Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 18

• Critical 9.8
  CVE-2026-43493

  crypto: pcrypt - Fix handling of MAY_BACKLOG requests

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2026
• Critical 9.8
  CVE-2026-52924 Public exploit

  sctp: purge outqueue on stale COOKIE-ECHO handling

  In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• Critical 9.8
  CVE-2026-52993 Public exploit

  tipc: fix double-free in tipc_buf_append()

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-53002

  netfilter: conntrack: remove sprintf usage

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-68426

  xfrm: fix stale skb->prev after async crypto steals a GSO segment

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-72098

  dm-verity: fix buffer overflow in FEC calculation

  In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74746

  netfilter: flowtable: publish GC-visible tuple last

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.8
  CVE-2026-63917

  ip6: vti: Use ip6_tnl.net in vti6_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63919

  xfrm: input: hold netns during deferred transport reinjection

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63921

  ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-68294

  net: qrtr: restrict socket creation to the initial network namespace

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.4
  CVE-2026-53091

  net: pull headers in qdisc_pkt_len_segs_init()

  In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2024-57990

  wifi: mt76: mt7925: fix off by one in mt7925_load_clc()

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() This comparison should be >= instead of > to prevent an out of bounds read and write.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2026-31663

  xfrm: hold dev ref until after transport_finish NF_HOOK

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-53239

  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64558

  s390/pkey: Check length in pkey_pckmo handler implementation

  In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The ha…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2026
• High 7.5
  CVE-2022-49670

  linux/dim: Fix divide by 0 in RDMA DIM

  In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2026-68480

  x86/bugs: Make Safe-RET robust against interrupt injection

  In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2347919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74174.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49670
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49670
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49670
• article
  https://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49670-0b7b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-57990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-57990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-57990
• article
  https://lore.kernel.org/linux-cve-announce/2025022638-CVE-2024-57990-67dc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31663
• article
  https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43493
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43493
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43493
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43493.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-52924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52924