Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 17

• Critical 9.8
  CVE-2026-43493

  crypto: pcrypt - Fix handling of MAY_BACKLOG requests

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2026
• Critical 9.8
  CVE-2026-53002

  netfilter: conntrack: remove sprintf usage

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-64597

  smb: client: fix double-free in SMB2_close() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cle…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 6, 2026
• Critical 9.8
  CVE-2026-72129

  nvmet-rdma: handle inline data with a nonzero offset

  In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74480

  net: bridge: stop fast-leave after deleting a port group

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, contin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.3
  CVE-2026-64034

  net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.1
  CVE-2026-46266

  inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

  In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 3, 2026
• High 8.8
  CVE-2026-53275

  ipv6: mcast: Fix use-after-free when processing MLD queries

  In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.9
  CVE-2026-43133

  KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

  In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 6, 2026
• High 7.8
  CVE-2026-43339

  ipv6: prevent possible UaF in addrconf_permanent_addr()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-46015

  tcp: call sk_data_ready() after listener migration

  In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46330

  Revert "net/smc: Introduce TCP ULP support"

  In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 9, 2026
• High 7.8
  CVE-2026-53366

  ipv4: account for fraggap on the paged allocation path

  In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + trans…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2026
• High 7.8
  CVE-2026-64563 Public exploit

  rhashtable: clear stale iter->p on table restart

  In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 4, 2026
• High 7.5
  CVE-2026-46306

  flow_dissector: do not dissect PPPoE PFC frames

  In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 8, 2026
• High 7.1
  CVE-2026-46149

  scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.1
  CVE-2026-53223

  net: guard timestamp cmsgs to real error queue skbs

  In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486999
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492811
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492841
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2501252
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510892
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511932
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517046
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66180.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43133
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43133
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43133
• article
  https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43339
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43339
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43339
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43339.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-43493
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43493
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43493
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43493.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-46015
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46015
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46015
• article
  https://lore.kernel.org/linux-cve-announce/2026052745-CVE-2026-46015-796a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46149
• article
  https://kernelcve.org/list/?q=CVE-2026-46149