The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
* kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
* kernel: Linux kernel: xfrm single-frag length not properly limited ()
* kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
* kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
* kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()
Bug Fix(es) and Enhancement(s):
* [RHEL9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-9.8.z] (JIRA:RHEL-183980)
* [RHEL-9.8.z]: mlx5: include bug fixes (JIRA:RHEL-188121)
* dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-9.8.z] (JIRA:RHEL-212061)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This advisory addresses security vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 8. Two security issues are fixed: a user-triggerable WARN_ON() in the RDMA mana driver (CVE-2026-46117) and a missing channel lock in the Bluetooth l2cap component (CVE-2026-53071). The update also resolves a kernel deadlock issue related to lock order. The update is rated as important by Red Hat Product Security and requires a system reboot to take effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398)
* kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125)
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
Bug Fix(es) and Enhancement(s):
* Kernel panic while shutting down ice driver due to use-after-free [rhel-9.4.z] (JIRA:RHEL-177523)
* crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-9.4.z] (JIRA:RHEL-182538)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
* kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the NVIDIA for RHEL 10 Release Notes linked from the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A critical security advisory from Red Hat addresses multiple vulnerabilities in the kernel packages for Red Hat Enterprise Linux for NVIDIA on ARM 64 architecture. The update includes fixes for several kernel vulnerabilities, including local privilege escalation issues and other kernel security bugs. The advisory references multiple CVEs and requires a system reboot after applying the update. Public exploit code is available via Metasploit for at least one of the vulnerabilities. The update is critical and affects Red Hat Enterprise Linux for NVIDIA ARM 64 version 10.
A vulnerability in the Linux kernel futex subsystem related to the CLONE_THREAD requirement for private default hash allocation has been resolved. The issue involved incorrect assumptions about concurrency when sharing memory mappings (mm) in ways other than pthread semantics, leading to use-after-free bugs. This could cause kernel memory corruption and crashes. The vulnerability has been addressed by loosening the check to cover any CLONE_VM clone except vfork, preventing the race conditions. Red Hat has released security updates for Red Hat Enterprise Linux 9 and 10 to fix this issue. The updates require system reboot to take effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.20. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:25185
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/
Security Fix(es):
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)
* kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)
* kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238)
* kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
* kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: nouveau: fix instmem race condition around ptr stores (CVE-2024-26984)
* kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)
* kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)
* kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: arm64: Tear down vGIC on failed vCPU creation (CVE-2025-37849)
* kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141)
* kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init (CVE-2025-38248)
* kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096)
* kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)
* kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.