Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 11

• Critical 9.8
  CVE-2026-43037

  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• Critical 9.8
  CVE-2026-43125

  dlm: validate length in dlm_search_rsb_tree

  In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-43501 Public exploit

  ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2026
• High 7.8
  CVE-2026-31419

  net: bonding: fix use-after-free in bond_xmit_broadcast()

  In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 13, 2026
• High 7.8
  CVE-2026-31508

  net: openvswitch: Avoid releasing netdev before teardown completes

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 22, 2026
• High 7.8
  CVE-2026-43056

  net: mana: fix use-after-free in add_adev() error path

  In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-43116

  netfilter: ctnetlink: ensure safe access to master conntrack

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• High 7.8
  CVE-2026-45852

  RDMA/rxe: Fix double free in rxe_srq_from_init

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46181

  RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Unscored —
  CVE-2026-23216

  scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 18, 2026
• Unscored —
  CVE-2026-31581

  ALSA: 6fire: fix use-after-free on disconnect

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467234
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482532
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25217.json
• report
  https://access.redhat.com/security/cve/CVE-2026-23216
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23216
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23216
• article
  https://lore.kernel.org/linux-cve-announce/2026021800-CVE-2026-23216-6c63@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31419
• article
  https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31508
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31508
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31508
• article
  https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31508-4def@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31581
• article
  https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43037
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43037
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43037
• article
  https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43056
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43056
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43056
• article
  https://lore.kernel.org/linux-cve-announce/2026050108-CVE-2026-43056-fefd@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43116