Red Hat Security Advisory: kernel security update

Fixed packages 48

Vulnerabilities 6

• Critical 9.8
  CVE-2026-31669

  mptcp: fix slab-use-after-free in __inet_lookup_established

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• Critical 9.8
  CVE-2026-43198

  tcp: fix potential race in tcp_v6_syn_recv_sock()

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• High 8.8
  CVE-2026-31408

  Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 6, 2026
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-45984

  gfs2: Fix use-after-free in iomap inline data write path

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46181

  RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467228
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482532
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35894.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31408
• article
  https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31669
• article
  https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31669-0e0d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43198
• article
  https://lore.kernel.org/linux-cve-announce/2026050645-CVE-2026-43198-0870@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43279
• article
  https://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45984
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45984
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45984
• article
  https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46181
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46181
• article
  https://lore.kernel.org/linux-cve-announce/2026052829-CVE-2026-46181-ecff@gregkh/T