Red Hat Security Advisory: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The advisory provides security fixes for multiple Linux kernel vulnerabilities affecting Red Hat Enterprise Linux 9 and associated variants. These include CVE-2025-38653 (proc_lseek check), CVE-2025-68183 (IMA_DIGSIG flag handling), CVE-2025-68366 (nbd config unlock), CVE-2025-68724 (asymmetric_key_generate_id overflow), CVE-2025-71089 (iommu SVA disablement), and others addressing issues in netfilter, Bluetooth, HID, SMB client, wifi, xfs, and memory management. The fixes prevent issues such as use-after-free, buffer overflows, race conditions, invalid input acceptance, and improper memory clearing. The advisory applies to Red Hat Enterprise Linux 9 and related CodeReady Linux Builder and Extended Update Support versions. The system must be rebooted after applying the update for changes to take effect.
Potential Impact
The vulnerabilities collectively could allow attackers to cause memory corruption, race conditions, invalid input processing, and other kernel-level faults that may lead to denial of service, privilege escalation, or information disclosure. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.
Mitigation Recommendations
An official security update is available from Red Hat for affected Red Hat Enterprise Linux 9 products and related variants. Users should apply the kernel update provided in advisory RHSA-2026:21556 and reboot their systems to activate the fixes. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are specified beyond applying the official patch.
Red Hat Security Advisory: kernel security update
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory provides security fixes for multiple Linux kernel vulnerabilities affecting Red Hat Enterprise Linux 9 and associated variants. These include CVE-2025-38653 (proc_lseek check), CVE-2025-68183 (IMA_DIGSIG flag handling), CVE-2025-68366 (nbd config unlock), CVE-2025-68724 (asymmetric_key_generate_id overflow), CVE-2025-71089 (iommu SVA disablement), and others addressing issues in netfilter, Bluetooth, HID, SMB client, wifi, xfs, and memory management. The fixes prevent issues such as use-after-free, buffer overflows, race conditions, invalid input acceptance, and improper memory clearing. The advisory applies to Red Hat Enterprise Linux 9 and related CodeReady Linux Builder and Extended Update Support versions. The system must be rebooted after applying the update for changes to take effect.
Potential Impact
The vulnerabilities collectively could allow attackers to cause memory corruption, race conditions, invalid input processing, and other kernel-level faults that may lead to denial of service, privilege escalation, or information disclosure. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.
Mitigation Recommendations
An official security update is available from Red Hat for affected Red Hat Enterprise Linux 9 products and related variants. Users should apply the kernel update provided in advisory RHSA-2026:21556 and reboot their systems to activate the fixes. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are specified beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:21556
- Cve Count
- 19
- Additional Cves
- ["CVE-2025-68183","CVE-2025-68366","CVE-2025-68724","CVE-2025-71089","CVE-2026-23392","CVE-2026-23455","CVE-2026-31408","CVE-2026-31684","CVE-2026-31685","CVE-2026-31709","CVE-2026-43020","CVE-2026-43023","CVE-2026-43027","CVE-2026-43051","CVE-2026-43110","CVE-2026-43158","CVE-2026-43190","CVE-2026-43303"]
- Cvss Version
- null
Threat ID: 6a19fee3e29bf47b500feab9
Added to database: 05/29/2026, 21:02:27 UTC
Last enriched: 07/30/2026, 15:12:54 UTC
Last updated: 07/31/2026, 22:14:50 UTC
Views: 125
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.