Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 158

Vulnerabilities 14

• Critical 9.8
  CVE-2026-99153

  scsi: libiscsi: Validate the ITT reflected in a Reject PDU

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2026
• High 8.8
  CVE-2026-53075 Public exploit

  ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

  In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 8.4
  CVE-2026-74631

  net: smc: fix splice entry lifetime imbalance in smc_rx_splice

  In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 22, 2026
• High 7.8
  CVE-2026-68398 Public exploit

  ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

  In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-90207

  ALSA: seq: midi: Serialize input teardown with event_input

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 17, 2026
• High 7.8
  CVE-2026-98116

  ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

  In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 25, 2026
• High 7.8
  CVE-2026-98318

  smb: client: validate absolute native symlink targets before NT fixups

  In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 6, 2026
• High 7.5
  CVE-2026-52945

  Revert "wireguard: device: enable threaded NAPI"

  In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.5
  CVE-2026-99152

  scsi: libiscsi: Validate the task named by a management response

  In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2026
• Unscored —
  CVE-2026-80842

  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80863

  RDMA/rxe: Fix OOB in free_rd_atomic_resources()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80864

  RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2026
• Unscored —
  CVE-2026-80951

  i3c: master: svc: bound IBI payload to the requested max_payload_len

  In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2026
• Unscored —
  CVE-2026-89956

  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

  In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492373
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2513188
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2521413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528665
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532522
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2535200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2536701
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2541360
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2546374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2562697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2562706
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99148.json
• report
  https://access.redhat.com/security/cve/CVE-2026-52945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-52945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-52945
• article
  https://lore.kernel.org/linux-cve-announce/2026062400-CVE-2026-52945-5ce8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-53075
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53075
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53075
• article
  https://kernelcve.org/list/?q=CVE-2026-53075
• article
  https://lore.kernel.org/linux-cve-announce/2026062405-CVE-2026-53075-9f2a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-68398
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68398
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68398
• article
  https://lore.kernel.org/linux-cve-announce/2026081048-CVE-2026-68398-ca73@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-74631
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-74631
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-74631
• article
  https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-80842
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-80842
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-80842
• article
  https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80842.mbox
• report
  https://access.redhat.com/security/cve/CVE-2026-80863
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-80863