Red Hat Security AdvisoryRHSA-2026:2766
kernel security update
Released 2026-02-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.111.1.el9_4, libperf-5.14.0-427.111.1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.111.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.111.1.el9_4, kernel-64k-devel-5.14.0-427.111.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.111.1.el9_4, kernel-5.14.0-427.111.1.el9_4, kernel-64k-5.14.0-427.111.1.el9_4 +29
- Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.111.1.el9_4, kernel-rt-core-5.14.0-427.111.1.el9_4, kernel-rt-debug-5.14.0-427.111.1.el9_4 +9
- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.111.1.el9_4, kernel-rt-core-5.14.0-427.111.1.el9_4, kernel-rt-debug-5.14.0-427.111.1.el9_4 +11
Fixes 9 records
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.
CVSS 3.1CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.00347 · Published 2025-10-04 · Partial fix · 6.1.191, 6.6.160 +3
Priority LOW 36
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHC…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00301 · Published 2025-05-09 · Partial fix · 6.12.26, 6.14.5 +1 CWE-416
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00488 · Published 2025-12-06 · Partial fix · 5.4.302, 5.10.247 +6
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were ac…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00173 · Published 2025-09-04 · Partial fix · 6.6.103, 6.12.44 +3 CWE-787
Priority LOW 34
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00712 · Published 2025-12-24 · Partial fix · 5.10.248, 5.15.198 +6
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering te…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00144 · Published 2025-12-08 · Partial fix · 5.4.302, 5.10.247 +6
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and e…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0019 · Published 2025-12-06 · Partial fix · 4.4.230, 4.9.230 +11
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00225 · Published 2025-07-25 · Partial fix · 5.4.295, 5.10.239 +6 CWE-787
Priority LOW 30
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00179 · Published 2025-09-11 · Partial fix · 5.10.241, 5.15.190 +6 CWE-125
THREATIST.IORead the docs