RHSA-2026:25217HighCVSS 8.8

Red Hat Security Advisory: kernel security update

Published
June 11, 2026
Last Modified
July 31, 2026

🔗 CVE IDs covered (11)

CVE-2026-43501 →CVE-2026-45852 →CVE-2026-31581 →CVE-2026-43037 →CVE-2026-43116 →CVE-2026-46181 →CVE-2026-23216 →CVE-2026-31419 →CVE-2026-31508 →CVE-2026-43056 →CVE-2026-43125 →

📋 Description

CVE-2026-23216 — kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() CVE-2026-31419 — kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service CVE-2026-31508 — kernel: net: openvswitch: Avoid releasing netdev before teardown completes CVE-2026-31581 — kernel: ALSA: 6fire: fix use-after-free on disconnect CVE-2026-43037 — kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() CVE-2026-43056 — kernel: net: mana: fix use-after-free in add_adev() error path CVE-2026-43116 — kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43125 — kernel: dlm: validate length in dlm_search_rsb_tree CVE-2026-43501 — kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows CVE-2026-45852 — kernel: RDMA/rxe: Fix double free in rxe_srq_from_init CVE-2026-46181 — kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.15.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.15.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.15.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.15.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.15.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue, prevent the iscsi_target_mod module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules. Workaround: To mitigate this issue, prevent the snd_usb_6fire module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: Mitigation for this issue is to skip loading the affected module `ip6_tunnel` onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ We may also want to detection and monitoring an affected system as below: ~~~ Monitor for exploitation attempts: # Enable kernel audit for IPv6 tunnel operations auditctl -a always,exit -F arch=b64 -S socket -F a0=10 -F a1=3 -k ipv6_tunnel # Monitor system logs for kernel panics/crashes journalctl -k -p err -f | grep -i "ip6_tunnel\|icmp\|stack" ~~~ Workaround: Mitigation for this issue is to skip loading the affected module "netfilter" onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~ Workaround: To mitigate this issue, disable IPv6 Source Routing by setting the `accept_source_route` sysctl parameter to 0 for all IPv6 interfaces. This can prevent the kernel from processing IPv6 Source Routing Headers, thereby avoiding the vulnerable code path. To disable IPv6 Source Routing: `sysctl -w net.ipv6.conf.all.accept_source_route=0` `sysctl -w net.ipv6.conf.default.accept_source_route=0` To make this change persistent across reboots, add the following lines to `/etc/sysctl.d/99-disable-ipv6-srh.conf`: `net.ipv6.conf.all.accept_source_route = 0` `net.ipv6.conf.default.accept_source_route = 0` Then, apply the changes with: `sysctl --system` Disabling IPv6 Source Routing may impact network configurations that rely on this feature.

🔗 References (14)