Skip to content
OpenAdvisories
Critical RHSA-2026:67468 11 CVEs

Red Hat Security Advisory: kernel security update

Published Sep 15, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos bpftool 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos bpftool-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-abi-stablelists 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-core 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-core 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-devel 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-modules 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debug-modules-extra 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-s390x 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-devel 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-doc 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-modules 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-modules-extra 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-tools-libs 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-core 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-devel 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-modules 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perf 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perf-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-perf 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-perf-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb bpftool-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debug-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-aarch64 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-debuginfo-common-x86_64 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-tools-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb kernel-tools-libs-devel 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb perf-debuginfo 0:4.18.0-553.163.1.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-perf-debuginfo 0:4.18.0-553.163.1.el8_10

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-72098

    dm-verity: fix buffer overflow in FEC calculation

    In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64117

    wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee802…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-63889

    scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.9
    CVE-2026-43133

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52947

    net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53182

    wifi: nl80211: reject oversized EMA RNR lists

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-63802

    blk-cgroup: fix UAF in __blkcg_rstat_flush()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-71127

    wifi: mac80211: Discard Beacon frames to non-broadcast address

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-53161

    EDAC/bluefield: Fix potential integer overflow

    In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2333977
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467065
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492432
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492722
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502320
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513286
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516501
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517010
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67468.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-53161
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-53161
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-53161
  • article
    https://lore.kernel.org/linux-cve-announce/2024122431-CVE-2024-53161-50f6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-71127
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71127
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71127
  • article
    https://lore.kernel.org/linux-cve-announce/2026011450-CVE-2025-71127-29a7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43133
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43133
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43133
  • article
    https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-52947
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-52947
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-52947
  • article
    https://kernelcve.org/list/?q=CVE-2026-52947
  • article
    https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-52947-8205@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53182
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53182
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53182
  • article
    https://lore.kernel.org/linux-cve-announce/2026062555-CVE-2026-53182-1e3e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63802
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63802
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63802
  • article
    https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63802-1c53@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63889