Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 27

• Critical 9.8
  CVE-2026-63888

  scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64007

  netfilter: synproxy: refresh tcphdr after skb_ensure_writable

  In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64386

  smb: client: fix query_info() replay double-free

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-68388

  smb/client: handle overlapping allocated ranges in fallocate

  In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate of…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Critical 9.1
  CVE-2026-68343

  smb: client: validate DFS referral PathConsumed

  In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. Ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.8
  CVE-2026-53374

  drm/amdgpu: zero-initialize GART table on allocation

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 8.8
  CVE-2026-64382

  smb: client: fix double-free in SMB2_open() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, clean…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 8.8
  CVE-2026-74580 Public exploit

  vhost: reset the vring metadata cache on vring reconfiguration

  In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 21, 2026
• High 8.4
  CVE-2026-63952

  memfd: deny writeable mappings when implying SEAL_WRITE

  In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.2
  CVE-2026-43233

  netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43206

  drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Alpine
  May 6, 2026
• High 7.8
  CVE-2026-43237

  drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the lo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 6, 2026
• High 7.8
  CVE-2026-45878

  drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-45991

  udf: fix partition descriptor append bookkeeping

  In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46120

  ip6_gre: Use cached t->net in ip6erspan_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-net…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-52991

  sched/psi: fix race between file release and pressure write

  In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_fi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-53189

  mm/huge_memory: update file PMD counter before folio_put()

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-53356

  drm/i915/gem: Fix phys BO pread/pwrite with offset

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be access…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 1, 2026
• High 7.8
  CVE-2026-63879

  drm/amdgpu: fix amdgpu_hmm_range_get_pages

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 7.8
  CVE-2026-63884

  drm/i915: Fix potential UAF in TTM object purge

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-64560 Public exploit

  posix-cpu-timers: Prevent UAF caused by non-leader exec() race

  In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2026
• High 7.5
  CVE-2026-64048

  net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

  In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.1
  CVE-2026-64379

  smb: client: mask server-provided mode to 07777 in modefromsid

  In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.0
  CVE-2026-53143

  drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.0
  CVE-2026-53329

  drm/amd/display: Use krealloc_array() in dal_vector_reserve()

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, whic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 1, 2026
• High 7.0
  CVE-2026-64219

  drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 24, 2026
• Unscored —
  CVE-2026-53136

  drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467202
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482113
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492768
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2495941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2495950
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502188
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502321
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502443
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502589
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506790
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507216
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508504
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513373
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513470
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57252.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43206
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43206
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43206
• article
  https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43233
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43233
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43233
• article
  https://lore.kernel.org/linux-cve-announce/2026050657-CVE-2026-43233-e6b4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43237
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43237
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43237