Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 124

Vulnerabilities 14

• Critical 9.8
  CVE-2026-52924 Public exploit

  sctp: purge outqueue on stale COOKIE-ECHO handling

  In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• Critical 9.8
  CVE-2026-52993 Public exploit

  tipc: fix double-free in tipc_buf_append()

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-53002

  netfilter: conntrack: remove sprintf usage

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-72098

  dm-verity: fix buffer overflow in FEC calculation

  In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74746

  netfilter: flowtable: publish GC-visible tuple last

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.8
  CVE-2026-53071

  Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 8.8
  CVE-2026-68294

  net: qrtr: restrict socket creation to the initial network namespace

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.4
  CVE-2026-53091

  net: pull headers in qdisc_pkt_len_segs_init()

  In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-53185

  zram: fix use-after-free in zram_bvec_write_partial()

  In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.5
  CVE-2022-49670

  linux/dim: Fix divide by 0 in RDMA DIM

  In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 6.3
  CVE-2026-53059

  dm log: fix out-of-bounds write due to region_count overflow

  In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Unscored —
  CVE-2026-31581

  ALSA: 6fire: fix use-after-free on disconnect

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026
• Unscored —
  CVE-2026-68480

  x86/bugs: Make Safe-RET robust against interrupt injection

  In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2347919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73645.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49670
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49670
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49670
• article
  https://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49670-0b7b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31581
• article
  https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52924
• article
  https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52993
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52993
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52993
• article
  https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53002
• article
  https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53002-8577@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53059