RHSA-2026:9644MediumCVSS 7.5

Red Hat Security Advisory: kernel security update

Published
April 22, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (9)

CVE-2025-38248 →CVE-2025-39981 →CVE-2026-23144 →CVE-2026-23171 →CVE-2025-68800 →CVE-2026-23066 →CVE-2026-23204 →CVE-2026-23209 →CVE-2026-23231 →

📋 Description

CVE-2025-38248 — kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init CVE-2025-39981 — kernel: Bluetooth: MGMT: Fix possible UAFs CVE-2025-68800 — kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats CVE-2026-23066 — kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg CVE-2026-23144 — kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure CVE-2026-23171 — kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution CVE-2026-23204 — kernel: net/sched: cls_u32: use skb_header_pointer_careful() CVE-2026-23209 — kernel: macvlan: fix error recovery in macvlan_common_newlink() CVE-2026-23231 — kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()

🎯 Affected products169

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-0:7.0.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-0:7.0.0-284.166.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-0:7.0.0-284.166.1.el9_2.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-0:7.0.0-284.166.1.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • bpftool-debuginfo-0:7.0.0-284.166.1.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-0:5.14.0-284.166.1.el9_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-0:5.14.0-284.166.1.el9_2.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-0:5.14.0-284.166.1.el9_2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-0:5.14.0-284.166.1.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-core-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-core-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-debuginfo-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • kernel-64k-debug-debuginfo-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-devel-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • kernel-64k-debug-devel-matched-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • kernel-64k-debug-modules-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-modules-core-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • kernel-64k-debug-modules-extra-0:5.14.0-284.166.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • +139 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Ensure Bluetooth management interfaces are hardened or, if unused, disabled. Workaround: To mitigate this issue, prevent module rxrpc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent the `bonding` kernel module from loading if bonding interfaces are not required. This can be achieved by creating a modprobe configuration file. Create a file named `/etc/modprobe.d/disable-bonding.conf` with the following content: `install bonding /bin/true` After creating the file, a system reboot is required for the change to take effect if the module is currently loaded. This action will prevent the creation and use of bonding network interfaces. Workaround: To mitigate this issue, prevent module macvlan from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 7.4 and later, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

🔗 References (12)