Red Hat Security Advisory

RHSA-2026:37729

kernel security update

Released 2026-07-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.137.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.137.1.el9_4, kernel-64k-devel-5.14.0-427.137.1.el9_4 +11
Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.137.1.el9_4, kernel-5.14.0-427.137.1.el9_4, kernel-64k-5.14.0-427.137.1.el9_4 +29
Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.137.1.el9_4, kernel-rt-core-5.14.0-427.137.1.el9_4, kernel-rt-debug-5.14.0-427.137.1.el9_4 +9
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.137.1.el9_4, kernel-rt-core-5.14.0-427.137.1.el9_4, kernel-rt-debug-5.14.0-427.137.1.el9_4 +11

Fixes 4 records

TI-2026-38445 CVE-2026-53359 · GHSA-wpw8-53h7-xqcq

KVM: x86: Fix shadow paging use-after-free due to unexpected role

HIGH 73

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GF…

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.01368 Published 2026-07-04 Partial fix · 5.15.222, 6.1.177 +5 CWE-416

TI-2026-33963 CVE-2026-46242 · GHSA-h4r8-4j67-99mx

eventpoll: fix ep_remove struct eventpoll / struct file UAF

MEDIUM 43

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.04576 Published 2026-05-30 Partial fix · 5.15.222, 6.1.178 +5 CWE-416

TI-2026-33837 CVE-2026-46113 · GHSA-gcf3-9g28-gv44

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

LOW 39

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00195 Published 2026-05-28 Partial fix · 5.15.222, 6.1.175 +5 CWE-416

TI-2026-31254 CVE-2026-43074 · GHSA-4j6h-qqh4-vpw7

eventpoll: defer struct eventpoll free to RCU grace period

LOW 37

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00482 Published 2026-05-06 Fixed in 6.6.136, 6.12.83 +3 CWE-416