Red Hat Security Advisory

RHSA-2026:4246

kernel security update

Released 2026-03-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.114.1.el9_4, libperf-5.14.0-427.114.1.el9_4
Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.114.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.114.1.el9_4, kernel-64k-devel-5.14.0-427.114.1.el9_4 +11
Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.114.1.el9_4, kernel-5.14.0-427.114.1.el9_4, kernel-64k-5.14.0-427.114.1.el9_4 +29
Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.114.1.el9_4, kernel-rt-core-5.14.0-427.114.1.el9_4, kernel-rt-debug-5.14.0-427.114.1.el9_4 +9
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.114.1.el9_4, kernel-rt-core-5.14.0-427.114.1.el9_4, kernel-rt-debug-5.14.0-427.114.1.el9_4 +11

Fixes 5 records

TI-2025-25546 CVE-2025-38206 · GHSA-349q-hp2f-r4hf

exfat: fix double free in delayed_free

LOW 35

In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00193 Published 2025-07-04 Partial fix · 5.10.239, 5.15.186 +5 CWE-415

TI-2025-25470 CVE-2025-38129 · GHSA-98jq-f2h2-hqf4

page_pool: Fix use-after-free in page_pool_recycle_in_ring

LOW 35

In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_r…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00199 Published 2025-07-03 Partial fix · 5.10.259, 5.15.198 +5 CWE-416

TI-2025-25369 CVE-2025-38024 · GHSA-5vmj-cw62-2mgm

RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug

LOW 35

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 li…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00229 Published 2025-06-18 Partial fix · 5.4.294, 5.10.238 +6 CWE-416

TI-2024-32003 CVE-2024-47727 · GHSA-w36c-ppc4-pwgg

x86/tdx: Fix "in-kernel MMIO" check

LOW 34

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix "in-kernel MMIO" check TDX only supports kernel-initiated MMIO operations.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00247 Published 2024-10-21 Partial fix · 6.1.113, 6.6.54 +3 CWE-754

TI-2025-43235 CVE-2025-71085 · GHSA-hjpx-f2r6-rr4q

ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

LOW 33

In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00305 Published 2026-01-13 Partial fix · 5.10.248, 5.15.198 +5 CWE-190