Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 48

Vulnerabilities 24

• Critical 9.8
  CVE-2026-43037

  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• Critical 9.8
  CVE-2026-43038

  ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• Critical 9.4
  CVE-2026-31685

  netfilter: ip6t_eui64: reject invalid MAC header for all packets

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 25, 2026
• High 8.8
  CVE-2026-43110

  wifi: brcmfmac: validate bsscfg indices in IF events

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.8
  CVE-2026-43158

  xfs: fix freemap adjustments when adding xattrs to leaf blocks

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.2
  CVE-2023-53372

  sctp: fix a potential overflow in sctp_ifwdtsn_skip

  In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data le…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 8.2
  CVE-2026-43190

  netfilter: xt_tcpmss: check remaining length before reading optlen

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.1
  CVE-2025-40135

  ipv6: use RCU in ip6_xmit()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 8.1
  CVE-2025-40158

  ipv6: use RCU in ip6_output()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2025-21858

  geneve: Fix use-after-free in geneve_find_dev().

  In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• High 7.8
  CVE-2025-40170

  net: use dst_dev_rcu() in sk_setup_caps()

  In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2025-68800

  mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not chan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2025-71089

  iommu: disable SVA when CONFIG_X86 is set

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2026-23001 Public exploit

  macvlan: fix possible UAF in macvlan_forward_source()

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 25, 2026
• High 7.8
  CVE-2026-23191

  ALSA: aloop: Fix racy access at PCM trigger

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 14, 2026
• High 7.8
  CVE-2026-23243

  RDMA/umad: Reject negative data_len in ib_umad_write

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 18, 2026
• High 7.8
  CVE-2026-23392

  netfilter: nf_tables: release flowtable after rcu grace period on error

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 25, 2026
• High 7.8
  CVE-2026-43116

  netfilter: ctnetlink: ensure safe access to master conntrack

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• High 7.8
  CVE-2026-46227

  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

  In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.1
  CVE-2026-46243 Public exploit

  smb: client: reject userspace cifs.spnego descriptions

  In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 1, 2026
• Unscored —
  CVE-2025-68366

  nbd: defer config unlock in nbd_genl_connect

  In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• Unscored —
  CVE-2026-23097

  migrate: correct lock ordering for hugetlb file folios

  In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• Unscored —
  CVE-2026-23216

  scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 18, 2026
• Unscored —
  CVE-2026-43163

  md/bitmap: fix GPF in write_page caused by resize race

  In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351619
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414523
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424881
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432664
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436802
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448594
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461759
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481486
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482564
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26535.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53372
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53372
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53372
• article
  https://lore.kernel.org/linux-cve-announce/2025091855-CVE-2023-53372-4d9e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21858
• article
  https://lore.kernel.org/linux-cve-announce/2025031215-CVE-2025-21858-3986@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40135
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40135
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40135
• article
  https://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40135-67ca@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40158