Red Hat Security Advisory: kernel security update

Fixed packages 90

Vulnerabilities 7

• High 8.8
  CVE-2026-64561 Public exploit

  KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 4, 2026
• High 8.1
  CVE-2026-46099

  net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

  In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-52973

  futex: Drop CLONE_THREAD requirement for private default hash alloc

  In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Medium 6.3
  CVE-2026-53059

  dm log: fix out-of-bounds write due to region_count overflow

  In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Unscored —
  CVE-2025-40237

  fs/notify: call exportfs_encode_fid with s_umount

  In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 4, 2025
• Unscored —
  CVE-2026-23110

  scsi: core: Wake up the error handler when final completions race against each other

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes whe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• Unscored —
  CVE-2026-31692

  rtnetlink: add missing netlink_ns_capable() check for peer netns

  In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 30, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436755
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464093
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492413
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45114.json
• report
  https://access.redhat.com/security/cve/CVE-2025-40237
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40237
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40237
• article
  https://lore.kernel.org/linux-cve-announce/2025120402-CVE-2025-40237-f087@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23110
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23110
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23110
• article
  https://lore.kernel.org/linux-cve-announce/2026020431-CVE-2026-23110-56b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31692
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31692
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31692
• article
  https://lore.kernel.org/linux-cve-announce/2026043054-CVE-2026-31692-5f89@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46099
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46099
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46099
• article
  https://lore.kernel.org/linux-cve-announce/2026052704-CVE-2026-46099-2a55@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52973
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52973
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52973
• article
  https://lore.kernel.org/linux-cve-announce/2026062439-CVE-2026-52973-af9c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53059
• article
  https://lore.kernel.org/linux-cve-announce/2026062401-CVE-2026-53059-f32e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510891
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64561
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64561
• article
  https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T