Skip to content
OpenAdvisories
Critical RHSA-2026:64767 10 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Sep 8, 2026 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 91

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel-matched 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel-matched 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-abi-stablelists 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel-matched 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-uki-virt 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-aarch64 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-ppc64le 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-s390x 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-x86_64 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel-matched 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-doc 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-kvm 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-kvm 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt-addons 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel-matched 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-core 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-extra 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf-debuginfo 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rtla 0:6.12.0-55.103.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rv 0:6.12.0-55.103.1.el10_0

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-53006

    ipv6: fix possible UAF in icmpv6_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63886

    scsi: target: iscsi: Validate CHAP_R length before base64 decode

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.4
    CVE-2026-43114

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-46155

    smb/client: fix out-of-bounds read in smb2_compound_op()

    In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns succe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46056

    Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-46099

    net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

    In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40149

    tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

    In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46145

    RDMA/mana: Validate rx_hash_key_len

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53016

    crypto: ccp - copy IV using skcipher ivsize

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer w…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64304

    crypto: qat - validate RSA CRT component lengths

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414466
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466994
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482181
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482581
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482660
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492269
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507119
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64767.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-40149
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40149
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40149
  • article
    https://lore.kernel.org/linux-cve-announce/2025111257-CVE-2025-40149-2c48@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43114
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43114
  • article
    https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46056
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46056
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46056
  • article
    https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46056-0ff1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46099
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46099
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46099
  • article
    https://lore.kernel.org/linux-cve-announce/2026052704-CVE-2026-46099-2a55@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46145
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46145
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46145
  • article
    https://lore.kernel.org/linux-cve-announce/2026052821-CVE-2026-46145-e347@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46155
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46155
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46155
  • article
    https://lore.kernel.org/linux-cve-announce/2026052823-CVE-2026-46155-a53c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53006
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53006
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53006