Skip to content
OpenAdvisories
Critical RHSA-2026:77217 19 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Oct 8, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 57

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-core 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-core 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-devel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-devel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-doc 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules-extra 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-libs 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-core 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-core 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-devel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-aarch64 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-s390x 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-devel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-doc 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules-extra 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-libs 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump-core 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump-devel 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump-modules 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-zfcpdump-modules-extra 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf-debuginfo 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf 0:4.18.0-305.211.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.211.1.el8_4

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-52924 Public exploit

    sctp: purge outqueue on stale COOKIE-ECHO handling

    In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-64007

    netfilter: synproxy: refresh tcphdr after skb_ensure_writable

    In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-68426

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74746

    netfilter: flowtable: publish GC-visible tuple last

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46043

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63917

    ip6: vti: Use ip6_tnl.net in vti6_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63919

    xfrm: input: hold netns during deferred transport reinjection

    In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63921

    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31663

    xfrm: hold dev ref until after transport_finish NF_HOOK

    In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45984

    gfs2: Fix use-after-free in iomap inline data write path

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45991

    udf: fix partition descriptor append bookkeeping

    In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53239

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64582

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46133

    RDMA/rxe: Reject unknown opcodes before ICRC processing

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31581

    ALSA: 6fire: fix use-after-free on disconnect

    In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80863

    RDMA/rxe: Fix OOB in free_rd_atomic_resources()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80864

    RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461471
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482113
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482550
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492095
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492779
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502361
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502434
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517010
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528646
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528665
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77217.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-31581
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31581
  • article
    https://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31663
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31663
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31663
  • article
    https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-45984
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45984
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45984
  • article
    https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-45991
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45991
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45991
  • article
    https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45991-24df@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46043
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46043