Skip to content
OpenAdvisories
Critical RHSA-2026:33899 9 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Jul 1, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos bpftool 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos bpftool-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-abi-stablelists 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-core 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-core 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-devel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-modules 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-modules-extra 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debuginfo-common-x86_64 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-devel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-doc 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-modules 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-modules-extra 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools-libs 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos perf 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos perf-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos python3-perf 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos python3-perf-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos bpftool 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos bpftool-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-abi-stablelists 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-core 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-core 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-devel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-modules 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-modules-extra 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debuginfo-common-x86_64 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-devel 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-doc 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-modules 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-modules-extra 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools-libs 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos perf 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos perf-debuginfo 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos python3-perf 0:4.18.0-372.198.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos python3-perf-debuginfo 0:4.18.0-372.198.1.el8_6

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-22984

    libceph: prevent potential out-of-bounds reads in handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2025-71116

    libceph: make decode_pool() more resilient against corrupted osdmaps

    In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expect…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43329

    netfilter: flowtable: strictly check for maximum number of actions

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46090

    ALSA: aloop: Fix peer runtime UAF during format-change stop

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46227

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

    In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22990

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

    In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429602
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467234
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468124
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481980
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482564
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33899.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-71116
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71116
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71116
  • article
    https://lore.kernel.org/linux-cve-announce/2026011414-CVE-2025-71116-e57d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-22984
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22984
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22984
  • article
    https://lore.kernel.org/linux-cve-announce/2026012349-CVE-2026-22984-001c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-22990
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-22990
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-22990
  • article
    https://lore.kernel.org/linux-cve-announce/2026012351-CVE-2026-22990-a62e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23455
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23455
  • article
    https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23455-f045@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43125
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43125
  • article
    https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43329
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43329
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43329
  • article
    https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox
  • report
    https://access.redhat.com/security/cve/CVE-2026-45852
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45852
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45852
  • article
    https://lore.kernel.org/linux-cve-announce/2026052708-CVE-2026-45852-fcf9@gregkh/T