Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 91

Vulnerabilities 11

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43198

  tcp: fix potential race in tcp_v6_syn_recv_sock()

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-43341

  net/ipv6: ioam6: prevent schema length wraparound in trace fill

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• Critical 9.1
  CVE-2026-46244

  netfilter: nft_inner: Fix IPv6 inner_thoff desync

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 3, 2026
• High 8.8
  CVE-2026-43158

  xfs: fix freemap adjustments when adding xattrs to leaf blocks

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 8.8
  CVE-2026-46166

  wifi: mac80211: use safe list iteration in radar detect work

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 28, 2026
• High 7.8
  CVE-2026-43128

  RDMA/umem: Fix double dma_buf_unpin in failure path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43303

  mm/page_alloc: clear page->private in free_pages_prepare()

  In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• High 7.8
  CVE-2026-43329

  netfilter: flowtable: strictly check for maximum number of actions

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-46090

  ALSA: aloop: Fix peer runtime UAF during format-change stop

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46176

  RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467228
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482594
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484451
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33215.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43128
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43128
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43128
• article
  https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43158
• article
  https://kernelcve.org/list/?q=CVE-2026-43158
• article
  https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43198
• article
  https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43198-0870@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43303
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43303
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43303
• article
  https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43303-dc12@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43329
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-43341