RHSA-2026:25095HighCVSS 7.3

Red Hat Security Advisory: kernel security update

Published
June 10, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (4)

CVE-2026-31532 →CVE-2026-31607 →CVE-2026-31685 →CVE-2026-43163 →

📋 Description

CVE-2026-31532 — kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() CVE-2026-31607 — kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() CVE-2026-31685 — kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets CVE-2026-43163 — kernel: md/bitmap: fix GPF in write_page caused by resize race

🎯 Affected products95

  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bpftool-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-0:3.10.0-1160.151.1.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-0:3.10.0-1160.151.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bpftool-debuginfo-0:3.10.0-1160.151.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • kernel-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-0:3.10.0-1160.151.1.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-0:3.10.0-1160.151.1.el7.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-0:3.10.0-1160.151.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-abi-whitelists-0:3.10.0-1160.151.1.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-bootwrapper-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-bootwrapper-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-0:3.10.0-1160.151.1.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-0:3.10.0-1160.151.1.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-debuginfo-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-debuginfo-0:3.10.0-1160.151.1.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • kernel-debug-debuginfo-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • kernel-debug-debuginfo-0:3.10.0-1160.151.1.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • kernel-debug-debuginfo-0:3.10.0-1160.151.1.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • +65 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue, prevent the `can` kernel module from loading if CAN functionality is not required. This can be achieved by blacklisting the module. Create a file named `/etc/modprobe.d/blacklist-can.conf` with the following content: ``` blacklist can install can /bin/true ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. ```bash dracut -f -v reboot ``` This mitigation may impact systems that rely on CAN interfaces for their operation. Workaround: To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content: ``` blacklist usbip ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP.

🔗 References (7)