Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 8

• Critical 9.8
  CVE-2026-63886

  scsi: target: iscsi: Validate CHAP_R length before base64 decode

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.1
  CVE-2026-46155

  smb/client: fix out-of-bounds read in smb2_compound_op()

  In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns succe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-52933

  io_uring/poll: fix signed comparison in io_poll_get_ownership()

  In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-53185

  zram: fix use-after-free in zram_bvec_write_partial()

  In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.8
  CVE-2026-64560 Public exploit

  posix-cpu-timers: Prevent UAF caused by non-leader exec() race

  In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2026
• High 7.0
  CVE-2026-45998

  rxrpc: Fix potential UAF after skb_unshare() failure

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• Medium 6.8
  CVE-2026-53196

  USB: serial: io_ti: fix heap overflow in get_manuf_info()

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482660
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508504
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65708.json
• report
  https://access.redhat.com/security/cve/CVE-2026-45998
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45998
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45998
• article
  https://lore.kernel.org/linux-cve-announce/2026052741-CVE-2026-45998-6b5d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46155
• article
  https://lore.kernel.org/linux-cve-announce/2026052823-CVE-2026-46155-a53c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52933
• article
  https://lore.kernel.org/linux-cve-announce/2026062433-CVE-2026-52933-815c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53185
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53185
• article
  https://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53185-0922@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53196
• article
  https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53196-bcc6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63886
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63886
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63886
• article
  https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63886-48e4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64191
• article
  https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64560