Red Hat Security Advisory

RHSA-2026:6954

kernel security update

Released 2026-04-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.135.1.el8_8, kernel-4.18.0-477.135.1.el8_8, kernel-abi-stablelists-4.18.0-477.135.1.el8_8 +14
Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.135.1.el8_8, kernel-4.18.0-477.135.1.el8_8, kernel-abi-stablelists-4.18.0-477.135.1.el8_8 +14

Fixes 7 records

TI-2025-26838 CVE-2025-40168 · GHSA-9cp7-m95w-q87h

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

LOW 36

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0042 Published 2025-11-12 Partial fix · 6.1.187, 6.6.156 +3

TI-2025-25587 CVE-2025-38248 · GHSA-2838-84rj-32xc

bridge: mcast: Fix use-after-free during router port configuration

LOW 36

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.003 Published 2025-07-09 Partial fix · 5.15.224, 6.1.191 +4 CWE-416

TI-2026-18646 CVE-2026-23209 · GHSA-89j4-f3cq-gm32

macvlan: fix error recovery in macvlan_common_newlink()

LOW 35

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set ad…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00176 Published 2026-02-14 Partial fix · 5.10.250, 5.15.200 +5 CWE-416

TI-2026-18438 CVE-2026-23001 · GHSA-vgc7-m4r9-xw45

macvlan: fix possible UAF in macvlan_forward_source()

LOW 35

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00206 Published 2026-01-25 Partial fix · 5.10.249, 5.15.199 +5 CWE-416

TI-2025-43369 CVE-2025-71238 · GHSA-7hgf-78m2-x598

scsi: qla2xxx: Fix bsg_done() causing double free

LOW 35

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00216 Published 2026-03-04 Partial fix · 5.10.251, 5.15.201 +6 CWE-415

TI-2025-25520 CVE-2025-38180 · GHSA-qp5r-frvf-p8mw

net: atm: fix /proc/net/atm/lec handling

LOW 35

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0021 Published 2025-07-04 Partial fix · 5.4.295, 5.10.239 +6 CWE-416

TI-2025-26736 CVE-2025-40064 · GHSA-c442-5cxr-p4xq

smc: Fix use-after-free in __pnet_find_base_ndev().

LOW 33

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev().

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0015 Published 2025-10-28 Partial fix · 6.1.187, 6.6.156 +3