Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 92

Vulnerabilities 11

• Critical 9.8
  CVE-2026-64385

  smb: client: fix double-free in SMB2_ioctl() replay

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-68123

  openvswitch: fix GSO userspace truncation underflow

  In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Critical 9.8
  CVE-2026-89970

  nvmet-auth: Synchronize timeout work during SQ teardown

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• Critical 9.4
  CVE-2026-72318

  cifs: validate DFS referral string offsets

  In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offse…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.3
  CVE-2026-72289

  KVM: arm64: vgic: Check the interrupt is still ours before migrating it

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.1
  CVE-2026-63925

  macsec: fix replay protection at XPN lower-PN wrap

  In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-43332

  thermal: core: Fix thermal zone device registration error path

  In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-64191

  i2c: stub: Reject I2C block transfers with invalid length

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 20, 2026
• High 7.8
  CVE-2026-80521 Public exploit

  af_unix: Unlink scc_entry in unix_del_edge().

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the followin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• Unscored —
  CVE-2026-64507 Public exploit

  x86/bugs: Enable IBPB flush on BPF JIT allocation

  In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Unscored —
  CVE-2026-64508

  bpf: Support for hardening against JIT spraying

  In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507153
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535265
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81406.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43332
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43332
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43332
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43332.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-63925
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63925
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63925
• article
  https://kernelcve.org/list/?q=CVE-2026-63925
• article
  https://lore.kernel.org/linux-cve-announce/2026071949-CVE-2026-63925-2f73@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64191
• article
  https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64385
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64385
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64385
• article
  https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64385-80b2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64507
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64507
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64507
• article
  https://lore.kernel.org/linux-cve-announce/2026072554-CVE-2026-64507-5288@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64508
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64508
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64508
• article
  https://lore.kernel.org/linux-cve-announce/2026072554-CVE-2026-64508-fe26@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68123