Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 124

Vulnerabilities 11

• Critical 9.8
  CVE-2026-22984

  libceph: prevent potential out-of-bounds reads in handle_auth_done()

  In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 23, 2026
• Critical 9.1
  CVE-2025-71116

  libceph: make decode_pool() more resilient against corrupted osdmaps

  In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expect…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 14, 2026
• High 8.9
  CVE-2025-30156

  Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

  Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initia…

  ceph ceph ceph ceph Debian Ubuntu Azure Linux
  Aug 27, 2026
• High 8.8
  CVE-2026-43158

  xfs: fix freemap adjustments when adding xattrs to leaf blocks

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.8
  CVE-2026-46125

  wifi: mac80211: remove station if connection prep fails

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-43116

  netfilter: ctnetlink: ensure safe access to master conntrack

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• High 7.8
  CVE-2026-43303

  mm/page_alloc: clear page->private in free_pages_prepare()

  In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• High 7.8
  CVE-2026-46227

  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

  In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46323

  net: gro: don't merge zcopy skbs

  In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 9, 2026
• High 7.5
  CVE-2026-22990

  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

  In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 23, 2026
• High 7.1
  CVE-2026-46243 Public exploit

  smb: client: reject userspace cifs.spnego descriptions

  In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479832
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481486
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482608
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27735.json
• report
  https://access.redhat.com/security/cve/CVE-2025-30156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393864
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-30156
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-30156
• report
  https://access.redhat.com/security/cve/CVE-2025-71116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71116
• article
  https://lore.kernel.org/linux-cve-announce/2026011414-CVE-2025-71116-e57d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-22984
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-22984
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-22984
• article
  https://lore.kernel.org/linux-cve-announce/2026012349-CVE-2026-22984-001c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-22990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-22990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-22990
• article
  https://lore.kernel.org/linux-cve-announce/2026012351-CVE-2026-22990-a62e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43116
• article
  https://kernelcve.org/list/?q=CVE-2026-43116
• article
  https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43116-08a5@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43158
• article
  https://kernelcve.org/list/?q=CVE-2026-43158
• article
  https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43303