_conntrack_helper: pass helper to expect cleanup

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43205

    dpaa2-switch: validate num_ifs to prevent out-of-bounds write

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2334560
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422699
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451199
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464369
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464402
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467005
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467090
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468091
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21557.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-56645
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-56645
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-56645
  • article
    https://lore.kernel.org/linux-cve-announce/2024122738-CVE-2024-56645-bc11@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68183
  • article
    https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23375
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23375
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23375
  • article
    https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23375-91b1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23392
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23392
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23392
  • article
    https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23392-fd9d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23455
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23455