Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 160

Vulnerabilities 32

• Critical 9.8
  CVE-2026-63994

  tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• Critical 9.8
  CVE-2026-68156

  libceph: refresh auth->authorizer_buf{,_len} after authorizer update

  In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• Critical 9.8
  CVE-2026-68159

  libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

  In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Critical 9.8
  CVE-2026-68476

  ipvs: reload ip header after head reallocation

  In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74569

  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74669

  ipvs: clear IPv4 options after rebasing tunnel ICMP errors

  In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-80714

  ipvs: do not propagate one-packet flag to synced conns

  In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 28, 2026
• Critical 9.8
  CVE-2026-89972

  nvme: add missing SRCU grace period in error path

  In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• Critical 9.1
  CVE-2026-63992

  tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

  In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 8.8
  CVE-2026-53374

  drm/amdgpu: zero-initialize GART table on allocation

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 8.8
  CVE-2026-63829

  net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 8.8
  CVE-2026-68432

  vxlan: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 12, 2026
• High 8.8
  CVE-2026-72052

  net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

  In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 8.1
  CVE-2026-53254

  Bluetooth: RFCOMM: validate skb length in MCC handlers

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can sen…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 8.1
  CVE-2026-63889

  scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

  In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-43206

  drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Alpine
  May 6, 2026
• High 7.8
  CVE-2026-45878

  drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-46259

  procfs: fix missing RCU protection when reading real_parent in do_task_stat()

  In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 3, 2026
• High 7.8
  CVE-2026-52912

  netfilter: nf_queue: hold bridge skb->dev while queued

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 24, 2026
• High 7.8
  CVE-2026-53356

  drm/i915/gem: Fix phys BO pread/pwrite with offset

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be access…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 1, 2026
• High 7.8
  CVE-2026-63879

  drm/amdgpu: fix amdgpu_hmm_range_get_pages

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2026
• High 7.8
  CVE-2026-63884

  drm/i915: Fix potential UAF in TTM object purge

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-72255

  netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.8
  CVE-2026-90227

  nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

  In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 17, 2026
• High 7.5
  CVE-2026-68155

  libceph: Reject monmaps advertising zero monitors

  In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.5
  CVE-2026-68157

  libceph: guard missing CRUSH type name lookup

  In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_imme…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.5
  CVE-2026-89481

  nvme-tcp: fix host memory disclosure on R2T for a read command

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• High 7.5
  CVE-2026-97417

  netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 24, 2026
• High 7.0
  CVE-2026-53143

  drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026
• High 7.0
  CVE-2026-53329

  drm/amd/display: Use krealloc_array() in dal_vector_reserve()

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, whic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 1, 2026
• High 7.0
  CVE-2026-64219

  drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 24, 2026
• Unscored —
  CVE-2026-53136

  drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492768
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2495941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2495950
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502188
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502321
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506790
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513165
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2514441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516251
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521375
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2525436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2536346
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2540479
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98239.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43206
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43206
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43206
• article
  https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-45878