Red Hat Security Advisory: kernel security update

Fixed packages 90

Vulnerabilities 7

• Critical 9.8
  CVE-2026-43037

  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• Critical 9.8
  CVE-2026-43501 Public exploit

  ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2026
• High 7.8
  CVE-2026-31419

  net: bonding: fix use-after-free in bond_xmit_broadcast()

  In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 13, 2026
• High 7.8
  CVE-2026-31532

  can: raw: fix ro->uniq use-after-free in raw_rcv()

  In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 23, 2026
• High 7.5
  CVE-2026-31467

  erofs: add GFP_NOIO in the bio completion if needed

  In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 22, 2026
• High 7.1
  CVE-2026-46054

  selinux: fix overlayfs mmap() and mprotect() access checks

  In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• Unscored —
  CVE-2026-31581

  ALSA: 6fire: fix use-after-free on disconnect

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461107
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482025
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25191.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31419
• article
  https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31467
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31467
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31467
• article
  https://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31467-914b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31532
• article
  https://lore.kernel.org/linux-cve-announce/2026042349-CVE-2026-31532-a820@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31581
• article
  https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43037
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43037
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43037
• article
  https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43501
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43501
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43501
• article
  https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43501-63a6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46054
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46054
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46054
• article
  https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46054-b185@gregkh/T