Red Hat Security Advisory

RHSA-2026:36541

kernel security, bug fix, and enhancement update

Released 2026-07-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.31.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.31.1.el10_2, kernel-64k-devel-6.12.0-211.31.1.el10_2 +12
Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.31.1.el10_2, kernel-64k-6.12.0-211.31.1.el10_2, kernel-64k-core-6.12.0-211.31.1.el10_2 +29
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.31.1.el10_2, libperf-6.12.0-211.31.1.el10_2
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.31.1.el10_2, kernel-rt-64k-6.12.0-211.31.1.el10_2, kernel-rt-64k-core-6.12.0-211.31.1.el10_2 +21
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.31.1.el10_2, kernel-rt-core-6.12.0-211.31.1.el10_2, kernel-rt-debug-6.12.0-211.31.1.el10_2 +9

Fixes 6 records

TI-2026-31520 CVE-2026-43341 · GHSA-p877-m7m5-3qh3

net/ipv6: ioam6: prevent schema length wraparound in trace fill

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00512 Published 2026-05-08 Fixed in 5.15.210, 6.1.168 +5 CWE-190

TI-2026-33879 CVE-2026-46155 · GHSA-r5mc-mc43-5gch

smb/client: fix out-of-bounds read in smb2_compound_op()

MEDIUM 46

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA li…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00478 Published 2026-05-28 Fixed in 6.6.140, 6.12.88 +3 CWE-125

TI-2026-33963 CVE-2026-46242 · GHSA-h4r8-4j67-99mx

eventpoll: fix ep_remove struct eventpoll / struct file UAF

MEDIUM 43

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.04576 Published 2026-05-30 Partial fix · 5.15.222, 6.1.178 +5 CWE-416

TI-2026-31254 CVE-2026-43074 · GHSA-4j6h-qqh4-vpw7

eventpoll: defer struct eventpoll free to RCU grace period

LOW 37

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00482 Published 2026-05-06 Fixed in 6.6.136, 6.12.83 +3 CWE-416

TI-2026-33980 CVE-2026-46259 · GHSA-vg6r-r7wf-v3q2

procfs: fix missing RCU protection when reading real_parent in do_task_stat()

LOW 35

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent w…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00121 Published 2026-06-03 Partial fix · 5.10.252, 5.15.202 +6 CWE-416

TI-2026-31455 CVE-2026-43276 · GHSA-hv6m-q2m2-vxvr

net: mana: Fix double destroy_workqueue on service rescan PCI path

LOW 33

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the ser…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00118 Published 2026-05-06 Fixed in 6.18.16, 6.19.6 +1 CWE-415