Skip to content
OpenAdvisories
Critical RHSA-2026:26563 18 CVEs

Red Hat Security Advisory: kernel security update

Published Jun 18, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 49

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-core 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-core 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-devel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-devel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-doc 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules-extra 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-libs 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-core 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-core 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-devel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-devel 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-doc 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules-extra 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-libs 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf-debuginfo 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf 0:4.18.0-477.147.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.147.1.el8_8

Vulnerabilities 18

  • Critical 9.8
    CVE-2026-22984

    libceph: prevent potential out-of-bounds reads in handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2025-71116

    libceph: make decode_pool() more resilient against corrupted osdmaps

    In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expect…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-46125

    wifi: mac80211: remove station if connection prep fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21858

    geneve: Fix use-after-free in geneve_find_dev().

    In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-68724

    crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

    In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-68800

    mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not chan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-71089

    iommu: disable SVA when CONFIG_X86 is set

    In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43116

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46227

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

    In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22990

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

    In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46243 Public exploit

    smb: client: reject userspace cifs.spnego descriptions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68366

    nbd: defer config unlock in nbd_genl_connect

    In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43163

    md/bitmap: fix GPF in write_page caused by resize race

    In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2351619
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424881
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424886
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429065
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429602
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467005
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481486
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482608
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26563.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-21858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-21858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-21858
  • article
    https://lore.kernel.org/linux-cve-announce/2025031215-CVE-2025-21858-3986@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68366
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68366
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68366
  • article
    https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2025-68366-b367@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68724
  • article
    https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2025-68724-4d3c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68800
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68800
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68800
  • article
    https://lore.kernel.org/linux-cve-announce/2026011307-CVE-2025-68800-39d2@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-71089
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71089
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71089