Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 6

• Critical 9.8
  CVE-2026-53006

  ipv6: fix possible UAF in icmpv6_rcv()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 8.8
  CVE-2026-64561 Public exploit

  KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 4, 2026
• High 7.9
  CVE-2025-40026

  KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 28, 2025
• High 7.8
  CVE-2026-52950

  drm/xe/dma-buf: fix UAF with retry loop

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-52976

  drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path ju…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Medium 6.3
  CVE-2026-53059

  dm log: fix out-of-bounds write due to region_count overflow

  In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2406712
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492284
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492363
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45192.json
• report
  https://access.redhat.com/security/cve/CVE-2025-40026
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40026
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40026
• article
  https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52950
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52950
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52950
• article
  https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52950-9c1a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52976
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52976
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52976
• article
  https://lore.kernel.org/linux-cve-announce/2026062440-CVE-2026-52976-d615@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53006
• article
  https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53059
• article
  https://lore.kernel.org/linux-cve-announce/2026062401-CVE-2026-53059-f32e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510891
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64561
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64561
• article
  https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T