Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2026:71233 14 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Sep 24, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 kernel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-abi-stablelists 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-uki-virt 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-doc 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt-addons 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf-debuginfo 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rtla 0:6.12.0-211.59.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rv 0:6.12.0-211.59.1.el10_2

Vulnerabilities 14

  • High 8.8
    CVE-2026-53266 Exploited Public exploit

    netfilter: bridge: make ebt_snat ARP rewrite writable

    In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-64383

    smb: client: fix double-free in SMB2_flush() replay

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-64564 Public exploit

    sctp: don't free the ASCONF's own transport in DEL-IP processing

    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74569

    netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-89846

    scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPAB…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63831

    mac802154: llsec: add skb_cow_data() before in-place crypto

    In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cry…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-74469 Public exploit

    sctp: prevent peer transport count overflow

    In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-72243

    selinux: check connect-related permissions on TCP Fast Open

    In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are ch…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63802

    blk-cgroup: fix UAF in __blkcg_rstat_flush()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64053

    block: don't overwrite bip_vcnt in bio_integrity_copy_user()

    In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68201

    ALSA: timer: drain a slave's callback before its master detaches it

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not it…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-81000 Public exploit

    net: tun: bound receive headroom

    In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23007 Public exploit

    block: zero non-PI portion of auto integrity buffer

    In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80844 Public exploit

    xfrm: ah6: validate routing header segments_left

    In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432674
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2485368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502243
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502498
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507134
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510890
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516684
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517052
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528676
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532176
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535391
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71233.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23007
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23007
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23007
  • article
    https://lore.kernel.org/linux-cve-announce/2026012536-CVE-2026-23007-38b1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53266
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53266
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53266
  • article
    https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53266-6162@gregkh/T/#u
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2026-63802
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63802
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63802
  • article
    https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63802-1c53@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63831
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63831
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63831
  • article
    https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63831-36ca@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64053
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64053
  • article
    https://kernelcve.org/list/?q=CVE-2026-64053
  • article
    https://lore.kernel.org/linux-cve-announce/2026071909-CVE-2026-64053-29c0@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64383
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64383