Skip to content
OpenAdvisories
Critical RHSA-2026:27729 6 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Jun 22, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 26

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 bpftool 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 bpftool-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-abi-whitelists 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-bootwrapper 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debug 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debug-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debug-devel 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debuginfo-common-ppc64 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debuginfo-common-ppc64le 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debuginfo-common-s390x 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-debuginfo-common-x86_64 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-devel 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-doc 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-kdump 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-kdump-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-kdump-devel 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-tools 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-tools-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-tools-libs 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 kernel-tools-libs-devel 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 perf 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 perf-debuginfo 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 python-perf 0:3.10.0-1160.153.1.el7
Red Hat · RHEL 7 ELS rhel_els:7 python-perf-debuginfo 0:3.10.0-1160.153.1.el7

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-43037

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23243

    RDMA/umad: Reject negative data_len in ib_umad_write

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46243 Public exploit

    smb: client: reject userspace cifs.spnego descriptions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448594
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464351
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481486
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27729.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23243
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23243
  • article
    https://lore.kernel.org/linux-cve-announce/2026031816-CVE-2026-23243-b88e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43037
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43037
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43037
  • article
    https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43110
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43110
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43110
  • article
    https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43110-7309@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43158
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43158
  • article
    https://kernelcve.org/list/?q=CVE-2026-43158
  • article
    https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43190
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43190
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43190
  • article
    https://lore.kernel.org/linux-cve-announce/2026050642-CVE-2026-43190-f1c9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46243
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2026-005
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46243
  • article
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3da1fdf4efbc490041eb4f836bf596201203f8f2
  • article
    https://lore.kernel.org/linux-cve-announce/2026060140-CVE-2026-46243-3d1c@gregkh/