Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 13

• Critical 9.8
  CVE-2026-52924 Public exploit

  sctp: purge outqueue on stale COOKIE-ECHO handling

  In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• Critical 9.8
  CVE-2026-74581

  net: ipv6: clear suppressed fib6 rule result

  In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule sup…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 21, 2026
• Critical 9.4
  CVE-2026-43114

  netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• Critical 9.4
  CVE-2026-53131

  netfilter: require Ethernet MAC header before using eth_hdr()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 8.3
  CVE-2026-52920

  netfilter: xt_policy: fix strict mode inbound policy matching

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 8.2
  CVE-2026-53268

  netfilter: conntrack_irc: fix possible out-of-bounds read

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-53185

  zram: fix use-after-free in zram_bvec_write_partial()

  In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64189

  netfilter: ipset: fix race between dump and ip_set_list resize

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 20, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.8
  CVE-2026-64276

  Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.8
  CVE-2026-64277

  Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.5
  CVE-2026-23003 Public exploit

  ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 25, 2026
• Unscored —
  CVE-2025-68211

  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

  In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 16, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422696
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432681
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2466994
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492112
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492747
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492770
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502889
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507301
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2520980
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59723.json
• report
  https://access.redhat.com/security/cve/CVE-2025-68211
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68211
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68211
• article
  https://lore.kernel.org/linux-cve-announce/2025121634-CVE-2025-68211-180a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23003
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23003
• article
  https://lore.kernel.org/linux-cve-announce/2026012535-CVE-2026-23003-e684@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43114
• article
  https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52920
• article
  https://lore.kernel.org/linux-cve-announce/2026062430-CVE-2026-52920-22f8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52924
• article
  https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53131
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53131
• article
  https://lore.kernel.org/linux-cve-announce/2026062539-CVE-2026-53131-0b14@gregkh/T