Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 91

Vulnerabilities 8

• Critical 9.8
  CVE-2026-64534

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• Critical 9.8
  CVE-2026-74556

  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-98432 Public exploit

  ipv4: free inet_opt and ireq_opt after an RCU grace period

  In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2026
• High 8.8
  CVE-2026-63974

  Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoid…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 7.8
  CVE-2025-71066

  net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue`…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 13, 2026
• High 7.5
  CVE-2026-89481

  nvme-tcp: fix host memory disclosure on R2T for a read command

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Unscored —
  CVE-2025-39797

  xfrm: Duplicate SPI Handling

  In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expecte…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 12, 2025
• Unscored —
  CVE-2026-99284

  net: skbuff: propagate shared-frag marker in skb_zerocopy()

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400057
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429036
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2559835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94508.json
• report
  https://access.redhat.com/security/cve/CVE-2025-39797
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39797
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39797
• article
  https://lore.kernel.org/linux-cve-announce/2025091224-CVE-2025-39797-b0f7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-71066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-71066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-71066
• article
  https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71066-f1fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63974
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63974
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63974
• article
  https://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63974-2863@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-64534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-64534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-64534
• article
  https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-74556
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-74556
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-74556
• article
  https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74556-3eb4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-89481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-89481
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-89481
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-98432
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-016
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-98432
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-98432
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox