Skip to content
OpenAdvisories
Critical RHSA-2026:65710 13 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Sep 9, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-core 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-core 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-devel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-devel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-doc 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules-extra 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-libs 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-core 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-core 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-devel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-devel 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-doc 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules-extra 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-libs 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf-debuginfo 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf 0:4.18.0-305.206.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.206.1.el8_4

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-53006

    ipv6: fix possible UAF in icmpv6_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64268

    RDMA/siw: bound Read Response placement to the RREAD length

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->proce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53071

    Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-74580 Public exploit

    vhost: reset the vring metadata cache on vring reconfiguration

    In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2021-47600

    dm btree remove: fix use after free in rebalance_children()

    In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalance_children() Move dm_tm_unlock() after dm_tm_dec().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-17523

    can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

    In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46120

    ip6_gre: Use cached t->net in ip6erspan_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53016

    crypto: ccp - copy IV using skcipher ivsize

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer w…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64191

    i2c: stub: Reject I2C block transfers with invalid length

    In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74582

    packet: use consistent hard_header_len in non-ring send paths

    In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-53196

    USB: serial: io_ti: fix heap overflow in get_manuf_info()

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52924

    netfilter: nf_tables: don't skip expired elements during walk

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-31411

    net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

    In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() Reproducer available at [1]. The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc pointer from msg->vcc and …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2343897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482614
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492269
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492458
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502872
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507407
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519475
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65710.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-47600
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47600
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47600
  • article
    https://lore.kernel.org/linux-cve-announce/2024061922-CVE-2021-47600-5cc4@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-52924
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52924
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52924
  • article
    https://lore.kernel.org/linux-cve-announce/2025020500-CVE-2023-52924-03d7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-17523
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-17523
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-17523
  • article
    https://github.com/torvalds/linux/commit/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68
  • report
    https://access.redhat.com/security/cve/CVE-2026-31411
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31411
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31411
  • article
    https://lore.kernel.org/linux-cve-announce/2026040820-CVE-2026-31411-7ef9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46120
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46120
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46120
  • article
    https://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46120-1a01@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53006
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53006
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53006
  • article
    https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53016