Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 13

• Critical 9.8
  CVE-2026-22984

  libceph: prevent potential out-of-bounds reads in handle_auth_done()

  In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 23, 2026
• Critical 9.1
  CVE-2025-71116

  libceph: make decode_pool() more resilient against corrupted osdmaps

  In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expect…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 14, 2026
• Critical 9.1
  CVE-2026-23455

  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2026
• High 8.8
  CVE-2026-43110

  wifi: brcmfmac: validate bsscfg indices in IF events

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.2
  CVE-2026-43190

  netfilter: xt_tcpmss: check remaining length before reading optlen

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.1
  CVE-2025-40135

  ipv6: use RCU in ip6_xmit()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 8.1
  CVE-2025-40158

  ipv6: use RCU in ip6_output()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2025-40170

  net: use dst_dev_rcu() in sk_setup_caps()

  In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2025-68724

  crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

  In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.8
  CVE-2025-71089

  iommu: disable SVA when CONFIG_X86 is set

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2026-31508

  net: openvswitch: Avoid releasing netdev before teardown completes

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 22, 2026
• High 7.5
  CVE-2026-22990

  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

  In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 23, 2026
• Unscored —
  CVE-2026-23216

  scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414523
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467064
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25218.json
• report
  https://access.redhat.com/security/cve/CVE-2025-40135
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40135
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40135
• article
  https://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40135-67ca@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40158
• article
  https://lore.kernel.org/linux-cve-announce/2025111258-CVE-2025-40158-4c9d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40170
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40170
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40170
• article
  https://lore.kernel.org/linux-cve-announce/2025111259-CVE-2025-40170-d39d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68724
• article
  https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2025-68724-4d3c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-71089
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71089
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71089
• article
  https://lore.kernel.org/linux-cve-announce/2026011341-CVE-2025-71089-a642@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-71116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71116
• article
  https://lore.kernel.org/linux-cve-announce/2026011414-CVE-2025-71116-e57d@gregkh/T