Skip to content
OpenAdvisories
Critical RHSA-2026:76738 35 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 92

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 kernel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-devel-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-64k-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-abi-stablelists 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-devel-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debug-uki-virt 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-devel-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-doc 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-extra-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-modules-internal 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-rt-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-tools-libs-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-uki-virt-addons 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 libperf-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 perf-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 python3-perf-debuginfo 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rtla 0:6.12.0-211.63.1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rv 0:6.12.0-211.63.1.el10_2
Red Hat · Shadow Migration Toolkit 10 shadow_migration_toolkit:10::el10 kernel-modules-internal 0:6.12.0-211.63.1.el10_2

Vulnerabilities 35

  • Critical 9.8
    CVE-2026-63922

    ipv6: exthdrs: refresh nh after handling HAO option

    In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63924

    ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63984

    ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63994

    tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

    In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64132

    ipv6: ioam: refresh hdr pointer before ioam6_event()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-68476

    ipvs: reload ip header after head reallocation

    In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74669

    ipvs: clear IPv4 options after rebasing tunnel ICMP errors

    In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74746

    netfilter: flowtable: publish GC-visible tuple last

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89972

    nvme: add missing SRCU grace period in error path

    In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-64024

    tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-63992

    tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

    In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-72320

    netfilter: nft_lookup: fix catchall element handling with inverted lookups

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catchall element handling with inverted lookups nft_lookup_eval() decides whether a lookup matched (`found`) from the direct set lookup and priv->invert before fall…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63829

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64557

    Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-68432

    vxlan: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-72052

    net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-80921

    KVM: s390: vsie: zero stale crypto bits

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-74516

    KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a sep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.0
    CVE-2026-53357

    Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46275

    Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the li…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53270

    ipvs: clear the svc scheduler ptr early on edit

    In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-63918

    l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

    In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64078

    netfilter: x_tables: add and use xtables_unregister_table_exit

    In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-72255

    netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74582

    packet: use consistent hard_header_len in non-ring send paths

    In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-90227

    nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

    In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-93288

    netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-45860

    netfilter: nf_conncount: increase the connection clean up limit to 64

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-97417

    netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-45856

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

    In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-63920

    ipv6: validate extension header length before copying to cmsg

    In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2026-52972

    crypto: af_alg - Cap AEAD AD length to 0x80000000

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-63794

    KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80775 Public exploit

    futex: Fix race on the initial mm->futex.phash.ref allocation

    In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80792

    ipv6: fix use-after-free in ip6_finish_output2()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482115
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482129
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2486398
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492364
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492853
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496574
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502230
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502241
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502327
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502330
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502333
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502384
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502395
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502554
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502619
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508320
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514441
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516306
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516606
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516717
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516998
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519475
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521057
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521375
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528542
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528550
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2531066
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2536346
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2540479
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2540500
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76738.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-45856