Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 90

Vulnerabilities 15

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 8.8
  CVE-2026-46056

  Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 8.8
  CVE-2026-46125

  wifi: mac80211: remove station if connection prep fails

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46152

  wifi: mac80211: drop stray 'static' from fast-RX rx_result

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46166

  wifi: mac80211: use safe list iteration in radar detect work

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 28, 2026
• High 7.8
  CVE-2026-31474

  can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

  In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 22, 2026
• High 7.8
  CVE-2026-31641

  rxrpc: Fix RxGK token loading to check bounds

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026
• High 7.8
  CVE-2026-31772

  Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-31786

  Buffer overflow in drivers/xen/sys-hypervisor.c

  In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 30, 2026
• High 7.8
  CVE-2026-43056

  net: mana: fix use-after-free in add_adev() error path

  In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-43330

  crypto: caam - fix overflow on long hmac keys

  In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be roun…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-46173

  exit: prevent preemption of oopsing TASK_DEAD task

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46331 Public exploit

  net/sched: fix pedit partial COW leading to page cache corruption

  In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 16, 2026
• Unscored —
  CVE-2026-31787 Public exploit

  xen/privcmd: fix double free via VMA splitting

  In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 30, 2026
• Unscored —
  CVE-2026-43260

  bnxt_en: Fix RSS context delete logic

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461548
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464096
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468061
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482645
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27288.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31474
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31474
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31474
• article
  https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31474-8673@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31641
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31641
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31641
• article
  https://lore.kernel.org/linux-cve-announce/2026042457-CVE-2026-31641-2dee@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31772
• article
  https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31786
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31786
• article
  https://lore.kernel.org/linux-cve-announce/2026043031-CVE-2026-31786-826a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31787
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31787