Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 173

Vulnerabilities 39

• Critical 10.0
  CVE-2026-74705

  udp: fix potential use-after-free in tunnel segmentation

  In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-64035

  igc: set tx buffer type for SMD frames

  In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64162

  idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

  In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_setti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64268

  RDMA/siw: bound Read Response placement to the RREAD length

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->proce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• Critical 9.8
  CVE-2026-72083

  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-72319

  ipvs: ensure inner headers in ICMP errors are in headroom

  In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb_pull() we should ensure the inner IP headers in ICMP errors from …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.3
  CVE-2026-64018

  net: mana: validate rx_req_idx to prevent out-of-bounds array access

  In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-S…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.3
  CVE-2026-64034

  net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.3
  CVE-2026-72289

  KVM: arm64: vgic: Check the interrupt is still ours before migrating it

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.1
  CVE-2026-89631

  smb: client: reject a tree connect response whose byte count is too small

  In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Critical 9.1
  CVE-2026-90011

  scsi: target: iscsi: Reserve a terminator byte for the login payload

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.8
  CVE-2026-89777

  vfio/pci: clear vdev->msi_perm after freeing it on init failure

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KER…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.8
  CVE-2026-89811

  drm/amdkfd: Add TLB flush after MES queue eviction/suspension

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this au…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• High 8.4
  CVE-2026-80536

  xfs: bounds-check buffer log item's dirty bitmap

  In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.4
  CVE-2026-93827

  virtio-fs: avoid double-free on failed queue setup

  In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees bo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 8.2
  CVE-2026-80985

  net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

  In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 11, 2026
• High 8.2
  CVE-2026-98466

  KVM: arm64: Transfer the hyp stack pages out of the host stage-2

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026
• High 7.8
  CVE-2026-43332

  thermal: core: Fix thermal zone device registration error path

  In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2026
• High 7.8
  CVE-2026-53365 Public exploit

  vsock/virtio: fix zerocopy completion for multi-skb sends

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 13, 2026
• High 7.8
  CVE-2026-63970

  vsock/virtio: bind uarg before filling zerocopy skb

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() stil…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-64266

  fuse: re-lock request before returning from fuse_ref_folio()

  In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.8
  CVE-2026-64378

  writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

  In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ========================================…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 7.8
  CVE-2026-64481

  ALSA: hda/cs35l41: Fix firmware load work teardown

  In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2026
• High 7.8
  CVE-2026-68202

  ALSA: seq: close a re-opened queue timer in the destructor

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-68236

  drm/amd/display: set new_stream to NULL after release

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a l…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-68245

  drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• High 7.8
  CVE-2026-93817

  perf: Fix addr_filter_ranges lifetime

  In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 7.8
  CVE-2026-98260 Public exploit

  exec: Cleanup POSIX timers right after de_thread()

  In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 6, 2026
• High 7.8
  CVE-2026-98320

  netfilter: flowtable: hold reference on ct until flow is released

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 6, 2026
• High 7.5
  CVE-2026-68299

  vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

  In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.3
  CVE-2025-38004

  can: bcm: add locking for bcm_op runtime updates

  In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be chan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 8, 2025
• High 7.1
  CVE-2026-68293

  net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Medium 5.5
  CVE-2025-22063

  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

  In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• Unscored —
  CVE-2025-38147

  calipso: Don't call calipso functions for AF_INET sk.

  In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 3, 2025
• Unscored —
  CVE-2026-63899

  USB: serial: mxuport: fix memory corruption with small endpoint

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-63962

  usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() svdm_consume_modes() checks pmdata->altmodes against the array size once before the loop over the count, but forgo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Unscored —
  CVE-2026-68278

  drm/dp/mst: fix buffer overflows in sideband chunk accumulation

  In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length cur…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Unscored —
  CVE-2026-80887

  drm/vmwgfx: use check_add_overflow for shader size+offset bound

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-98725

  nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercoun…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2468043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492741
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492851
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499742
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502411
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502593
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507038
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507089
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507098
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507222
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507296
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513148
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513150
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513245
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516967
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524501