Red Hat Security Advisory

RHSA-2026:43231

kernel security, bug fix, and enhancement update

Released 2026-07-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.139.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.139.1.el9_4, kernel-64k-devel-5.14.0-427.139.1.el9_4 +11
Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.139.1.el9_4, kernel-5.14.0-427.139.1.el9_4, kernel-64k-5.14.0-427.139.1.el9_4 +29
Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.139.1.el9_4, kernel-rt-core-5.14.0-427.139.1.el9_4, kernel-rt-debug-5.14.0-427.139.1.el9_4 +9
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.139.1.el9_4, kernel-rt-core-5.14.0-427.139.1.el9_4, kernel-rt-debug-5.14.0-427.139.1.el9_4 +11

Fixes 5 records

TI-2026-33859 CVE-2026-46135 · GHSA-pp4w-65w8-f5f3

nvmet-tcp: fix race between ICReq handling and queue teardown

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection R…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2026-05-28 Partial fix · 5.10.261, 5.15.212 +6 CWE-362

TI-2026-33932 CVE-2026-46209 · GHSA-f8g6-g8cv-582v

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

LOW 35

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00142 Published 2026-05-28 Partial fix · 5.10.258, 5.15.209 +6 CWE-190

TI-2026-33840 CVE-2026-46116 · GHSA-96hg-7p79-ggx2

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

LOW 35

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls u…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0013 Published 2026-05-28 Partial fix · 5.10.261, 5.15.210 +6 CWE-416

TI-2026-24046 CVE-2026-31488 · GHSA-wg67-7cxp-7wp8

drm/amd/display: Do not skip unrelated mode changes in DSC validation

LOW 35

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in ato…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0014 Published 2026-04-22 Partial fix · 6.1.175, 6.6.140 +4 CWE-416

TI-2026-24241 CVE-2026-31684 · GHSA-gj33-f2q3-mjhg

net: sched: act_csum: validate nested VLAN headers

LOW 24

In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00117 Published 2026-04-25 Partial fix · 4.20, 5.10.258 +7