Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 124

Vulnerabilities 8

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43501 Public exploit

  ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2026
• Critical 9.1
  CVE-2026-23455

  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2026
• High 7.8
  CVE-2026-43128

  RDMA/umem: Fix double dma_buf_unpin in failure path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43329

  netfilter: flowtable: strictly check for maximum number of actions

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-45852

  RDMA/rxe: Fix double free in rxe_srq_from_init

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46173

  exit: prevent preemption of oopsing TASK_DEAD task

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46331 Public exploit

  net/sched: fix pedit partial COW leading to page cache corruption

  In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 16, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482634
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27713.json
• report
  https://access.redhat.com/security/cve/CVE-2026-23455
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23455
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23455
• article
  https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23455-f045@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43128
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43128
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43128
• article
  https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43329
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-43501
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43501
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43501
• article
  https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43501-63a6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45852
• article
  https://lore.kernel.org/linux-cve-announce/2026052708-CVE-2026-45852-fcf9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46173
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46173
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46173
• article
  https://lore.kernel.org/linux-cve-announce/2026052827-CVE-2026-46173-0214@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46331