Skip to content
OpenAdvisories
Critical RHSA-2026:39371 15 CVEs

Red Hat Security Advisory: kernel security update

Published Jul 15, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 91

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel-matched 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel-matched 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-abi-stablelists 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel-matched 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-uki-virt 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-aarch64 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-ppc64le 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-s390x 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-x86_64 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel-matched 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-doc 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-kvm 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-kvm 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt-addons 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel-matched 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-core 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-extra 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf-debuginfo 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rtla 0:6.12.0-55.88.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rv 0:6.12.0-55.88.1.el10_0

Vulnerabilities 15

  • Critical 9.8
    CVE-2026-43414

    scsi: qla2xxx: Completely fix fcport double free

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-46135

    nvmet-tcp: fix race between ICReq handling and queue teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-46316 Public exploit

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-31408

    Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46113

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow pagi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53359 Public exploit

    KVM: x86: Fix shadow paging use-after-free due to unexpected role

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch betw…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38653

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

    In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-68183

    ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

    In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68724

    crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

    In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43074 Public exploit

    eventpoll: defer struct eventpoll free to RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43330

    crypto: caam - fix overflow on long hmac keys

    In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be roun…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46116

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

    In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46173

    exit: prevent preemption of oopsing TASK_DEAD task

    In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46242 Public exploit

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43027

    netfilter: nf_conntrack_helper: pass helper to expect cleanup

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2390372
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422699
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424886
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455334
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464369
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467019
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468061
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468155
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482523
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482634
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2486982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497033
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39371.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-38653
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38653
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38653
  • article
    https://lore.kernel.org/linux-cve-announce/2025082238-CVE-2025-38653-35ba@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68183
  • article
    https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68724
  • article
    https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2025-68724-4d3c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31408
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31408
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31408
  • article
    https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43027
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43027
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43027
  • article
    https://lore.kernel.org/linux-cve-announce/2026050159-CVE-2026-43027-5711@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43074
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43074
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43074