Skip to content
OpenAdvisories
High RLSA-2026:30129 8 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jun 27, 2026 · Updated Jun 27, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)

* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

* kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

* kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

* kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

* Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:Rocky Linux-185117)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 kernel 0:6.12.0-211.28.1.el10_2

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-43038

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43198

    tcp: fix potential race in tcp_v6_syn_recv_sock()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43414

    scsi: qla2xxx: Completely fix fcport double free

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-45898

    RDMA/iwcm: Fix workqueue list corruption by removing work_list

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_wo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-46135

    nvmet-tcp: fix race between ICReq handling and queue teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-31636

    rxrpc: fix RESPONSE authenticator parser OOB read

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46117

    RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46145

    RDMA/mana: Validate rx_hash_key_len

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468155
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482031
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482576
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464397
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482581
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461510