RHSA-2026:19568HighCVSS 8.1

Red Hat Security Advisory: kernel security update

Published
May 20, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (18)

CVE-2026-43163 →CVE-2025-71116 →CVE-2026-22990 →CVE-2026-23204 →CVE-2026-46333 →CVE-2026-31402 →CVE-2026-31607 →CVE-2026-46300 →CVE-2025-39766 →CVE-2025-68741 →CVE-2026-23136 →CVE-2026-23401 →CVE-2026-43128 →CVE-2026-22984 →CVE-2026-23270 →CVE-2026-31532 →CVE-2026-43284 →CVE-2026-43503 →

📋 Description

CVE-2025-39766 — kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit CVE-2025-68741 — kernel: scsi: qla2xxx: Fix improper freeing of purex item CVE-2025-71116 — kernel: libceph: make decode_pool() more resilient against corrupted osdmaps CVE-2026-22984 — kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() CVE-2026-22990 — kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() CVE-2026-23136 — kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state CVE-2026-23204 — kernel: net/sched: cls_u32: use skb_header_pointer_careful() CVE-2026-23270 — kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation CVE-2026-23401 — kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling CVE-2026-31402 — kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache CVE-2026-31532 — kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() CVE-2026-31607 — kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() CVE-2026-43128 — kernel: RDMA/umem: Fix double dma_buf_unpin in failure path CVE-2026-43163 — kernel: md/bitmap: fix GPF in write_page caused by resize race CVE-2026-43284 — kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel CVE-2026-43503 — kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers CVE-2026-46300 — kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel CVE-2026-46333 — kernel: Read root-owned files as an unprivileged user

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.10.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.10.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.10.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.10.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.10.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue and if Ceph not being used, then prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent the `can` kernel module from loading if CAN functionality is not required. This can be achieved by blacklisting the module. Create a file named `/etc/modprobe.d/blacklist-can.conf` with the following content: ``` blacklist can install can /bin/true ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. ```bash dracut -f -v reboot ``` This mitigation may impact systems that rely on CAN interfaces for their operation. Workaround: To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content: ``` blacklist usbip ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (20)