Skip to content
OpenAdvisories
Critical RHSA-2026:57251 25 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Aug 20, 2026 · Updated Nov 13, 2026

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 kernel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-abi-stablelists 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-uki-virt 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-doc 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt-addons 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf-debuginfo 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rtla 0:6.12.0-211.49.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rv 0:6.12.0-211.49.1.el10_2

Vulnerabilities 25

  • Critical 9.8

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests

    In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

  • Critical 9.8

    scsi: target: iscsi: Validate CHAP_R length before base64 decode

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…

  • Critical 9.8

    scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…

  • Critical 9.8

    smb: client: fix query_info() replay double-free

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, c…

  • Critical 9.8

    smb/client: handle overlapping allocated ranges in fallocate

    In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate of…

  • Critical 9.1

    smb/client: fix out-of-bounds read in symlink_data()

    In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for …

  • High 8.8

    drm/amdgpu: zero-initialize GART table on allocation

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…

  • High 8.8

    smb: client: fix double-free in SMB2_open() replay

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, clean…

  • High 8.8
    CVE-2026-74580 Public exploit

    vhost: reset the vring metadata cache on vring reconfiguration

    In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

  • High 8.4

    memfd: deny writeable mappings when implying SEAL_WRITE

    In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can n…

  • High 7.8

    drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…

  • High 7.8

    drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the lo…

  • High 7.8

    drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int…

  • High 7.8

    udf: fix partition descriptor append bookkeeping

    In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_…

  • High 7.8

    sched/psi: fix race between file release and pressure write

    In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_fi…

  • High 7.8

    drm/i915/gem: Fix phys BO pread/pwrite with offset

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be access…

  • High 7.8

    drm/amdgpu: fix amdgpu_hmm_range_get_pages

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre…

  • High 7.8

    drm/i915: Fix potential UAF in TTM object purge

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right po…

  • High 7.8

    blk-mq: pop cached request if it is usable

    In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_f…

  • High 7.8
    CVE-2026-64560 Public exploit

    posix-cpu-timers: Prevent UAF caused by non-leader exec() race

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() po…

  • High 7.1

    smb: client: mask server-provided mode to 07777 in modefromsid

    In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without …

  • High 7.0

    drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA …

  • High 7.0

    drm/amd/display: Use krealloc_array() in dal_vector_reserve()

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, whic…

  • High 7.0

    drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack …

  • Unscored —

    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used a…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467156
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467202
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479812
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482113
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482124
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482558
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492403
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492719
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2495941
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2495950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502188
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502321
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502443
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502449
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502463
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506790
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507042
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507135
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507216
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508504
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513470
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57251.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-43206
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43206
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43206
  • article
    https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43237
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43237
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43237
  • article
    https://lore.kernel.org/linux-cve-announce/2026050658-CVE-2026-43237-b6c1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43493
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43493
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43493
  • article
    https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43493.mbox
  • report
    https://access.redhat.com/security/cve/CVE-2026-45878