Red Hat Security Advisory: kernel security update

Fixed packages 48

Vulnerabilities 8

• Critical 9.8
  CVE-2026-53006

  ipv6: fix possible UAF in icmpv6_rcv()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 8.8
  CVE-2026-46056

  Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 8.8
  CVE-2026-53071

  Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-17523

  can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

  In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• High 7.8
  CVE-2026-53009

  ice: fix double-free of tx_buf skb

  In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.8
  CVE-2026-74582

  packet: use consistent hard_header_len in non-ring send paths

  In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 21, 2026
• Medium 6.8
  CVE-2026-53196

  USB: serial: io_ti: fix heap overflow in get_manuf_info()

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519475
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65711.json
• report
  https://access.redhat.com/security/cve/CVE-2026-17523
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-17523
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-17523
• article
  https://github.com/torvalds/linux/commit/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68
• report
  https://access.redhat.com/security/cve/CVE-2026-46056
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46056
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46056
• article
  https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46056-0ff1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53006
• article
  https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53009
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53009
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53009
• article
  https://lore.kernel.org/linux-cve-announce/2026062449-CVE-2026-53009-4fef@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53071
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53071
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53071
• article
  https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53071-bdae@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53196
• article
  https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53196-bcc6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64191
• article
  https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-74582