Skip to content
OpenAdvisories
Critical RHSA-2026:25121 13 CVEs

Red Hat Security Advisory: kernel security update

Published Jun 11, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos bpftool 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos bpftool-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-abi-stablelists 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-core 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-core 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-devel 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-modules 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-modules-extra 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-s390x 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-devel 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-doc 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-modules 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-modules-extra 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools-libs 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-core 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-devel 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-modules 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perf 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perf-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-perf 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-perf-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb bpftool-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debug-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-aarch64 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-x86_64 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-tools-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-tools-libs-devel 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb perf-debuginfo 0:4.18.0-553.132.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-perf-debuginfo 0:4.18.0-553.132.1.el8_10

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-22984

    libceph: prevent potential out-of-bounds reads in handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43037

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43038

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-31613

    smb: client: fix OOB reads parsing symlink error response

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53781

    smc: Fix use-after-free in tcp_write_timer_handler().

    In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21858

    geneve: Fix use-after-free in geneve_find_dev().

    In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46181

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22990

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

    In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68366

    nbd: defer config unlock in nbd_genl_connect

    In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31581

    ALSA: 6fire: fix use-after-free on disconnect

    In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351619
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420279
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424881
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461471
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461480
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464351
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464397
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467234
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482532
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25121.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-53781
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53781
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53781
  • article
    https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53781-cb1d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-21858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-21858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-21858
  • article
    https://lore.kernel.org/linux-cve-announce/2025031215-CVE-2025-21858-3986@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68366
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68366
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68366
  • article
    https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2025-68366-b367@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-22984
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22984
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22984
  • article
    https://lore.kernel.org/linux-cve-announce/2026012349-CVE-2026-22984-001c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-22990
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22990
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22990
  • article
    https://lore.kernel.org/linux-cve-announce/2026012351-CVE-2026-22990-a62e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23392
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23392
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23392
  • article
    https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23392-fd9d@gregkh/T