Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 8

• High 8.4
  CVE-2026-80536

  xfs: bounds-check buffer log item's dirty bitmap

  In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 7.8
  CVE-2026-64481

  ALSA: hda/cs35l41: Fix firmware load work teardown

  In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2026
• High 7.8
  CVE-2026-68202

  ALSA: seq: close a re-opened queue timer in the destructor

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.5
  CVE-2026-68299

  vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

  In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.1
  CVE-2026-80530

  xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 26, 2026
• Medium 5.5
  CVE-2025-22063

  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

  In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• Unscored —
  CVE-2025-38147

  calipso: Don't call calipso functions for AF_INET sk.

  In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 3, 2025
• Unscored —
  CVE-2026-68448

  ovl: check access to copy_file_range source with src mounter creds

  In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507038
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513245
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524501
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87805.json
• report
  https://access.redhat.com/security/cve/CVE-2025-22063
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22063
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22063
• article
  https://lore.kernel.org/linux-cve-announce/2025041607-CVE-2025-22063-dec0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38147
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38147
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38147
• article
  https://lore.kernel.org/linux-cve-announce/2025070335-CVE-2025-38147-52a6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64481
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64481
• article
  https://kernelcve.org/list/?q=CVE-2026-64481
• article
  https://lore.kernel.org/linux-cve-announce/2026072548-CVE-2026-64481-d8df@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68202
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68202
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68202
• article
  https://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68202-e7fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68299
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68299
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68299
• article
  https://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68299-d85c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68448
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68448
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68448
• article
  https://kernelcve.org/list/?q=CVE-2026-68448
• article
  https://lore.kernel.org/linux-cve-announce/2026081224-CVE-2026-68448-5739@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-80530
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-80530
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-80530