Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 17

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43414

  scsi: qla2xxx: Completely fix fcport double free

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• Critical 9.8
  CVE-2026-46135

  nvmet-tcp: fix race between ICReq handling and queue teardown

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46056

  Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 8.8
  CVE-2026-46125

  wifi: mac80211: remove station if connection prep fails

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46152

  wifi: mac80211: drop stray 'static' from fast-RX rx_result

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46166

  wifi: mac80211: use safe list iteration in radar detect work

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 28, 2026
• High 7.8
  CVE-2026-31474

  can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

  In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 22, 2026
• High 7.8
  CVE-2026-31772

  Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-45984

  gfs2: Fix use-after-free in iomap inline data write path

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46117

  RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WA…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 28, 2026
• High 7.8
  CVE-2026-46145

  RDMA/mana: Validate rx_hash_key_len

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46173

  exit: prevent preemption of oopsing TASK_DEAD task

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46331 Public exploit

  net/sched: fix pedit partial COW leading to page cache corruption

  In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 16, 2026
• Unscored —
  CVE-2026-31787 Public exploit

  xen/privcmd: fix double free via VMA splitting

  In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 30, 2026
• Unscored —
  CVE-2026-43260

  bnxt_en: Fix RSS context delete logic

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468155
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482581
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482654
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27789.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31474
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31474
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31474
• article
  https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31474-8673@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31772
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31772
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31772
• article
  https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31787
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31787
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31787
• article
  https://lore.kernel.org/linux-cve-announce/2026043034-CVE-2026-31787-f6cc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43260
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43260
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43260
• article
  https://lore.kernel.org/linux-cve-announce/2026050606-CVE-2026-43260-7443@gregkh/T