Skip to content
OpenAdvisories
High RHSA-2026:3388 10 CVEs

Red Hat Security Advisory: kernel security update

Published Feb 27, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool-debuginfo 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-abi-whitelists 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-core 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-core 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-debuginfo 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-devel 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules-extra 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo-common-x86_64 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-devel 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-doc 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules-extra 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-debuginfo 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-libs 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf-debuginfo 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf 0:4.18.0-193.187.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf-debuginfo 0:4.18.0-193.187.1.el8_2

Vulnerabilities 10

  • High 8.8
    CVE-2023-53827

    Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23074

    net/sched: Enforce that teql can only be used as root qdisc

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2022-50865

    tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53513

    nbd: fix incomplete validation of ioctl arg

    In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53821

    ip6_vti: fix slab-use-after-free in decode_session6

    In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38415

    Squashfs: check return result of sb_min_blocksize

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38459

    atm: clip: Fix infinite recursive call of clip_push().

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383487
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400795
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420376
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436791
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3388.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-50865
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50865
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50865
  • article
    https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53513
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53513
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53513
  • article
    https://lore.kernel.org/linux-cve-announce/2025100130-CVE-2023-53513-4667@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53821
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53821
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53821
  • article
    https://lore.kernel.org/linux-cve-announce/2025120950-CVE-2023-53821-9542@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53827
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53827
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53827
  • article
    https://lore.kernel.org/linux-cve-announce/2025120952-CVE-2023-53827-b045@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38022
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38022
  • article
    https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38415
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38415
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38415
  • article
    https://lore.kernel.org/linux-cve-announce/2025072513-CVE-2025-38415-c634@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38459
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38459
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38459