Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 173

Vulnerabilities 29

• Critical 9.8
  CVE-2026-72221

  sunrpc: wait for in-flight TLS handshake callback when cancel loses race

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait_for_completion_interruptible_timeout() in svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-72222

  sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_serve…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• Critical 9.8
  CVE-2026-74586 Public exploit

  sctp: clear new_transport when removing a peer

  In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been proce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-74588

  sctp: keep chunk->transport in step with the list it is queued on

  In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• Critical 9.8
  CVE-2026-74752

  sctp: validate cookie AUTH state before use

  In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• Critical 9.8
  CVE-2026-80586

  mptcp: options: reset DSS fields in case of unexpected size

  In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• Critical 9.8
  CVE-2026-80981

  net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

  In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ...…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 11, 2026
• Critical 9.8
  CVE-2026-89479

  sctp: stop processing a packet once its association is deleted

  In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Critical 9.8
  CVE-2026-89633 Public exploit

  smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against bu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Critical 9.8
  CVE-2026-99153

  scsi: libiscsi: Validate the ITT reflected in a Reject PDU

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2026
• Critical 9.3
  CVE-2026-99999 Public exploit

  ipv4: validate checksum_start before completing checksum

  In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2026
• High 8.8
  CVE-2026-68140

  net/iucv: fix use-after-free of a severed iucv_path

  In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 8.8
  CVE-2026-80553

  s390/vfio_ccw: Cancel existing workqueues

  In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 8.4
  CVE-2026-80584

  s390/qeth: validate user buffer length in SNMP and ARP query ioctls

  In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2026
• High 7.8
  CVE-2026-68162

  sctp: avoid auth_enable sysctl UAF during netns teardown

  In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• High 7.8
  CVE-2026-68451

  s390/zcrypt: Validate length for CCA ECC private key requests

  In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 13, 2026
• High 7.8
  CVE-2026-68452

  s390/zcrypt: Validate length for CCA AES cipher key requests

  In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 13, 2026
• High 7.8
  CVE-2026-90207

  ALSA: seq: midi: Serialize input teardown with event_input

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 17, 2026
• High 7.8
  CVE-2026-98116

  ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

  In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 25, 2026
• High 7.8
  CVE-2026-98318

  smb: client: validate absolute native symlink targets before NT fixups

  In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 6, 2026
• High 7.8
  CVE-2026-98442

  net/sched: act_ct: fix helper UAF due to extensions realloc

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026
• High 7.8
  CVE-2026-99032

  net/smc: protect clcsock lifetime in smc_getname

  In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_cl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 23, 2026
• High 7.5
  CVE-2026-74385

  nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 15, 2026
• High 7.5
  CVE-2026-99152

  scsi: libiscsi: Validate the task named by a management response

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2026
• Medium 6.8
  CVE-2026-53196

  USB: serial: io_ti: fix heap overflow in get_manuf_info()

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2026
• Unscored —
  CVE-2026-80571

  powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer over…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 26, 2026
• Unscored —
  CVE-2026-80792

  ipv6: fix use-after-free in ip6_finish_output2()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-89956

  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

  In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026
• Unscored —
  CVE-2026-98741

  ALSA: ua101: reject mismatched capture/playback packet sizes

  In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513314
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2516837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521384
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2536701
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2541360
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2546374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2553429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2554848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2555081
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2559710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2562697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2562706
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99135.json
• report
  https://access.redhat.com/security/cve/CVE-2026-53196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53196
• article
  https://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53196-bcc6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68140
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68140
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68140
• article
  https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68140-f4e1@gregkh/T