Skip to content
OpenAdvisories
High RHSA-2026:4012 10 CVEs

Red Hat Security Advisory: kernel security update

Published Mar 10, 2026 · Updated Jul 30, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 kernel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-devel-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debug-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-devel-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-64k-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-abi-stablelists 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-devel-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debug-uki-virt 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-aarch64 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-ppc64le 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-s390x 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-debuginfo-common-x86_64 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-devel-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-doc 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-modules-extra-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debug-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-64k-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debug-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-rt-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-tools-libs-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-uki-virt-addons 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-devel-matched 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-core 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 kernel-zfcpdump-modules-extra 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libperf-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 perf-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-perf-debuginfo 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rtla 0:6.12.0-124.43.1.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rv 0:6.12.0-124.43.1.el10_1

Vulnerabilities 10

  • High 7.8
    CVE-2025-38106

    io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()

    In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by ta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38141

    dm: fix dm_blk_report_zones

    In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38703

    drm/xe: Make dma-fences compliant with the safe access rules

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace cl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39818

    HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KAS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40249

    gpio: cdev: make sure the cdev fd is still active before emitting events

    In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23001 Public exploit

    macvlan: fix possible UAF in macvlan_forward_source()

    In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-71085

    ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is tri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23097

    migrate: correct lock ordering for hugetlb file folios

    In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23156

    efivarfs: fix error propagation in efivar_entry_get()

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitial…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376052
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376077
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393157
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395797
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418886
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429026
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432664
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436802
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439951
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4012.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-38106
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38106
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38106
  • article
    https://lore.kernel.org/linux-cve-announce/2025070322-CVE-2025-38106-8de3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38141
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38141
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38141
  • article
    https://lore.kernel.org/linux-cve-announce/2025070333-CVE-2025-38141-560e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38703
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38703
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38703
  • article
    https://lore.kernel.org/linux-cve-announce/2025090453-CVE-2025-38703-2f5c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39760
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39760
  • article
    https://lore.kernel.org/linux-cve-announce/2025091145-CVE-2025-39760-2d5f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39818
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39818
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39818
  • article
    https://lore.kernel.org/linux-cve-announce/2025091615-CVE-2025-39818-f1b9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40249
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40249
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40249
  • article
    https://lore.kernel.org/linux-cve-announce/2025120430-CVE-2025-40249-3972@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-71085
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71085
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71085