Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 48

Vulnerabilities 10

• Critical 9.8
  CVE-2026-46135

  nvmet-tcp: fix race between ICReq handling and queue teardown

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 8.1
  CVE-2026-31613

  smb: client: fix OOB reads parsing symlink error response

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2025-68183

  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025
• High 7.8
  CVE-2025-68724

  crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

  In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-46116

  xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

  In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-46209

  drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

  In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.0
  CVE-2026-46189

  RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

  In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• Unscored —
  CVE-2026-31684

  net: sched: act_csum: validate nested VLAN headers

  In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 25, 2026
• Unscored —
  CVE-2026-43027

  netfilter: nf_conntrack_helper: pass helper to expect cleanup

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482523
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482588
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482636
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482654
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47633.json
• report
  https://access.redhat.com/security/cve/CVE-2025-68183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68183
• article
  https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68724
• article
  https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2025-68724-4d3c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31613
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31613
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31613
• article
  https://lore.kernel.org/linux-cve-announce/2026042422-CVE-2026-31613-b061@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31684
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31684
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31684
• article
  https://lore.kernel.org/linux-cve-announce/2026042545-CVE-2026-31684-6974@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43027
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43027
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43027
• article
  https://lore.kernel.org/linux-cve-announce/2026050159-CVE-2026-43027-5711@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43279
• article
  https://lore.kernel.org/linux-cve-announce/2026050613-CVE-2026-43279-4530@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46116