Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 31

• Critical 9.8
  CVE-2026-53176

  IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

  In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• Critical 9.8
  CVE-2026-68159

  libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

  In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-68426

  xfrm: fix stale skb->prev after async crypto steals a GSO segment

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.1
  CVE-2026-46043

  RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 8.8
  CVE-2026-63917

  ip6: vti: Use ip6_tnl.net in vti6_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63919

  xfrm: input: hold netns during deferred transport reinjection

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63921

  ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-68128

  ice: reject out-of-range ptype in ice_parser_profile_init

  In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.8
  CVE-2026-72003

  wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.4
  CVE-2026-23172

  net: wwan: t7xx: fix potential skb->frags overflow in RX path

  In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 14, 2026
• High 8.4
  CVE-2026-72243

  selinux: check connect-related permissions on TCP Fast Open

  In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are ch…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.4
  CVE-2026-72298

  net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.2
  CVE-2026-63913

  netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.1
  CVE-2026-64176

  wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-31663

  xfrm: hold dev ref until after transport_finish NF_HOOK

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-45910

  RDMA/rxe: Fix race condition in QP timer handlers

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swappe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-52971

  net: ena: PHC: Fix potential use-after-free in get_timestamp

  In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-53192

  ALSA: timer: Fix UAF at snd_timer_user_params()

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-53193

  ALSA: timer: Forcibly close timer instances at closing

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026
• High 7.8
  CVE-2026-53239

  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64029

  ALSA: seq: Serialize UMP output teardown with event_input

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-64582

  RDMA/rxe: Fix a use-after-free problem in rxe_mmap

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 5, 2026
• High 7.8
  CVE-2026-68200

  ALSA: timer: don't re-enter an instance callback that is still running

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-72102

  dm_early_create: fix freeing used table on dm_resume failure

  In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.6
  CVE-2026-63869

  wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.5
  CVE-2026-46114

  RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)paylo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.5
  CVE-2026-46133

  RDMA/rxe: Reject unknown opcodes before ICRC processing

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.5
  CVE-2026-64175

  wifi: iwlwifi: mld: stop TX during firmware restart

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Medium 6.8
  CVE-2026-53196

  USB: serial: io_ti: fix heap overflow in get_manuf_info()

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026
• Unscored —
  CVE-2026-64174

  wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MB…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-68363

  wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482098
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492741
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492742
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502575
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513165
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513286
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516490
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516599
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516684
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68570.json
• report
  https://access.redhat.com/security/cve/CVE-2026-23172
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23172
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23172
• article
  https://lore.kernel.org/linux-cve-announce/2026021421-CVE-2026-23172-acf0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31663