The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-14684 is a medium severity vulnerability in HdrHistogram versions 2.2.0, 2.2.1, and 2.2.2. It involves uncontrolled memory allocation in the decodeFromByteBuffer function due to manipulation of the numberOfSignificantValueDigits argument. The attack requires local access and no user interaction. The existence of the vulnerability is disputed because it may not cross security boundaries and has specific prerequisites. No official patch or fix is currently documented.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: kernel: ipv6 frag escape ()
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the NVIDIA for RHEL 10 Release Notes linked from the References section.
Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
* kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Satellite 6.16.10 for RHEL 8 and 9 addresses multiple security vulnerabilities including privilege escalation, information disclosure, unauthorized modification of host configurations, and cross-tenant private SSH key disclosure. These issues stem from broken access controls, improper validation of nested request parameters, and taxonomy scoping bypasses in Foreman components. The update is rated as Important by Red Hat Product Security and fixes these vulnerabilities to prevent unauthorized administrative access and data leaks.
Two moderate severity vulnerabilities were identified in the Apache HTTP Server mod_http2 module used in Red Hat Enterprise Linux 9 and 10. CVE-2026-48913 is a use-after-free vulnerability that could allow arbitrary code execution or denial of service. CVE-2026-43951 is an out-of-bounds read vulnerability in mod_headers and mod_mime. Red Hat has released patches addressing these issues in updated mod_http2 packages for affected RHEL versions.
A memory corruption vulnerability exists in the PHP OpenSSL extension's AES-WRAP-PAD algorithm implementation in versions prior to 8.2.32, 8.3.32, 8.4.23, and 8.5.8. The issue is due to incorrect buffer allocation that does not consider RFC 5649 expansion, which can lead to heap corruption and application aborts. Red Hat has released updates for Red Hat Hardened Images RPMs to address this flaw.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
* kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
* kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
* kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
Bug Fix(es) and Enhancement(s):
* [rhel-9] WARNING: possible recursive locking detected - vmd_enable_domain+0x757/0x910 (JIRA:RHEL-174467)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)
Bug Fix(es) and Enhancement(s):
* CLONE - [RHEL 10.2 Bug] qla2xxx flash image validation failure [rhel-10.2.z] (JIRA:RHEL-181887)
* tegra-se fixes and updates [rhel-10.2.z] (JIRA:RHEL-182759)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.