Skip to content
OpenAdvisories
Critical RHSA-2026:77301 18 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Oct 8, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 49

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-core 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-core 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-devel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-devel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-doc 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules-extra 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-libs 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-core 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-core 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-devel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-devel 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-doc 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules-extra 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-libs 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf-debuginfo 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf 0:4.18.0-477.172.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.172.1.el8_8

Vulnerabilities 18

  • Critical 9.8
    CVE-2026-52924 Public exploit

    sctp: purge outqueue on stale COOKIE-ECHO handling

    In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68426

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74746

    netfilter: flowtable: publish GC-visible tuple last

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46043

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63917

    ip6: vti: Use ip6_tnl.net in vti6_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63919

    xfrm: input: hold netns during deferred transport reinjection

    In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63921

    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53781

    smc: Fix use-after-free in tcp_write_timer_handler().

    In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68347

    ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

    In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provide…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31663

    xfrm: hold dev ref until after transport_finish NF_HOOK

    In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53239

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64582

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46133

    RDMA/rxe: Reject unknown opcodes before ICRC processing

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43020

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68480

    x86/bugs: Make Safe-RET robust against interrupt injection

    In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80863

    RDMA/rxe: Fix OOB in free_rd_atomic_resources()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80864

    RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420279
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424879
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482550
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492095
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492779
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502434
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528646
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528665
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77301.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-53781
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53781
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53781
  • article
    https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53781-cb1d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68347
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68347
  • article
    https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2025-68347-74dd@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31663
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31663
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31663
  • article
    https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43020
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43020
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43020
  • article
    https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43020-3561@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46043
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46043
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46043