Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 16

• Critical 9.8
  CVE-2026-63922

  ipv6: exthdrs: refresh nh after handling HAO option

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63924

  ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63984

  ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64383

  smb: client: fix double-free in SMB2_flush() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-64385

  smb: client: fix double-free in SMB2_ioctl() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-64386

  smb: client: fix query_info() replay double-free

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.1
  CVE-2026-46043

  RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-45910

  RDMA/rxe: Fix race condition in QP timer handlers

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swappe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-64582

  RDMA/rxe: Fix a use-after-free problem in rxe_mmap

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 5, 2026
• High 7.5
  CVE-2026-46114

  RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)paylo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.5
  CVE-2026-46133

  RDMA/rxe: Reject unknown opcodes before ICRC processing

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.1
  CVE-2026-63920

  ipv6: validate extension header length before copying to cmsg

  In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-23442

  ipv6: add NULL checks for idev in SRv6 paths

  In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks fo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2026
• Unscored —
  CVE-2026-80792

  ipv6: fix use-after-free in ip6_finish_output2()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80863

  RDMA/rxe: Fix OOB in free_rd_atomic_resources()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80864

  RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454807
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482098
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482550
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507134
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507216
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528665
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77219.json
• report
  https://access.redhat.com/security/cve/CVE-2026-23442
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23442
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23442
• article
  https://lore.kernel.org/linux-cve-announce/2026040314-CVE-2026-23442-fe23@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45910
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45910
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45910
• article
  https://lore.kernel.org/linux-cve-announce/2026052722-CVE-2026-45910-ff0e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46043
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46043
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46043
• article
  https://lore.kernel.org/linux-cve-announce/2026052751-CVE-2026-46043-153e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46114
• article
  https://lore.kernel.org/linux-cve-announce/2026052813-CVE-2026-46114-2563@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46133
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46133
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46133
• article
  https://kernelcve.org/list/?q=CVE-2026-46133
• article
  https://lore.kernel.org/linux-cve-announce/2026052818-CVE-2026-46133-09c3@gregkh/T