Skip to content
OpenAdvisories
Critical RHSA-2026:41236 16 CVEs

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Published Jul 18, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-debug 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-debug-debuginfo 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-debug-devel 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-debuginfo 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-debuginfo-common-x86_64 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-devel 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-doc 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-trace 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-trace-debuginfo 0:3.10.0-1160.155.1.rt56.1307.el7
Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 kernel-rt-trace-devel 0:3.10.0-1160.155.1.rt56.1307.el7

Vulnerabilities 16

  • Critical 9.8
    CVE-2026-31607

    usbip: validate number_of_packets in usbip_pack_ret_submit()

    In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets fro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43037

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43198

    tcp: fix potential race in tcp_v6_syn_recv_sock()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23243

    RDMA/umad: Reject negative data_len in ib_umad_write

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31532

    can: raw: fix ro->uniq use-after-free in raw_rcv()

    In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46090

    ALSA: aloop: Fix peer runtime UAF during format-change stop

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46181

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46243 Public exploit

    smb: client: reject userspace cifs.spnego descriptions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43163

    md/bitmap: fix GPF in write_page caused by resize race

    In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448594
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464351
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467234
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481486
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481980
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482532
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41236.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23243
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23243
  • article
    https://lore.kernel.org/linux-cve-announce/2026031816-CVE-2026-23243-b88e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23455
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23455
  • article
    https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23455-f045@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31532
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31532
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31532
  • article
    https://lore.kernel.org/linux-cve-announce/2026042349-CVE-2026-31532-a820@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31607
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31607
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31607
  • article
    https://lore.kernel.org/linux-cve-announce/2026042420-CVE-2026-31607-7bac@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31685
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31685
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31685
  • article
    https://lore.kernel.org/linux-cve-announce/2026042545-CVE-2026-31685-3fcc@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43037