Red Hat Security AdvisoryRHSA-2026:64767
kernel security, bug fix, and enhancement update
Released 2026-09-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.103.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.103.1.el10_0, kernel-64k-devel-6.12.0-55.103.1.el10_0 +12
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.103.1.el10_0, kernel-64k-6.12.0-55.103.1.el10_0, kernel-64k-core-6.12.0-55.103.1.el10_0 +28
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.103.1.el10_0, libperf-6.12.0-55.103.1.el10_0
- Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.103.1.el10_0, kernel-rt-64k-6.12.0-55.103.1.el10_0, kernel-rt-64k-core-6.12.0-55.103.1.el10_0 +21
- Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.103.1.el10_0, kernel-rt-core-6.12.0-55.103.1.el10_0, kernel-rt-debug-6.12.0-55.103.1.el10_0 +11
Fixes 10 records
Priority MEDIUM 50
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and th…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00711 · Published 2026-07-19 · Partial fix · 6.1.176, 6.6.143 +4 CWE-122
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-06-24 · Partial fix · 5.10.258, 5.15.209 +6 CWE-825
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used.
CVSS 3.1CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.0037 · Published 2026-05-06 · Partial fix · 5.10.258, 5.15.209 +6 CWE-20
Priority MEDIUM 46
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA li…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00478 · Published 2026-05-28 · Fixed in 6.6.140, 6.12.88 +3 CWE-125
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify…
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00282 · Published 2026-05-27 · Partial fix · 5.10.259, 5.15.210 +6 CWE-416
Priority LOW 37
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00288 · Published 2026-05-27 · Partial fix · 5.15.209, 6.1.175 +5 CWE-416
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00169 · Published 2026-07-25 · Partial fix · 5.10.261, 5.15.212 +6 CWE-787
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00141 · Published 2026-06-24 · Partial fix · 5.10.258, 5.15.209 +6 CWE-805
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the us…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00147 · Published 2026-05-28 · Fixed in 6.6.141, 6.12.88 +3 CWE-120
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00172 · Published 2025-11-12 · Partial fix · 5.15.199, 6.1.161 +4 CWE-416
THREATIST.IORead the docs