Red Hat Security Advisory

RHSA-2026:35844

kernel security update

Released 2026-07-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7 ELS) bpftool-3.10.0-1160.154.1.el7, kernel-3.10.0-1160.154.1.el7, kernel-abi-whitelists-3.10.0-1160.154.1.el7 +11
Red Hat Enterprise Linux Server Optional (v. 7 ELS) kernel-debug-devel-3.10.0-1160.154.1.el7, kernel-tools-libs-devel-3.10.0-1160.154.1.el7

Fixes 4 records

TI-2026-31304 CVE-2026-43125 · GHSA-fr2c-799q-pg3x

dlm: validate length in dlm_search_rsb_tree

MEDIUM 50

In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00538 Published 2026-05-06 Partial fix · 5.15.224, 6.1.191 +5 CWE-787

TI-2026-18890 CVE-2026-23455 · GHSA-gm78-p64f-gx97

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

MEDIUM 48

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, the…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01587 Published 2026-04-03 Partial fix · 5.10.253, 5.15.203 +6 CWE-125

TI-2026-33814 CVE-2026-46090 · GHSA-w9ff-9cjh-6463

ALSA: aloop: Fix peer runtime UAF during format-change stop

LOW 35

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00104 Published 2026-05-27 Partial fix · 5.10.259, 5.15.210 +6 CWE-416

TI-2026-33577 CVE-2026-45852 · GHSA-m5rc-6p5x-73gp

RDMA/rxe: Fix double free in rxe_srq_from_init

LOW 35

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ numbe…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00199 Published 2026-05-27 Partial fix · 4.20, 5.10.259 +7 CWE-415