Red Hat Security Advisory: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * RHEL9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:RHEL-166048) * [RHEL 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [rhel-9.8.z] (JIRA:RHEL-175699) * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:RHEL-175820) * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:RHEL-175823) * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:RHEL-178308) * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:RHEL-183317) * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:RHEL-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The advisories cover multiple security fixes in the Linux kernel packages for Red Hat Enterprise Linux 9 and 10. Key fixes include resolving use-after-free bugs in CAN ISOTP (CVE-2026-31474), MPTCP (CVE-2026-31669), and Bluetooth SSP passkey handlers (CVE-2026-46056); buffer overflow corrections in Bluetooth hci_sync (CVE-2026-31772) and Xen sys-hypervisor driver (CVE-2026-31786); double free fixes in Xen privcmd (CVE-2026-31787) and SCSI qla2xxx driver (CVE-2026-43414); and other memory safety improvements across networking, crypto, and WiFi subsystems. These vulnerabilities are addressed by updated kernel packages provided by Red Hat, which require rebooting the system to apply. The advisories include detailed bugzilla references and cover multiple architectures supported by Red Hat Enterprise Linux.
Potential Impact
The vulnerabilities fixed in these advisories affect the Linux kernel, the core of the operating system, and involve memory corruption issues such as use-after-free, buffer overflows, and double frees. Exploitation could lead to system crashes, denial of service, or potentially privilege escalation or code execution depending on the specific flaw. The advisories rate the impact as Important, indicating significant security concerns that warrant prompt patching. No known exploits in the wild have been reported at the time of the advisory.
Mitigation Recommendations
Red Hat has released official patches for these vulnerabilities in updated kernel packages for Red Hat Enterprise Linux 9 and 10. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. A system reboot is required for the kernel updates to take effect. There are no indications that additional mitigations beyond applying the official patches are necessary.
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * RHEL9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:RHEL-166048) * [RHEL 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [rhel-9.8.z] (JIRA:RHEL-175699) * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:RHEL-175820) * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:RHEL-175823) * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:RHEL-178308) * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:RHEL-183317) * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:RHEL-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisories cover multiple security fixes in the Linux kernel packages for Red Hat Enterprise Linux 9 and 10. Key fixes include resolving use-after-free bugs in CAN ISOTP (CVE-2026-31474), MPTCP (CVE-2026-31669), and Bluetooth SSP passkey handlers (CVE-2026-46056); buffer overflow corrections in Bluetooth hci_sync (CVE-2026-31772) and Xen sys-hypervisor driver (CVE-2026-31786); double free fixes in Xen privcmd (CVE-2026-31787) and SCSI qla2xxx driver (CVE-2026-43414); and other memory safety improvements across networking, crypto, and WiFi subsystems. These vulnerabilities are addressed by updated kernel packages provided by Red Hat, which require rebooting the system to apply. The advisories include detailed bugzilla references and cover multiple architectures supported by Red Hat Enterprise Linux.
Potential Impact
The vulnerabilities fixed in these advisories affect the Linux kernel, the core of the operating system, and involve memory corruption issues such as use-after-free, buffer overflows, and double frees. Exploitation could lead to system crashes, denial of service, or potentially privilege escalation or code execution depending on the specific flaw. The advisories rate the impact as Important, indicating significant security concerns that warrant prompt patching. No known exploits in the wild have been reported at the time of the advisory.
Mitigation Recommendations
Red Hat has released official patches for these vulnerabilities in updated kernel packages for Red Hat Enterprise Linux 9 and 10. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. A system reboot is required for the kernel updates to take effect. There are no indications that additional mitigations beyond applying the official patches are necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:27288
- Cve Count
- 15
- Additional Cves
- ["CVE-2026-31641","CVE-2026-31669","CVE-2026-31772","CVE-2026-31786","CVE-2026-31787","CVE-2026-43056","CVE-2026-43260","CVE-2026-43330","CVE-2026-46056","CVE-2026-46125","CVE-2026-46152","CVE-2026-46166","CVE-2026-46173","CVE-2026-46331"]
Threat ID: 6a3806dceed863c81e005290
Added to database: 06/21/2026, 15:44:28 UTC
Last enriched: 08/07/2026, 17:17:25 UTC
Last updated: 09/17/2026, 22:01:34 UTC
Views: 144
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.