Red Hat Security Advisory: kernel security update

Fixed packages 49

Vulnerabilities 7

• Critical 9.8
  CVE-2026-63922

  ipv6: exthdrs: refresh nh after handling HAO option

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-63924

  ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-53062

  dm cache policy smq: fix missing locks in invalidating cache blocks

  In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-63802

  blk-cgroup: fix UAF in __blkcg_rstat_flush()

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.1
  CVE-2026-46149

  scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 28, 2026
• High 7.1
  CVE-2026-63920

  ipv6: validate extension header length before copying to cmsg

  In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-43450

  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helpe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468228
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502251
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502330
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84793.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43450
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43450
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43450
• article
  https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43450-8919@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46149
• article
  https://kernelcve.org/list/?q=CVE-2026-46149
• article
  https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46149-ad2e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53062
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53062
• article
  https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-53062-a727@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63802
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63802
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63802
• article
  https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63802-1c53@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63920
• article
  https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63920-54a7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63922
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63922
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63922
• article
  https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63922-5716@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63924
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63924
• article
  https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63924-ec60@gregkh/T