Red Hat Security Advisory: kernel security update

Fixed packages 124

Vulnerabilities 22

• Critical 9.8
  CVE-2026-63994

  tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-64534

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• Critical 9.8
  CVE-2026-68156

  libceph: refresh auth->authorizer_buf{,_len} after authorizer update

  In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Critical 9.8
  CVE-2026-68159

  libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

  In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-68476

  ipvs: reload ip header after head reallocation

  In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74569

  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74669

  ipvs: clear IPv4 options after rebasing tunnel ICMP errors

  In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-80714

  ipvs: do not propagate one-packet flag to synced conns

  In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 28, 2026
• Critical 9.1
  CVE-2026-63992

  tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.1
  CVE-2026-64320

  nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2026
• High 8.8
  CVE-2026-63829

  net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 8.8
  CVE-2026-68432

  vxlan: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 12, 2026
• High 8.8
  CVE-2026-72052

  net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.2
  CVE-2026-63913

  netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.1
  CVE-2026-53254

  Bluetooth: RFCOMM: validate skb length in MCC handlers

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can sen…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 8.1
  CVE-2026-63889

  scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

  In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-52912

  netfilter: nf_queue: hold bridge skb->dev while queued

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-72255

  netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.5
  CVE-2026-68155

  libceph: Reject monmaps advertising zero monitors

  In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.5
  CVE-2026-68157

  libceph: guard missing CRUSH type name lookup

  In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_imme…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.5
  CVE-2026-89481

  nvme-tcp: fix host memory disclosure on R2T for a read command

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• High 7.5
  CVE-2026-97417

  netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507061
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513165
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516251
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521375
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540479
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98047.json
• report
  https://access.redhat.com/security/cve/CVE-2026-52912
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52912
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52912
• article
  https://lore.kernel.org/linux-cve-announce/2026062426-CVE-2026-52912-9506@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53254
• article
  https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53254-82af@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63829
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63829
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63829
• article
  https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63829-ff2a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-63889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-63889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-63889