Red Hat Security Advisory

RHSA-2026:15883

kernel security update

Released 2026-05-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.72.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.72.1.el10_0, kernel-64k-devel-6.12.0-55.72.1.el10_0 +12
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.72.1.el10_0, kernel-64k-6.12.0-55.72.1.el10_0, kernel-64k-core-6.12.0-55.72.1.el10_0 +28
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.72.1.el10_0, libperf-6.12.0-55.72.1.el10_0
Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.72.1.el10_0, kernel-rt-64k-6.12.0-55.72.1.el10_0, kernel-rt-64k-core-6.12.0-55.72.1.el10_0 +21
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.72.1.el10_0, kernel-rt-core-6.12.0-55.72.1.el10_0, kernel-rt-debug-6.12.0-55.72.1.el10_0 +11

Fixes 6 records

TI-2026-23961 CVE-2026-31402 · GHSA-7xf5-3qmr-j4c6

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

MEDIUM 51

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01219 Published 2026-04-03 Partial fix · 5.10.253, 5.15.210 +6 CWE-122

TI-2026-24090 CVE-2026-31532 · GHSA-7w6x-pfmg-76xx

can: raw: fix ro->uniq use-after-free in raw_rcv()

LOW 35

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is d…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00165 Published 2026-04-23 Fixed in 5.10.258, 5.15.209 +7 CWE-416

TI-2026-18680 CVE-2026-23243 · GHSA-85rq-57vx-88q2

RDMA/umad: Reject negative data_len in ib_umad_write

LOW 35

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0018 Published 2026-03-18 Partial fix · 5.10.252, 5.15.202 +6 CWE-190

TI-2026-18576 CVE-2026-23139 · GHSA-cf2j-m586-269w

netfilter: nf_conncount: update last_gc only when GC has been performed

LOW 33

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that m…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00383 Published 2026-02-14 Partial fix · 6.1.161, 6.6.121 +3

TI-2026-18836 CVE-2026-23401 · GHSA-2g4m-3wvw-crq2

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

LOW 24

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the e…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00191 Published 2026-04-01 Partial fix · 5.15.203, 6.1.168 +5

TI-2026-18534 CVE-2026-23097 · GHSA-3gqm-m375-7mp2

migrate: correct lock ordering for hugetlb file folios

LOW 24

In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then trie…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00107 Published 2026-02-04 Partial fix · 5.10, 5.10.249 +6 CWE-362