Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 14

• Critical 9.8
  CVE-2026-64383

  smb: client: fix double-free in SMB2_flush() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-64534

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• Critical 9.8
  CVE-2026-64564 Public exploit

  sctp: don't free the ASCONF's own transport in DEL-IP processing

  In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 4, 2026
• Critical 9.1
  CVE-2026-89846

  scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPAB…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.8
  CVE-2026-63831

  mac802154: llsec: add skb_cow_data() before in-place crypto

  In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cry…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-74469 Public exploit

  sctp: prevent peer transport count overflow

  In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• High 7.8
  CVE-2026-53005

  af_unix: Drop all SCM attributes for SOCKMAP.

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-63802

  blk-cgroup: fix UAF in __blkcg_rstat_flush()

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-64053

  block: don't overwrite bip_vcnt in bio_integrity_copy_user()

  In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-68201

  ALSA: timer: drain a slave's callback before its master detaches it

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not it…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-72261

  ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.8
  CVE-2026-81000 Public exploit

  net: tun: bound receive headroom

  In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Unscored —
  CVE-2026-23007 Public exploit

  block: zero non-PI portion of auto integrity buffer

  In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 25, 2026
• Unscored —
  CVE-2026-80844 Public exploit

  xfrm: ah6: validate routing header segments_left

  In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432674
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502243
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502251
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507134
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510890
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528676
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535391
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71232.json
• report
  https://access.redhat.com/security/cve/CVE-2026-23007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23007
• article
  https://lore.kernel.org/linux-cve-announce/2026012536-CVE-2026-23007-38b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53005
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53005
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53005
• article
  https://lore.kernel.org/linux-cve-announce/2026062448-CVE-2026-53005-b325@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63802
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63802
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63802
• article
  https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63802-1c53@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63831
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63831
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63831
• article
  https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63831-36ca@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64053
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64053
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64053
• article
  https://kernelcve.org/list/?q=CVE-2026-64053
• article
  https://lore.kernel.org/linux-cve-announce/2026071909-CVE-2026-64053-29c0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64383
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64383
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64383