Red Hat Security Advisory: kernel security update

Fixed packages 71

Vulnerabilities 8

• Critical 10.0
  CVE-2026-74705

  udp: fix potential use-after-free in tunnel segmentation

  In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-68426

  xfrm: fix stale skb->prev after async crypto steals a GSO segment

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-72130

  nvmet-auth: reject short AUTH_RECEIVE buffers

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.8
  CVE-2026-63917

  ip6: vti: Use ip6_tnl.net in vti6_changelink().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63919

  xfrm: input: hold netns during deferred transport reinjection

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-63921

  ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-31663

  xfrm: hold dev ref until after transport_finish NF_HOOK

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 24, 2026
• High 7.8
  CVE-2026-53239

  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2461462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516448
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521498
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80908.json
• report
  https://access.redhat.com/security/cve/CVE-2026-31663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-31663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-31663
• article
  https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53239
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53239
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53239
• article
  https://kernelcve.org/list/?q=CVE-2026-53239
• article
  https://lore.kernel.org/linux-cve-announce/2026062510-CVE-2026-53239-8ebc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63917
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63917
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63917
• article
  https://lore.kernel.org/linux-cve-announce/2026071947-CVE-2026-63917-4a8f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63919
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63919
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63919
• article
  https://kernelcve.org/list/?q=CVE-2026-63919
• article
  https://lore.kernel.org/linux-cve-announce/2026071947-CVE-2026-63919-e224@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63921
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63921
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63921
• article
  https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63921-ea11@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68426
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68426
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68426
• article
  https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68426-9cce@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-72130
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-72130
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-72130