Red Hat Security AdvisoryRHSA-2026:27713
kernel security, bug fix, and enhancement update
Released 2026-06-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.134.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.134.1.el9_4, kernel-64k-devel-5.14.0-427.134.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.134.1.el9_4, kernel-5.14.0-427.134.1.el9_4, kernel-64k-5.14.0-427.134.1.el9_4 +29
- Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.134.1.el9_4, kernel-rt-core-5.14.0-427.134.1.el9_4, kernel-rt-debug-5.14.0-427.134.1.el9_4 +9
- Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.134.1.el9_4, kernel-rt-core-5.14.0-427.134.1.el9_4, kernel-rt-debug-5.14.0-427.134.1.el9_4 +11
Fixes 8 records
Priority HIGH 69
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key l…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00639 · Published 2026-06-16 · Fixed in 5.10.260, 5.15.211 +9 CWE-190
Priority MEDIUM 50
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segmen…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-05-21 · Partial fix · 5.10.258, 5.15.209 +6 CWE-787
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket me…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00471 · Published 2026-04-24 · Partial fix · 5.15.203, 6.1.169 +5 CWE-416
Priority MEDIUM 48
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, the…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01587 · Published 2026-04-03 · Partial fix · 5.10.253, 5.15.203 +6 CWE-125
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00132 · Published 2026-05-28 · Partial fix · 6.1.175, 6.6.140 +4 CWE-416
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ numbe…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00199 · Published 2026-05-27 · Partial fix · 4.20, 5.10.259 +7 CWE-415
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangl…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00178 · Published 2026-05-08 · Partial fix · 5.15.203, 6.1.168 +5 CWE-122
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00139 · Published 2026-05-06 · Partial fix · 6.1.165, 6.6.128 +4 CWE-415
THREATIST.IORead the docs