Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 12

• Critical 9.8
  CVE-2026-46135

  nvmet-tcp: fix race between ICReq handling and queue teardown

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Critical 9.3
  CVE-2026-46316 Public exploit

  KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 9, 2026
• High 8.8
  CVE-2026-31408

  Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 6, 2026
• High 8.8
  CVE-2026-46113

  KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow pagi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-46152

  wifi: mac80211: drop stray 'static' from fast-RX rx_result

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.8
  CVE-2026-53359 Public exploit

  KVM: x86: Fix shadow paging use-after-free due to unexpected role

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch betw…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 4, 2026
• High 7.8
  CVE-2025-68183

  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025
• High 7.8
  CVE-2026-43074 Public exploit

  eventpoll: defer struct eventpoll free to RCU grace period

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-45984

  gfs2: Fix use-after-free in iomap inline data write path

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46242 Public exploit

  eventpoll: fix ep_remove struct eventpoll / struct file UAF

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2026
• High 7.0
  CVE-2026-46189

  RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482588
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482654
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497033
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38902.json
• report
  https://access.redhat.com/security/cve/CVE-2025-68183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68183
• article
  https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31408
• article
  https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43074
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43074
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43074
• article
  https://lore.kernel.org/linux-cve-announce/2026050601-CVE-2026-43074-ac01@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43279
• article
  https://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45984
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45984
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45984
• article
  https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46113
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482587
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46113
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46113
• article
  https://lore.kernel.org/linux-cve-announce/2026052813-CVE-2026-46113-f083@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46135