Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 91

Vulnerabilities 12

• Critical 9.1
  CVE-2025-10263 Public exploit

  Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X…

  Arm Cortex-X4 Neoverse V3AE Cortex-X925 Debian Ubuntu Alpine
  Jun 9, 2026
• Critical 9.1
  CVE-2026-23455

  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2026
• High 7.8
  CVE-2025-71089

  iommu: disable SVA when CONFIG_X86 is set

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 13, 2026
• High 7.8
  CVE-2026-31488

  drm/amd/display: Do not skip unrelated mode changes in DSC validation

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC sta…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 22, 2026
• High 7.8
  CVE-2026-43279

  ALSA: usb-audio: Add sanity check for OOB writes at silencing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-53000

  netfilter: nat: use kfree_rcu to release ops

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-53264 Public exploit

  net/sched: act_api: use RCU with deferred freeing for action lifecycle

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.5
  CVE-2025-71131

  crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

  In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 14, 2026
• High 7.0
  CVE-2026-45998

  rxrpc: Fix potential UAF after skb_unshare() failure

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• Medium 6.3
  CVE-2026-53059

  dm log: fix out-of-bounds write due to region_count overflow

  In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Unscored —
  CVE-2026-23110

  scsi: core: Wake up the error handler when final completions race against each other

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes whe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• Unscored —
  CVE-2026-23375

  mm: thp: deny THP for files on anonymous inodes

  In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_fil…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429583
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436755
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460619
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486958
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492851
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55445.json
• report
  https://access.redhat.com/security/cve/CVE-2025-10263
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10263
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10263
• article
  https://developer.arm.com/documentation/112137
• report
  https://access.redhat.com/security/cve/CVE-2025-71089
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71089
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71089
• article
  https://lore.kernel.org/linux-cve-announce/2026011341-CVE-2025-71089-a642@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-71131
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71131
• article
  https://lore.kernel.org/linux-cve-announce/2026011452-CVE-2025-71131-c844@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23110
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23110
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23110
• article
  https://lore.kernel.org/linux-cve-announce/2026020431-CVE-2026-23110-56b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23375
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23375
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23375
• article
  https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23375-91b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23455
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23455
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23455
• article
  https://lore.kernel.org/linux-cve-announce/2026040317-CVE-2026-23455-f045@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31488