RHSA-2026:33899HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
July 1, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (9)

CVE-2025-71116 →CVE-2026-43125 →CVE-2026-46090 →CVE-2026-22984 →CVE-2026-22990 →CVE-2026-23455 →CVE-2026-43329 →CVE-2026-45852 →CVE-2026-46227 →

📋 Description

CVE-2025-71116 — kernel: libceph: make decode_pool() more resilient against corrupted osdmaps CVE-2026-22984 — kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() CVE-2026-22990 — kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() CVE-2026-23455 — kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() CVE-2026-43125 — kernel: dlm: validate length in dlm_search_rsb_tree CVE-2026-43329 — kernel: netfilter: flowtable: strictly check for maximum number of actions CVE-2026-45852 — kernel: RDMA/rxe: Fix double free in rxe_srq_from_init CVE-2026-46090 — kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop CVE-2026-46227 — kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

🎯 Affected products52

  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • bpftool-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • bpftool-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.198.1.el8_6.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-0:4.18.0-372.198.1.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-abi-stablelists-0:4.18.0-372.198.1.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-abi-stablelists-0:4.18.0-372.198.1.el8_6.noarch as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-core-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-core-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-core-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-core-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-devel-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-devel-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-modules-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-modules-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debug-modules-extra-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debug-modules-extra-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debuginfo-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • kernel-debuginfo-common-x86_64-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • kernel-debuginfo-common-x86_64-0:4.18.0-372.198.1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue and if Ceph not being used, then prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this vulnerability, prevent the `rdma_rxe` kernel module from loading. Create a file `/etc/modprobe.d/blacklist-rdma_rxe.conf` with `blacklist rdma_rxe`. Regenerate the initramfs using `sudo dracut -f -v` (or `sudo mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot. This action may impact functionality dependent on the RDMA/rxe driver. Workaround: To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (12)