Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 19

• Critical 9.8
  CVE-2026-53228

  ipv6: sit: reload inner IPv6 header after GSO offloads

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• Critical 9.8
  CVE-2026-64303

  spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

  In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX cha…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-72083

  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-80586

  mptcp: options: reset DSS fields in case of unexpected size

  In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• Critical 9.8
  CVE-2026-98432 Public exploit

  ipv4: free inet_opt and ireq_opt after an RCU grace period

  In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2026
• Critical 9.1
  CVE-2026-90011

  scsi: target: iscsi: Reserve a terminator byte for the login payload

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.4
  CVE-2026-89603 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Sep 11, 2026
• High 8.4
  CVE-2026-93827

  virtio-fs: avoid double-free on failed queue setup

  In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees bo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 8.2
  CVE-2026-98466

  KVM: arm64: Transfer the hyp stack pages out of the host stage-2

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026
• High 8.1
  CVE-2026-93787

  smb: client: bound dirent name against end of SMB response in cifs_filldir

  In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namele…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 7.8
  CVE-2026-53270

  ipvs: clear the svc scheduler ptr early on edit

  In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.8
  CVE-2026-74283

  tipc: require net admin for TIPCv2 netlink mutators

  In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an oper…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.8
  CVE-2026-74510

  Bluetooth: mgmt: fix UAF in pair command cancellation

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• High 7.8
  CVE-2026-74582

  packet: use consistent hard_header_len in non-ring send paths

  In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 21, 2026
• High 7.8
  CVE-2026-98364

  xfrm: hold net_device reference under RCU in bundle creation

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pas…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 6, 2026
• High 7.5
  CVE-2026-52929

  sctp: stream: fully roll back denied add-stream state

  In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• Unscored —
  CVE-2026-68169

  mptcp: pm: userspace: fix use-after-free in get_local_id

  In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A con…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Unscored —
  CVE-2026-98725

  nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercoun…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026
• Unscored —
  CVE-2026-99284

  net: skbuff: propagate shared-frag marker in skb_zerocopy()

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492733
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532493
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535227
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540555
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2546487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2554835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2555068
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2559835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93412.json
• report
  https://access.redhat.com/security/cve/CVE-2026-52929
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52929
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52929
• article
  https://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52929-63ee@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53228
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53228
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53228
• article
  https://kernelcve.org/list/?q=CVE-2026-53228
• article
  https://lore.kernel.org/linux-cve-announce/2026062507-CVE-2026-53228-f3f1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53270
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53270
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53270
• article
  https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53270-0981@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64303
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64303
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64303
• article
  https://lore.kernel.org/linux-cve-announce/2026072507-CVE-2026-64303-7a2d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68169