Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 46

Vulnerabilities 7

• High 7.8
  CVE-2026-31431 Exploited Public exploit EPSS 98%

  crypto: algif_aead - Revert to operating out-of-place

  In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux Alpine
  Apr 22, 2026

  KEV May 1, 2026
• High 7.8
  CVE-2026-46300 Exploited Public exploit EPSS 16%

  net: skbuff: preserve shared-frag marker during coalescing

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 23, 2026

  KEV Oct 28, 2026
• Critical 9.8
  CVE-2026-43037

  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 8.8
  CVE-2026-43284 Public exploit EPSS 94%

  xfrm: esp: avoid in-place decrypt on shared skb frags

  In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• High 8.8
  CVE-2026-43503 Public exploit

  net: skbuff: propagate shared-frag marker through frag-transfer helpers

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 23, 2026
• High 7.1
  CVE-2026-46243 Public exploit

  smb: client: reject userspace cifs.spnego descriptions

  In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 1, 2026
• High 7.1
  CVE-2026-46333 Public exploit

  ptrace: slightly saner 'get_dumpable()' logic

  In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and ma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 15, 2026

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_nvidia/
• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477802
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481486
• article
  https://issues.redhat.com/browse/VOYAGER-10
• article
  https://issues.redhat.com/browse/VOYAGER-1034
• article
  https://issues.redhat.com/browse/VOYAGER-222
• article
  https://issues.redhat.com/browse/VOYAGER-223
• article
  https://issues.redhat.com/browse/VOYAGER-224
• article
  https://issues.redhat.com/browse/VOYAGER-238
• article
  https://issues.redhat.com/browse/VOYAGER-239
• article
  https://issues.redhat.com/browse/VOYAGER-240
• article
  https://issues.redhat.com/browse/VOYAGER-256
• article
  https://issues.redhat.com/browse/VOYAGER-281
• article
  https://issues.redhat.com/browse/VOYAGER-286
• article
  https://issues.redhat.com/browse/VOYAGER-418
• article
  https://issues.redhat.com/browse/VOYAGER-419
• article
  https://issues.redhat.com/browse/VOYAGER-488
• article
  https://issues.redhat.com/browse/VOYAGER-490
• article
  https://issues.redhat.com/browse/VOYAGER-6
• article
  https://issues.redhat.com/browse/VOYAGER-72
• article
  https://issues.redhat.com/browse/VOYAGER-73
• article
  https://issues.redhat.com/browse/VOYAGER-732
• article
  https://issues.redhat.com/browse/VOYAGER-74
• article
  https://issues.redhat.com/browse/VOYAGER-75
• article
  https://issues.redhat.com/browse/VOYAGER-82
• article
  https://issues.redhat.com/browse/VOYAGER-83
• article
  https://issues.redhat.com/browse/VOYAGER-89
• article
  https://issues.redhat.com/browse/VOYAGER-93
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33486.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31431
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31431
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31431
• article
  https://access.redhat.com/articles/7141989