Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 91

Vulnerabilities 19

• Critical 9.8
  CVE-2026-22984

  libceph: prevent potential out-of-bounds reads in handle_auth_done()

  In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 23, 2026
• Critical 9.8
  CVE-2026-43493

  crypto: pcrypt - Fix handling of MAY_BACKLOG requests

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2026
• Critical 9.8
  CVE-2026-52993 Public exploit

  tipc: fix double-free in tipc_buf_append()

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-68426

  xfrm: fix stale skb->prev after async crypto steals a GSO segment

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-72098

  dm-verity: fix buffer overflow in FEC calculation

  In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-72130

  nvmet-auth: reject short AUTH_RECEIVE buffers

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74746

  netfilter: flowtable: publish GC-visible tuple last

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.8
  CVE-2026-63917

  ip6: vti: Use ip6_tnl.net in vti6_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63919

  xfrm: input: hold netns during deferred transport reinjection

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63921

  ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-64438

  crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

  In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info)…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2026
• High 8.8
  CVE-2026-68294

  net: qrtr: restrict socket creation to the initial network namespace

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.1
  CVE-2026-64368

  mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

  In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.8
  CVE-2026-31663

  xfrm: hold dev ref until after transport_finish NF_HOOK

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-53239

  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64017

  blk-mq: pop cached request if it is usable

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.5
  CVE-2026-31467

  erofs: add GFP_NOIO in the bio completion if needed

  In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 22, 2026
• Unscored —
  CVE-2026-31581

  ALSA: 6fire: fix use-after-free on disconnect

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2460616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502449
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507118
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507213
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75560.json
• report
  https://access.redhat.com/security/cve/CVE-2026-22984
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-22984
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-22984
• article
  https://lore.kernel.org/linux-cve-announce/2026012349-CVE-2026-22984-001c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31467
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31467
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31467
• article
  https://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31467-914b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31581
• article
  https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31663
• article
  https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43493
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43493