Red Hat Security Advisory

RHSA-2026:95601

kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_161_1 security update

Released 2026-11-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS E4S (v.8.8) kpatch-patch-4_18_0-477_107_1-1-18.el8_8, kpatch-patch-4_18_0-477_120_1-1-17.el8_8, kpatch-patch-4_18_0-477_130_1-1-15.el8_8 +2

Fixes 3 records

TI-2026-52488 CVE-2026-74705 · GHSA-rcm8-q4cm-988v

udp: fix potential use-after-free in tunnel segmentation

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.005 Published 2026-08-22 Fixed in 5.10.265, 5.15.216 +6

TI-2026-56013 CVE-2026-81000 · GHSA-32hf-vhcc-85c2

net: tun: bound receive headroom

LOW 36

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00357 Published 2026-09-11 Partial fix · 5.10.270, 5.15.221 +6

TI-2026-38010 CVE-2026-52923 · GHSA-m237-4jxg-w5jh

ipc: limit next_id allocation to the valid ID range

LOW 35

In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00215 Published 2026-06-24 Partial fix · 5.10.259, 5.15.210 +6 CWE-20