RHSA-2026:35896HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
July 6, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (11)

CVE-2026-22990 →CVE-2026-23455 →CVE-2026-31408 →CVE-2026-43329 →CVE-2025-71116 →CVE-2026-31669 →CVE-2026-43198 →CVE-2026-45852 →CVE-2026-46090 →CVE-2026-46181 →CVE-2026-22984 →

📋 Description

CVE-2025-71116 — kernel: libceph: make decode_pool() more resilient against corrupted osdmaps CVE-2026-22984 — kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() CVE-2026-22990 — kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() CVE-2026-23455 — kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() CVE-2026-31408 — kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold CVE-2026-31669 — kernel: mptcp: fix slab-use-after-free in __inet_lookup_established CVE-2026-43198 — kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() CVE-2026-43329 — kernel: netfilter: flowtable: strictly check for maximum number of actions CVE-2026-45852 — kernel: RDMA/rxe: Fix double free in rxe_srq_from_init CVE-2026-46090 — kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop CVE-2026-46181 — kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

🎯 Affected products52

  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • bpftool-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • bpftool-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • bpftool-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • bpftool-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-0:4.18.0-305.197.1.el8_4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-0:4.18.0-305.197.1.el8_4.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-abi-stablelists-0:4.18.0-305.197.1.el8_4.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-abi-stablelists-0:4.18.0-305.197.1.el8_4.noarch as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-core-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-core-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-core-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-core-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-devel-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-devel-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-modules-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-modules-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-modules-extra-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-modules-extra-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debuginfo-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debuginfo-common-x86_64-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debuginfo-common-x86_64-0:4.18.0-305.197.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue and if Ceph not being used, then prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, prevent the `rdma_rxe` kernel module from loading. Create a file `/etc/modprobe.d/blacklist-rdma_rxe.conf` with `blacklist rdma_rxe`. Regenerate the initramfs using `sudo dracut -f -v` (or `sudo mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot. This action may impact functionality dependent on the RDMA/rxe driver.

🔗 References (14)