RHSA-2026:2212MediumCVSS 7.4

Red Hat Security Advisory: kernel security update

Published
February 9, 2026
Last Modified
July 30, 2026

🔗 CVE IDs covered (16)

CVE-2025-38403 →CVE-2025-38730 →CVE-2025-40141 →CVE-2025-40269 →CVE-2025-37819 →CVE-2025-38022 →CVE-2025-38415 →CVE-2025-39760 →CVE-2025-40135 →CVE-2025-40170 →CVE-2025-38024 →CVE-2025-38459 →CVE-2025-40318 →CVE-2025-37789 →CVE-2025-40158 →CVE-2025-40271 →

📋 Description

CVE-2025-37789 — kernel: Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation CVE-2025-37819 — kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability CVE-2025-38022 — kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem CVE-2025-38024 — kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution CVE-2025-38403 — kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet CVE-2025-38415 — kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation CVE-2025-38459 — kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion CVE-2025-38730 — kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling CVE-2025-39760 — kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing CVE-2025-40135 — kernel: ipv6: use RCU in ip6_xmit() CVE-2025-40141 — kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free CVE-2025-40158 — kernel: ipv6: use RCU in ip6_output() CVE-2025-40170 — kernel: net: use dst_dev_rcu() in sk_setup_caps() CVE-2025-40269 — kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service CVE-2025-40271 — kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. CVE-2025-40318 — kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-611.30.1.el9_7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-611.30.1.el9_7.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-611.30.1.el9_7.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-611.30.1.el9_7.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-611.30.1.el9_7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue, prevent the `rxe` kernel module from loading. This can be achieved by creating a blacklist rule. 1. Create a file `/etc/modprobe.d/blacklist-rxe.conf` with the following content: ``` blacklist rxe install rxe /bin/true ``` 2. Rebuild the initial ramdisk: ```bash dracut -f -v ``` 3. Reboot the system for the changes to take effect. Warning: Blacklisting the `rxe` module may impact functionality that relies on Soft RoCE. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent the `snd_usb_audio` kernel module from loading if USB audio functionality is not required. Create a file `/etc/modprobe.d/disable-snd-usb-audio.conf` with the following content: `install snd_usb_audio /bin/true` After creating the file, a system reboot is required for the changes to take effect. This action will disable all USB audio device functionality.

🔗 References (19)