Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 124

Vulnerabilities 11

• Critical 9.8
  CVE-2026-43125

  dlm: validate length in dlm_search_rsb_tree

  In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• Critical 9.8
  CVE-2026-64439

  crypto: krb5 - filter out async aead implementations at alloc

  In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2026
• High 8.8
  CVE-2026-31408

  Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 6, 2026
• High 8.8
  CVE-2026-46152

  wifi: mac80211: drop stray 'static' from fast-RX rx_result

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.0
  CVE-2024-27398 Public exploit

  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 13, 2024
• High 8.0
  CVE-2024-50125

  Bluetooth: SCO: Fix UAF on sco_sock_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 5, 2024
• High 7.8
  CVE-2025-68183

  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-45984

  gfs2: Fix use-after-free in iomap inline data write path

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.0
  CVE-2026-46189

  RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Unscored —
  CVE-2026-43027

  netfilter: nf_conntrack_helper: pass helper to expect cleanup

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467234
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482588
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36767.json
• report
  https://access.redhat.com/security/cve/CVE-2024-27398
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27398
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27398
• article
  https://lore.kernel.org/linux-cve-announce/2024051355-CVE-2024-27398-08ef@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50125
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50125
• article
  https://lore.kernel.org/linux-cve-announce/2024110557-CVE-2024-50125-5fd3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68183
• article
  https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31408
• article
  https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43027
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43027
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43027
• article
  https://lore.kernel.org/linux-cve-announce/2026050159-CVE-2026-43027-5711@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43125
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43125
• article
  https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43279