Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 38

• Critical 9.8
  CVE-2026-52986

  netfilter: nf_conntrack_sip: don't use simple_strtoul

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper tha…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-53049

  gfs2: add some missing log locking

  In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-63922

  ipv6: exthdrs: refresh nh after handling HAO option

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63924

  ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63984

  ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63993

  vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

  In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63994

  tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64385

  smb: client: fix double-free in SMB2_ioctl() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-74569

  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74669

  ipvs: clear IPv4 options after rebasing tunnel ICMP errors

  In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-74746

  netfilter: flowtable: publish GC-visible tuple last

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• Critical 9.8
  CVE-2026-89972

  nvme: add missing SRCU grace period in error path

  In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• Critical 9.3
  CVE-2026-72289

  KVM: arm64: vgic: Check the interrupt is still ours before migrating it

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.1
  CVE-2026-63992

  tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-46317

  KVM: arm64: Reassign nested_mmus array behind mmu_lock

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 9, 2026
• High 8.8
  CVE-2026-63829

  net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 8.8
  CVE-2026-64557

  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2026
• High 8.8
  CVE-2026-68432

  vxlan: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 12, 2026
• High 8.8
  CVE-2026-72052

  net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.8
  CVE-2026-80921

  KVM: s390: vsie: zero stale crypto bits

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2026
• High 8.2
  CVE-2026-74516

  KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a sep…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• High 8.0
  CVE-2026-53357

  Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 2, 2026
• High 7.9
  CVE-2026-46076

  KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1

  In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2025-40149

  tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

  In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2026-43332

  thermal: core: Fix thermal zone device registration error path

  In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-45861

  gfs2: Fix slab-use-after-free in qd_put

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-46275

  Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the li…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 8, 2026
• High 7.8
  CVE-2026-72255

  netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.8
  CVE-2026-90227

  nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

  In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 17, 2026
• High 7.8
  CVE-2026-93288

  netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 7.5
  CVE-2026-89480

  nvme-tcp: reject a read that transferred too few bytes

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received again…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• High 7.5
  CVE-2026-89481

  nvme-tcp: fix host memory disclosure on R2T for a read command

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• High 7.5
  CVE-2026-97417

  netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 7.1
  CVE-2026-52942

  netfilter: nf_log: validate MAC header was set before dumping it

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", withou…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.1
  CVE-2026-63920

  ipv6: validate extension header length before copying to cmsg

  In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.1
  CVE-2026-72099

  dm-integrity: don't increment hash_offset twice

  In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash_offset twice hash_offset is already incremented in the loop "for (i = 0; i < to_copy; i++, ts--)". Do not increment it again.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Unscored —
  CVE-2026-23442

  ipv6: add NULL checks for idev in SRv6 paths

  In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks fo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2026
• Unscored —
  CVE-2026-80792

  ipv6: fix use-after-free in ip6_finish_output2()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454807
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482143
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486976
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492276
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2496574
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516445
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516998
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521375
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524483
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2536346
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540500