Skip to content
OpenAdvisories
High RLSA-2026:45114 6 CVEs

Important: kernel security update

Published Jul 27, 2026 · Updated Jul 27, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237)
* kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
* kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
* kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
* kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 kernel 0:6.12.0-211.39.1.el10_2

Vulnerabilities 6

  • High 8.1
    CVE-2026-46099

    net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

    In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-52973

    futex: Drop CLONE_THREAD requirement for private default hash alloc

    In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.3
    CVE-2026-53059

    dm log: fix out-of-bounds write due to region_count overflow

    In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40237

    fs/notify: call exportfs_encode_fid with s_umount

    In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-23110

    scsi: core: Wake up the error handler when final completions race against each other

    In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31692

    rtnetlink: add missing netlink_ns_capable() check for peer netns

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436755
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492277
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492413
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418829
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464093