Skip to content
OpenAdvisories
Critical RHSA-2026:2573 11 CVEs

Red Hat Security Advisory: kernel security update

Published Feb 12, 2026 · Updated Sep 27, 2026

Ecosystem: Red Hat

Fixed packages 47

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream bpftool-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel-matched 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-aarch64 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-s390x 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-x86_64 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel-matched 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-doc 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-tools-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel-matched 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream python3-perf-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-abi-stablelists 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-core 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-core 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules-extra 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-aarch64 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-s390x 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-x86_64 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules-extra 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-libs 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-core 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules-extra 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos perf-debuginfo 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf 0:5.14.0-70.165.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf-debuginfo 0:5.14.0-70.165.1.el9_0

Vulnerabilities 11

  • Critical 9.8
    CVE-2023-53192

    vxlan: Fix nexthop hash size

    In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_has…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2023-53751

    cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname

    In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2025-68301

    net: atlantic: fix fragment overflow handling in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-53673

    Bluetooth: hci_event: call disconnect callback before deleting conn

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50673

    ext4: fix use-after-free in ext4_orphan_cleanup

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40251

    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

    In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40304

    fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

    In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2022-50865

    tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-40322

    fbdev: bitblit: bound-check glyph index in bit_putcs*

    In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-49503

    ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix

    In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53833

    drm/i915: Fix NULL ptr deref by checking new_crtc_state

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2347814
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418892
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419902
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420366
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422836
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426226
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2573.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-49503
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49503
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49503
  • article
    https://lore.kernel.org/linux-cve-announce/2025022608-CVE-2022-49503-a3bf@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50673
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50673
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50673
  • article
    https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50865
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50865
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50865
  • article
    https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53192
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53192
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53192
  • article
    https://lore.kernel.org/linux-cve-announce/2025091558-CVE-2023-53192-5ca6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53673
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53673
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53673
  • article
    https://lore.kernel.org/linux-cve-announce/2025100706-CVE-2023-53673-36b9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53751
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53751
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53751
  • article
    https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53751-2ff2@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53833
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53833