Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 71

Vulnerabilities 9

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43125

  dlm: validate length in dlm_search_rsb_tree

  In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-43501 Public exploit

  ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2026
• High 7.8
  CVE-2026-43128

  RDMA/umem: Fix double dma_buf_unpin in failure path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43329

  netfilter: flowtable: strictly check for maximum number of actions

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-46090

  ALSA: aloop: Fix peer runtime UAF during format-change stop

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46173

  exit: prevent preemption of oopsing TASK_DEAD task

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46181

  RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467234
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482634
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34095.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43125
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43125
• article
  https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43128
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43128
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43128
• article
  https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43279
• article
  https://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43329
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43329.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-43501
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43501
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43501
• article
  https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43501-63a6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46090
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46090
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46090
• article
  https://kernelcve.org/list/?q=CVE-2026-46090