Skip to content
OpenAdvisories
Critical RHSA-2026:3277 10 CVEs

Red Hat Security Advisory: kernel security update

Published Feb 26, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 49

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-core 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-core 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-devel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-devel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-doc 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules-extra 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-libs 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-core 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-core 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-devel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-devel 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-doc 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules-extra 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-libs 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf-debuginfo 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf 0:4.18.0-477.130.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.130.1.el8_8

Vulnerabilities 10

  • Critical 9.4
    CVE-2025-39933

    smb: client: let recv_done verify data_offset, data_length and remaining_data_length

    In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50673

    ext4: fix use-after-free in ext4_orphan_cleanup

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23074

    net/sched: Enforce that teql can only be used as root qdisc

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2022-50865

    tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-68349

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

    In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-53821

    ip6_vti: fix slab-use-after-free in decode_session6

    In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38415

    Squashfs: check return result of sb_min_blocksize

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38459

    atm: clip: Fix infinite recursive call of clip_push().

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383487
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2401432
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424880
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436791
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3277.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-50673
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50673
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50673
  • article
    https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50865
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50865
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50865
  • article
    https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53821
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53821
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53821
  • article
    https://lore.kernel.org/linux-cve-announce/2025120950-CVE-2023-53821-9542@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38415
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38415
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38415
  • article
    https://lore.kernel.org/linux-cve-announce/2025072513-CVE-2025-38415-c634@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38459
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38459
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38459
  • article
    https://lore.kernel.org/linux-cve-announce/2025072507-CVE-2025-38459-e941@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39760
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39760
  • article
    https://lore.kernel.org/linux-cve-announce/2025091145-CVE-2025-39760-2d5f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39933
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39933
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39933