Skip to content
OpenAdvisories
Critical RHSA-2026:68507 19 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Sep 18, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 kernel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-abi-stablelists 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-uki-virt 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-doc 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt-addons 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf-debuginfo 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rtla 0:6.12.0-211.56.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rv 0:6.12.0-211.56.1.el10_2

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-53176

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63923

    octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68128

    ice: reject out-of-range ptype in ice_parser_profile_init

    In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-23172

    net: wwan: t7xx: fix potential skb->frags overflow in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-64176

    wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52971

    net: ena: PHC: Fix potential use-after-free in get_timestamp

    In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53192

    ALSA: timer: Fix UAF at snd_timer_user_params()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53193

    ALSA: timer: Forcibly close timer instances at closing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64029

    ALSA: seq: Serialize UMP output teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68143

    net: slip: serialize receive against buffer reallocation

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68200

    ALSA: timer: don't re-enter an instance callback that is still running

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-72102

    dm_early_create: fix freeing used table on dm_resume failure

    In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.7
    CVE-2026-64456

    hwrng: virtio: clamp device-reported used.len at copy_data()

    In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-63869

    wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-64175

    wifi: iwlwifi: mld: stop TX during firmware restart

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-64414

    netfilter: handle unreadable frags

    In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-58007

    soc: qcom: socinfo: Avoid out of bounds read of serial number

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2348565
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439924
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492436
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492741
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492742
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502295
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502418
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502575
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502596
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507102
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507255
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513171
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513271
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513286
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516490
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68507.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-58007
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-58007
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-58007
  • article
    https://lore.kernel.org/linux-cve-announce/2025022655-CVE-2024-58007-123c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23172
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23172
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23172
  • article
    https://lore.kernel.org/linux-cve-announce/2026021421-CVE-2026-23172-acf0@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-52971
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-52971
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-52971
  • article
    https://lore.kernel.org/linux-cve-announce/2026062439-CVE-2026-52971-0bf1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53176
  • article
    https://lore.kernel.org/linux-cve-announce/2026062553-CVE-2026-53176-c8a7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53192
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53192