Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 13

• Critical 9.8
  CVE-2026-68123

  openvswitch: fix GSO userspace truncation underflow

  In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Critical 9.8
  CVE-2026-89970

  nvmet-auth: Synchronize timeout work during SQ teardown

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• Critical 9.4
  CVE-2026-72318

  cifs: validate DFS referral string offsets

  In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offse…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.8
  CVE-2026-89811

  drm/amdkfd: Add TLB flush after MES queue eviction/suspension

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this au…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.1
  CVE-2026-63925

  macsec: fix replay protection at XPN lower-PN wrap

  In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-68236

  drm/amd/display: set new_stream to NULL after release

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a l…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-68245

  drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• High 7.8
  CVE-2026-89894

  media: cx231xx: reject geometry changes while the VBI queue is busy

  In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 7.0
  CVE-2026-46309

  drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cache…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 8, 2026
• Unscored —
  CVE-2026-64507 Public exploit

  x86/bugs: Enable IBPB flush on BPF JIT allocation

  In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Unscored —
  CVE-2026-64508

  bpf: Support for hardening against JIT spraying

  In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Unscored —
  CVE-2026-68278

  drm/dp/mst: fix buffer overflows in sideband chunk accumulation

  In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length cur…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Unscored —
  CVE-2026-80887

  drm/vmwgfx: use check_add_overflow for shader size+offset bound

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507153
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513148
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535265
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535338
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_81552.json
• report
  https://access.redhat.com/security/cve/CVE-2026-46309
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46309
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46309
• article
  https://lore.kernel.org/linux-cve-announce/2026060852-CVE-2026-46309-7f6b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63925
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63925
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63925
• article
  https://kernelcve.org/list/?q=CVE-2026-63925
• article
  https://lore.kernel.org/linux-cve-announce/2026071949-CVE-2026-63925-2f73@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64507
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64507
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64507
• article
  https://lore.kernel.org/linux-cve-announce/2026072554-CVE-2026-64507-5288@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64508
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64508
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64508
• article
  https://lore.kernel.org/linux-cve-announce/2026072554-CVE-2026-64508-fe26@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68123
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68123
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68123
• article
  https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68236
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68236
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68236