Skip to content
OpenAdvisories
Critical RHSA-2026:67723 11 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Sep 16, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 71

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream bpftool-debuginfo 0:7.0.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-devel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debug-devel-matched 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-devel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-64k-devel-matched 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-devel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debug-devel-matched 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-aarch64 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-s390x 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-debuginfo-common-x86_64 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-devel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-devel-matched 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-doc 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-tools-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-devel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream kernel-zfcpdump-devel-matched 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream perf 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream perf-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python3-perf-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream rtla 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos bpftool 0:7.0.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos bpftool-debuginfo 0:7.0.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debug-modules-extra 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-64k-modules-extra 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-abi-stablelists 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-modules-extra 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debug-uki-virt 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-aarch64 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-s390x 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-debuginfo-common-x86_64 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-modules-extra 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-tools-libs 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-uki-virt 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules-core 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos kernel-zfcpdump-modules-extra 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos perf-debuginfo 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos python3-perf 0:5.14.0-284.191.1.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::baseos python3-perf-debuginfo 0:5.14.0-284.191.1.el9_2

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-53006

    ipv6: fix possible UAF in icmpv6_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63886

    scsi: target: iscsi: Validate CHAP_R length before base64 decode

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.4
    CVE-2026-43114

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-46056

    Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53071

    Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53016

    crypto: ccp - copy IV using skcipher ivsize

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer w…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64304

    crypto: qat - validate RSA CRT component lengths

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74582

    packet: use consistent hard_header_len in non-ring send paths

    In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46054

    selinux: fix overlayfs mmap() and mprotect() access checks

    In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-45998

    rxrpc: Fix potential UAF after skb_unshare() failure

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-53196

    USB: serial: io_ti: fix heap overflow in get_manuf_info()

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466994
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482024
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482025
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482181
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492269
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492458
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507119
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519475
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67723.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-43114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43114
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43114
  • article
    https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-45998
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45998
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45998
  • article
    https://lore.kernel.org/linux-cve-announce/2026052741-CVE-2026-45998-6b5d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46054
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46054
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46054
  • article
    https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46054-b185@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46056
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46056
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46056
  • article
    https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46056-0ff1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53006
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53006
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53006
  • article
    https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53006-2b02@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53016
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53016
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53016
  • article
    https://lore.kernel.org/linux-cve-announce/2026062451-CVE-2026-53016-90ac@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53071
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53071