This critical Red Hat kernel security update addresses multiple vulnerabilities, including use-after-free flaws in the bonding driver (CVE-2026-31419, CVSS 7.8) and CAN raw subsystem (CVE-2026-31532, CVSS 7.8), which can lead to denial of service. Affected kernel version ranges are extensive; for example, CVE-2026-31532 affects Linux kernels from 4.1 through 6.6.136, 6.7 through 6.12.82, and other specific ranges, with fixes available in versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. A system reboot is required after applying the update.
Red Hat Product Errata RHSA-2026:25191 - Security Advisory Issued: 2026-06-11 Updated: 2026-06-11 RHSA-2026:25191 - Security Advisory Overview Updated Packages Synopsis Critical: kernel security update Type/Severity Security Advisory: Critical Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2457829 - CVE-2026-31419 kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service BZ - 2460616 - CVE-2026-31467 kernel: Linux kernel: Denial of Service in erofs filesystem BZ - 2461107 - CVE-2026-31532 kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() BZ - 2461471 - CVE-2026-31581 kernel: ALSA: 6fire: fix use-after-free on disconnect BZ - 2464351 - CVE-2026-43037 kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() BZ - 2480457 - CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows BZ - 2482025 - CVE-2026-46054 kernel: selinux: fix overlayfs mmap() and mprotect() access checks CVEs CVE-2026-31419 CVE-2026-31467 CVE-2026-31532 CVE-2026-31581 CVE-2026-43037 CVE-2026-43501 CVE-2026-46054 References https://access.redhat.com/security/updates/classification/#critical Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM kernel-6.12.0-211.22.1.el10_2.src.rpm SHA-256: aa6f6da924ddec4431ecfa0015222bee86a7e5921ffadeed6917370ca7647568 x86_64 kernel-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: c577db1f04722bad80ed7b122f4e5fe17b3e78a5fef9857566fd33b9e6c95d19 kernel-abi-stablelists-6.12.0-211.22.1.el10_2.noarch.rpm SHA-256: b9e9aecd6f98ebc8cd05a69d058db4d3a9faf1a34a74a4534095a8645919c3d6 kernel-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: e1008c95d6116ea8717081d1ea772feab5c32bb4e3308bc66c4dfeae12d848d9 kernel-debug-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: b355274a6bb5083756ecb92f20bace5593946d294c2136065c5b63358719a23d kernel-debug-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 4194b11bb3c625d77ab91f8bf301453c973f89284135e8902950ae666f299d4a kernel-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 2f718bcea3026c2ab945d9367952b06a8ce10902bd0f02ea800c8f5bb47b51e5 kernel-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 2f718bcea3026c2ab945d9367952b06a8ce10902bd0f02ea800c8f5bb47b51e5 kernel-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 2f718bcea3026c2ab945d9367952b06a8ce10902bd0f02ea800c8f5bb47b51e5 kernel-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 2f718bcea3026c2ab945d9367952b06a8ce10902bd0f02ea800c8f5bb47b51e5 kernel-debug-devel-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 15514e6a37fc9ab0c8b359011e4b1710445116657f7dedbca620aafbbe991527 kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: bf4569eec7ce7dea428477df6e122130045490602f5a450eae7780fe50bf44e9 kernel-debug-modules-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 544c19c9e8f146922904d9d2074335d758bb442dd66fbe755ae15a288558e34e kernel-debug-modules-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 8e7afed3b49b9e93098ae57b3a5b51b009abd5957ea1852139f2e35a45dbd9fd kernel-debug-modules-extra-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 38a2c70711f1bb1dabe2bf76f4419eedd6c9c8b948111892413607821f394c88 kernel-debug-uki-virt-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: c51d7643bb33b4cba061a074855adc5ff63485f190f6b8ad5f6dbe1d69b70315 kernel-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 29b111b1b833fda7571df3975ae6238ad2983e368b705511a2d767723e2dc3e4 kernel-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 29b111b1b833fda7571df3975ae6238ad2983e368b705511a2d767723e2dc3e4 kernel-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 29b111b1b833fda7571df3975ae6238ad2983e368b705511a2d767723e2dc3e4 kernel-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 29b111b1b833fda7571df3975ae6238ad2983e368b705511a2d767723e2dc3e4 kernel-debuginfo-common-x86_64-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: a4dc063da96871d9f6420ae013a18a883fa395e4daac818caabe013b0d4484d1 kernel-debuginfo-common-x86_64-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: a4dc063da96871d9f6420ae013a18a883fa395e4daac818caabe013b0d4484d1 kernel-debuginfo-common-x86_64-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: a4dc063da96871d9f6420ae013a18a883fa395e4daac818caabe013b0d4484d1 kernel-debuginfo-common-x86_64-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: a4dc063da96871d9f6420ae013a18a883fa395e4daac818caabe013b0d4484d1 kernel-devel-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: e2106484f32cbfccf5b46207d40d21dedacee01ee0f4496915dcbaa3f7b59e03 kernel-devel-matched-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 036eb28320e90903dca3baacf81b4b3495ee435d48b5a11810231dfa424ec272 kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm SHA-256: 38efc5777245a577f6a0dfbb9d933907f0d0019e4b6b106f6f6d359c0b6e992f kernel-headers-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: a2d7c0ccc10be9975a931bcba956167daa021ec5d8b841550b4768c8cc8c7704 kernel-modules-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 20293e48dc0939b2358432649b4379583c4b794cc1f5cfc973e9655c9815645d kernel-modules-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 3ae15f5497ebd5c94cf57c1488eb9c66fef69a040202ffbc74cc10c8c48cf9df kernel-modules-extra-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: cea264d0cd232ce5ab9e978d72038264f1f9429ed08699027ede9cba4a580e93 kernel-modules-extra-matched-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 2fe94030b7bcf35faaf0a2ca46484aa5bc299ce6e6dffad7c5660c0498a3f307 kernel-rt-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: ab1049541ac368657ea3cb00c7d04c3a7a2197f16bb2ceca9a08c84c9ea78cdc kernel-rt-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: ab1049541ac368657ea3cb00c7d04c3a7a2197f16bb2ceca9a08c84c9ea78cdc kernel-rt-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 26ce5a9aa1a09da21c45bbbbaf7ac5b8d25e5b45001fe6f53df2e94098eabcea kernel-rt-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 26ce5a9aa1a09da21c45bbbbaf7ac5b8d25e5b45001fe6f53df2e94098eabcea kernel-rt-debug-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 061069840fa640bbd900eaa0b04be90c4165d8f4e0f0496e91a06529eb233e7c kernel-rt-debug-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 061069840fa640bbd900eaa0b04be90c4165d8f4e0f0496e91a06529eb233e7c kernel-rt-debug-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: c0931820adb26e601f0e7b020f8129cf9f3a61d31ef6527725557fcfcb690179 kernel-rt-debug-core-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: c0931820adb26e601f0e7b020f8129cf9f3a61d31ef6527725557fcfcb690179 kernel-rt-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 026921fd1512850feb7ed1e9368c58405418aa660fffd66bf23786c735bd7356 kernel-rt-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 026921fd1512850feb7ed1e9368c58405418aa660fffd66bf23786c735bd7356 kernel-rt-debug-debuginfo-6.12.0-211.22.1.el10_2.x86_64.rpm SHA-256: 026921fd1512850feb7ed1e9368c58405418aa660fffd66bf2378