Red Hat Security Advisory: kernel security update

Fixed packages 124

Vulnerabilities 21

• Critical 9.8
  CVE-2026-63922

  ipv6: exthdrs: refresh nh after handling HAO option

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63924

  ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63984

  ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64007

  netfilter: synproxy: refresh tcphdr after skb_ensure_writable

  In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-68426

  xfrm: fix stale skb->prev after async crypto steals a GSO segment

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-72130

  nvmet-auth: reject short AUTH_RECEIVE buffers

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.1
  CVE-2026-46043

  RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 8.8
  CVE-2026-63917

  ip6: vti: Use ip6_tnl.net in vti6_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63919

  xfrm: input: hold netns during deferred transport reinjection

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63921

  ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.1
  CVE-2026-31613

  smb: client: fix OOB reads parsing symlink error response

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-31663

  xfrm: hold dev ref until after transport_finish NF_HOOK

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-45910

  RDMA/rxe: Fix race condition in QP timer handlers

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swappe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-53239

  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-64582

  RDMA/rxe: Fix a use-after-free problem in rxe_mmap

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 5, 2026
• High 7.5
  CVE-2026-46114

  RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)paylo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.5
  CVE-2026-46133

  RDMA/rxe: Reject unknown opcodes before ICRC processing

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.1
  CVE-2026-63920

  ipv6: validate extension header length before copying to cmsg

  In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-80792

  ipv6: fix use-after-free in ip6_finish_output2()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80863

  RDMA/rxe: Fix OOB in free_rd_atomic_resources()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80864

  RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482098
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528665
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77218.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31613
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31613
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31613
• article
  https://lore.kernel.org/linux-cve-announce/2026042422-CVE-2026-31613-b061@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-31663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31663
• article
  https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45910
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45910
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45910
• article
  https://lore.kernel.org/linux-cve-announce/2026052722-CVE-2026-45910-ff0e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46043
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46043
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46043
• article
  https://lore.kernel.org/linux-cve-announce/2026052751-CVE-2026-46043-153e@gregkh/T