Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 124

Vulnerabilities 11

• Critical 9.8
  CVE-2026-53246

  sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

  In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is pars…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• Critical 9.8
  CVE-2026-74556

  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-98432 Public exploit

  ipv4: free inet_opt and ireq_opt after an RCU grace period

  In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2026
• Critical 9.1
  CVE-2026-53224

  sctp: validate embedded INIT chunk and address list lengths in cookie

  In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 8.1
  CVE-2026-43051

  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

  In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2026
• High 7.8
  CVE-2025-71066

  net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue`…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 13, 2026
• High 7.8
  CVE-2026-63875

  arm64: tlb: Flush walk cache when unsharing PMD tables

  In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-90227

  nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

  In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 17, 2026
• Unscored —
  CVE-2026-46086

  net: bridge: use a stable FDB dst snapshot in RCU readers

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keepin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• Unscored —
  CVE-2026-53073

  Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and se…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• Unscored —
  CVE-2026-99284

  net: skbuff: propagate shared-frag marker in skb_zerocopy()

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429036
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2481989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492447
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492769
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2536346
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2559835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94109.json
• report
  https://access.redhat.com/security/cve/CVE-2025-71066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71066
• article
  https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71066-f1fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-43051
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43051
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43051
• article
  https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43051-0d15@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-46086
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46086
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46086
• article
  https://kernelcve.org/list/?q=CVE-2026-46086
• article
  https://lore.kernel.org/linux-cve-announce/2026052701-CVE-2026-46086-d3c8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53073
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53073
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53073
• article
  https://lore.kernel.org/linux-cve-announce/2026062405-CVE-2026-53073-9692@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53224
• article
  https://lore.kernel.org/linux-cve-announce/2026062506-CVE-2026-53224-4b04@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53246
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53246
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53246
• article
  https://lore.kernel.org/linux-cve-announce/2026062512-CVE-2026-53246-e748@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63875