Fixed packages 91
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-devel-matched | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debug-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-devel-matched | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-64k-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-abi-stablelists | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-devel-matched | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debug-uki-virt | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debuginfo-common-aarch64 | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debuginfo-common-ppc64le | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debuginfo-common-s390x | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-debuginfo-common-x86_64 | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-devel-matched | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-doc | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debug-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-64k-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-kvm | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debug-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-kvm | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-rt-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-tools | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-tools-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-tools-libs | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-tools-libs-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-uki-virt | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-uki-virt-addons | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-devel | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-devel-matched | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-modules | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-modules-core | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | kernel-zfcpdump-modules-extra | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | libperf | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | libperf-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | perf | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | perf-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | python3-perf | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | python3-perf-debuginfo | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | rtla | 0:6.12.0-55.111.1.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | rv | 0:6.12.0-55.111.1.el10_0 |
Vulnerabilities 16
-
Critical 9.8
ipv6: exthdrs: refresh nh after handling HAO option
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…
-
Critical 9.8
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…
-
Critical 9.8
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…
-
Critical 9.8
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instea…
-
Critical 9.8
ixgbevf: fix use-after-free in VEPA multicast source pruning
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb …
-
High 8.4
ALSA: virtio: Validate control metadata from the device
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used …
-
High 7.8
Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…
-
High 7.8CVE-2026-98260 Public exploit
exec: Cleanup POSIX timers right after de_thread()
In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…
-
High 7.1
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…
-
High 7.1
ipv6: validate extension header length before copying to cmsg
In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…
-
High 7.0
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…
-
Unscored —
Bluetooth: MGMT: validate LTK enc_size on load
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…
-
Unscored —
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helpe…
-
Unscored —
mm/khugepaged: write all dirty file folios when collapsing
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions…
-
Unscored —
x86/bugs: Make Safe-RET robust against interrupt injection
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …
-
Unscored —
ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464455
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464502
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468228
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482566
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482588
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502326
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502327
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502330
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502369
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502395
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502541
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507277
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508363
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528542
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2546491
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83707.json
-
report
https://access.redhat.com/security/cve/CVE-2026-31772
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-31772
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-31772
-
article
https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T
-
report
https://access.redhat.com/security/cve/CVE-2026-43020
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-43020
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43020
-
article
https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43020-3561@gregkh/T
-
report
https://access.redhat.com/security/cve/CVE-2026-43450
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-43450
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43450
-
article
https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43450-8919@gregkh/T
-
report
https://access.redhat.com/security/cve/CVE-2026-46149
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-46149
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46149
-
article
https://kernelcve.org/list/?q=CVE-2026-46149
-
article
https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46149-ad2e@gregkh/T
-
report
https://access.redhat.com/security/cve/CVE-2026-46189
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-46189
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46189
-
article
https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46189-c188@gregkh/T