Skip to content
OpenAdvisories
Critical RHSA-2026:35863 10 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Jul 6, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 49

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-core 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-core 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-devel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-devel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-doc 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules-extra 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-libs 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-core 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-core 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-devel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-devel 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-doc 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules-extra 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-libs 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf-debuginfo 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf 0:4.18.0-477.150.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.150.1.el8_8

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-31669

    mptcp: fix slab-use-after-free in __inet_lookup_established

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43198

    tcp: fix potential race in tcp_v6_syn_recv_sock()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23270

    net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the curren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43279

    ALSA: usb-audio: Add sanity check for OOB writes at silencing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43329

    netfilter: flowtable: strictly check for maximum number of actions

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46090

    ALSA: aloop: Fix peer runtime UAF during format-change stop

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46181

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448745
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461503
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467215
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467234
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468124
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481980
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482532
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35863.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23270
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23270
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23270
  • article
    https://lore.kernel.org/linux-cve-announce/2026031847-CVE-2026-23270-cb9a@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23455
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23455
  • article
    https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23455-f045@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31669
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31669
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31669
  • article
    https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43125
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43125
  • article
    https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43198
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43198
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43198
  • article
    https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43198-0870@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43279
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43279
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43279
  • article
    https://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43329
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43329
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43329