Read the docs
Red Hat Security Advisory

RHSA-2026:0453

kernel security update

Released 2026-01-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 9 records

TI-2025-26846 CVE-2025-40176 · GHSA-79rw-jwgh-qv55

tls: wait for pending async decryptions if tls_strp_msg_hold fails

Priority MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold r…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00487 Published 2025-11-12 Fixed in 6.1.158, 6.6.114 +3
TI-2025-26480 CVE-2025-39806 · GHSA-r5jq-cwp5-xxhf

HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

Priority LOW 38

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00238 Published 2025-09-16 Partial fix · 5.15.191, 6.1.150 +5 CWE-125
TI-2025-26947 CVE-2025-40277 · GHSA-6jjc-g279-fq4c

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

Priority LOW 34

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations whi…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00254 Published 2025-12-06 Partial fix · 5.4.302, 5.10.247 +6
TI-2025-26910 CVE-2025-40240 · GHSA-p7wh-phc3-g7xr

sctp: avoid NULL dereference when chunk data buffer is missing

Priority LOW 34

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2025-12-04 Partial fix · 5.4.301, 5.10.246 +6
TI-2025-26638 CVE-2025-39966 · GHSA-jrgc-8xmv-4r2m

iommufd: Fix race during abort for file descriptors

Priority LOW 33

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work que…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00114 Published 2025-10-15 Partial fix · 6.12.50, 6.16.10 +1 CWE-362
TI-2025-26577 CVE-2025-39905 · GHSA-3w4m-c8rq-62jj

net: phylink: add lock for serializing concurrent pl->phydev writes with resolver

Priority LOW 32

In the Linux kernel, the following vulnerability has been resolved: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00111 Published 2025-10-01 Partial fix · 6.16.8, 6.17 CWE-362
TI-2025-26514 CVE-2025-39840 · GHSA-cwjm-393v-32x2

audit: fix out-of-bounds read in audit_compare_dname_path()

Priority LOW 30

In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directl…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00154 Published 2025-09-19 Fixed in 6.16.6, 6.17 CWE-125
TI-2025-26517 CVE-2025-39843 · GHSA-fwr4-vx34-qhjp

mm: slub: avoid wake up kswapd in set_track_prepare

Priority LOW 24

In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00117 Published 2025-09-19 Partial fix · 6.1.151, 6.6.105 +3 CWE-667