Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 90

Vulnerabilities 12

• High 7.8
  CVE-2025-39964 Exploited Public exploit

  crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

  In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 13, 2025

  KEV Sep 18, 2026
• Critical 9.8
  CVE-2026-64534

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• Critical 9.8
  CVE-2026-68159

  libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

  In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• High 7.8
  CVE-2026-45894

  iommu/vt-d: Clear Present bit before tearing down PASID entry

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-45959

  crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` at…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-53062

  dm cache policy smq: fix missing locks in invalidating cache blocks

  In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-63823

  keys: Pin request_key_auth payload in instantiate paths

  In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-68391

  Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-74518

  mm/hugetlb: fix list corruption in allocate_file_region_entries()

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• High 7.5
  CVE-2026-68155

  libceph: Reject monmaps advertising zero monitors

  In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.1
  CVE-2026-68293

  net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Unscored —
  CVE-2026-68188

  Bluetooth: RFCOMM: Fix session UAF in set_termios

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2403545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481940
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481948
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513150
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513165
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513453
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517004
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70498.json
• report
  https://access.redhat.com/security/cve/CVE-2025-39964
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39964
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39964
• article
  https://lore.kernel.org/linux-cve-announce/2025101334-CVE-2025-39964-7964@gregkh/T
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2026-45894
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45894
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45894
• article
  https://kernelcve.org/list/?q=CVE-2026-45894
• article
  https://lore.kernel.org/linux-cve-announce/2026052718-CVE-2026-45894-52a0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45959
• article
  https://kernelcve.org/list/?q=CVE-2026-45959
• article
  https://lore.kernel.org/linux-cve-announce/2026052733-CVE-2026-45959-5456@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53062
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53062
• article
  https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-53062-a727@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63823
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63823
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63823
• article
  https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63823-4e1e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64534