Red Hat Security Advisory

RHSA-2026:47017

kernel security, bug fix, and enhancement update

Released 2026-07-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.40.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.40.1.el10_2, kernel-64k-devel-6.12.0-211.40.1.el10_2 +12
Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.40.1.el10_2, kernel-64k-6.12.0-211.40.1.el10_2, kernel-64k-core-6.12.0-211.40.1.el10_2 +29
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.40.1.el10_2, libperf-6.12.0-211.40.1.el10_2
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.40.1.el10_2, kernel-rt-64k-6.12.0-211.40.1.el10_2, kernel-rt-64k-core-6.12.0-211.40.1.el10_2 +21
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.40.1.el10_2, kernel-rt-core-6.12.0-211.40.1.el10_2, kernel-rt-debug-6.12.0-211.40.1.el10_2 +9

Fixes 5 records

TI-2026-24192 CVE-2026-31635 · GHSA-f5xm-f2m7-vrg6

rxrpc: fix oversized RESPONSE authenticator length check

HIGH 68

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01017 Published 2026-04-24 Fixed in 6.18.23, 6.19.13 +1 CWE-130

TI-2026-38093 CVE-2026-53006 · GHSA-f2fg-xhhc-4m4w

ipv6: fix possible UAF in icmpv6_rcv()

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00394 Published 2026-06-24 Partial fix · 5.10.258, 5.15.209 +6 CWE-825

TI-2026-38080 CVE-2026-52993 · GHSA-m86q-cgj9-94c8

tipc: fix double-free in tipc_buf_append()

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00404 Published 2026-06-24 Partial fix · 5.10.258, 5.15.209 +6 CWE-763

TI-2026-38367 CVE-2026-53281 · GHSA-p9cf-q2gf-35mq

iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

LOW 39

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL…

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00136 Published 2026-06-26 Fixed in 6.12.114, 6.14 +3 CWE-476

TI-2026-33810 CVE-2026-46086 · GHSA-qcf5-mj4w-x99v

net: bridge: use a stable FDB dst snapshot in RCU readers

LOW 24

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00129 Published 2026-05-27 Partial fix · 5.10.259, 5.15.210 +6 CWE-476