Skip to content
OpenAdvisories
Critical RHSA-2026:27731 14 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Jun 22, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 91

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel-matched 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel-matched 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-abi-stablelists 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel-matched 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-uki-virt 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-aarch64 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-ppc64le 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-s390x 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-x86_64 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel-matched 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-doc 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-kvm 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-kvm 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt-addons 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel-matched 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-core 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-extra 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf-debuginfo 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rtla 0:6.12.0-55.82.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rv 0:6.12.0-55.82.1.el10_0

Vulnerabilities 14

  • Critical 9.8
    CVE-2026-43501 Public exploit

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-45898

    RDMA/iwcm: Fix workqueue list corruption by removing work_list

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_wo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.9
    CVE-2025-30156

    Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initia…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46125

    wifi: mac80211: remove station if connection prep fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38154

    bpf, sockmap: Avoid using sk_socket after free when sending

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31474

    can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

    In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43116

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46227

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

    In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46323

    net: gro: don't merge zcopy skbs

    In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46331 Public exploit

    net/sched: fix pedit partial COW leading to page cache corruption

    In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-23136

    libceph: reset sparse-read state in osd_fault()

    In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376056
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414506
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414523
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439852
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2460646
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467005
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479492
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479832
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480457
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482031
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482608
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27731.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-30156
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393864
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-30156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-30156
  • report
    https://access.redhat.com/security/cve/CVE-2025-38154
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38154
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38154
  • article
    https://lore.kernel.org/linux-cve-announce/2025070337-CVE-2025-38154-8353@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40135
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40135
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40135
  • article
    https://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40135-67ca@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40158
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40158
  • article
    https://lore.kernel.org/linux-cve-announce/2025111258-CVE-2025-40158-4c9d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40170
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40170
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40170
  • article
    https://lore.kernel.org/linux-cve-announce/2025111259-CVE-2025-40170-d39d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23136
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23136
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23136
  • article
    https://lore.kernel.org/linux-cve-announce/2026021428-CVE-2026-23136-f28c@gregkh/T