Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 71

Vulnerabilities 10

• Critical 9.8
  CVE-2026-52924 Public exploit

  sctp: purge outqueue on stale COOKIE-ECHO handling

  In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• Critical 9.8
  CVE-2026-53002

  netfilter: conntrack: remove sprintf usage

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Critical 9.8
  CVE-2026-74746

  netfilter: flowtable: publish GC-visible tuple last

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.8
  CVE-2026-68294

  net: qrtr: restrict socket creation to the initial network namespace

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-46120

  ip6_gre: Use cached t->net in ip6erspan_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-net…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.8
  CVE-2026-53009

  ice: fix double-free of tx_buf skb

  In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-53185

  zram: fix use-after-free in zram_bvec_write_partial()

  In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.5
  CVE-2022-49670

  linux/dim: Fix divide by 0 in RDMA DIM

  In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2026-31581

  ALSA: 6fire: fix use-after-free on disconnect

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2347919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524483
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77215.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49670
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49670
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49670
• article
  https://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49670-0b7b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31581
• article
  https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46120
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46120
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46120
• article
  https://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46120-1a01@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-52924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52924
• article
  https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53002
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53002
• article
  https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53002-8577@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53009
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53009
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53009
• article
  https://lore.kernel.org/linux-cve-announce/2026062449-CVE-2026-53009-4fef@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53185
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53185