Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 18

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43125

  dlm: validate length in dlm_search_rsb_tree

  In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-43198

  tcp: fix potential race in tcp_v6_syn_recv_sock()

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-43414

  scsi: qla2xxx: Completely fix fcport double free

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• Critical 9.8
  CVE-2026-43501 Public exploit

  ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2026
• Critical 9.1
  CVE-2026-46244

  netfilter: nft_inner: Fix IPv6 inner_thoff desync

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 3, 2026
• High 7.8
  CVE-2026-23191

  ALSA: aloop: Fix racy access at PCM trigger

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 14, 2026
• High 7.8
  CVE-2026-43128

  RDMA/umem: Fix double dma_buf_unpin in failure path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43329

  netfilter: flowtable: strictly check for maximum number of actions

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-45852

  RDMA/rxe: Fix double free in rxe_srq_from_init

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46090

  ALSA: aloop: Fix peer runtime UAF during format-change stop

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46173

  exit: prevent preemption of oopsing TASK_DEAD task

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46176

  RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46181

  RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46227

  sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

  In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Unscored —
  CVE-2025-21648

  netfilter: conntrack: clamp maximum hashtable size to INT_MAX

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 19, 2025
• Unscored —
  CVE-2025-21691

  cachestat: fix page cache statistics permission checking

  In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cachestat syscall"), it was meant to be a m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 10, 2025
• Unscored —
  CVE-2026-43027

  netfilter: nf_conntrack_helper: pass helper to expect cleanup

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2338814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2344687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467228
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467234
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468155
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482594
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484451
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34094.json
• report
  https://access.redhat.com/security/cve/CVE-2025-21648
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21648
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21648
• article
  https://lore.kernel.org/linux-cve-announce/2025011946-CVE-2025-21648-bcda@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21691
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21691
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21691
• article
  https://lore.kernel.org/linux-cve-announce/2025021055-CVE-2025-21691-2bd2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23191
• article
  https://lore.kernel.org/linux-cve-announce/2026021433-CVE-2026-23191-f990@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43027
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43027
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43027