Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 48

Vulnerabilities 6

• Critical 9.8
  CVE-2026-63888

  scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-74580 Public exploit

  vhost: reset the vring metadata cache on vring reconfiguration

  In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 21, 2026
• High 8.1
  CVE-2026-43051

  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

  In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2026-53016

  crypto: ccp - copy IV using skcipher ivsize

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.1
  CVE-2026-46054

  selinux: fix overlayfs mmap() and mprotect() access checks

  In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• Unscored —
  CVE-2026-31411

  net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

  In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() Reproducer available at [1]. The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc pointer from msg->vcc and …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502443
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59473.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31411
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31411
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31411
• article
  https://lore.kernel.org/linux-cve-announce/2026040820-CVE-2026-31411-7ef9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43051
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43051
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43051
• article
  https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43051-0d15@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46054
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46054
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46054
• article
  https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46054-b185@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53016
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53016
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53016
• article
  https://lore.kernel.org/linux-cve-announce/2026062451-CVE-2026-53016-90ac@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63888
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63888
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63888
• article
  https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-74580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521055
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-74580
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-74580
• article
  https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/T