This Red Hat security advisory addresses multiple critical and high-severity kernel vulnerabilities, including a critical (CVSS 9.8) slab-use-after-free in the MPTCP subsystem (CVE-2026-31669) and high-severity (CVSS 7.8) Xen driver flaws allowing double-free and buffer overflow conditions. The vulnerabilities affect a wide range of Linux kernel versions; for example, CVE-2026-31669 affects kernel versions from 5.12.1 through 5.15.202, 5.16 through 6.1.168, 6.2 through 6.6.134, 6.7 through 6.12.81, and 6.13 through 6.18.22. The fixed versions are provided per kernel branch, such as 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, and 6.19.13 for CVE-2026-31669, and a system reboot is required after applying the update.
Red Hat Product Errata RHSA-2026:26427 - Security Advisory Issued: 2026-06-16 Updated: 2026-06-16 RHSA-2026:26427 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2461503 - CVE-2026-31669 kernel: mptcp: fix slab-use-after-free in __inet_lookup_established BZ - 2464092 - CVE-2026-31787 kernel: xen/privcmd: fix double free via VMA splitting BZ - 2464096 - CVE-2026-31786 kernel: Buffer overflow in drivers/xen/sys-hypervisor.c BZ - 2467014 - CVE-2026-43110 kernel: wifi: brcmfmac: validate bsscfg indices in IF events BZ - 2468124 - CVE-2026-43329 kernel: netfilter: flowtable: strictly check for maximum number of actions BZ - 2482181 - CVE-2026-46056 kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers BZ - 2482563 - CVE-2026-46152 kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result BZ - 2482608 - CVE-2026-46125 kernel: wifi: mac80211: remove station if connection prep fails CVEs CVE-2026-31669 CVE-2026-31786 CVE-2026-31787 CVE-2026-43110 CVE-2026-43329 CVE-2026-46056 CVE-2026-46125 CVE-2026-46152 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM kernel-4.18.0-553.134.1.el8_10.src.rpm SHA-256: 218258d666606810d0be70ec4c7efd06cb7f24f88a9af0d7acb64a60147dcc62 x86_64 bpftool-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: fb87b7f058f48b9d07d1e35e313c8f7b8914d1b782837989e91862e97369d7d0 bpftool-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 2fc80a2a2a358090da5ddcd0b9484b3ed4f651da7ba7d7e80d22a2df47524be0 kernel-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 97614d426cccda2b9eb0d4aec0df3222e575e52fc16ccdf458c1555060788568 kernel-abi-stablelists-4.18.0-553.134.1.el8_10.noarch.rpm SHA-256: edf783ddbe28bdde501a38af6f4d7c73e601a31804bdac3865f0a14acf6b8139 kernel-core-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 08e414c759fb1d24115f0a472f2049cdb2958113eb9f207494e012ea204fa776 kernel-cross-headers-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 1a17c1c18bf41f541a211c950f3e48a9d197585853190b52967a607e05e04089 kernel-debug-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 31b74ec30a028545bb4a51cb06fed21c4191b8249be2238f83eb4f511e9e3f7c kernel-debug-core-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 1efeb95fa2dfe4acb6fc42b3226bdd52b43f1c4b45f0c8fa923d0b4986e8dee9 kernel-debug-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 2cbdcd3e378011c348c49bee99885f4538755d0dc322cacfe84c07a1416f667c kernel-debug-devel-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 0da9e3eaff1e88a0b840f351036ac2cbfed65b7317bd124e33365964ef6ad0e8 kernel-debug-modules-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 64c7f39efc10b9b42df3f4feb365c71fe04fe6fc4736c0008bc5e9f560a283a1 kernel-debug-modules-extra-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 2ac6d609778b4323078172e776d921ef08201288f74a83c99e7550b7d761ca6e kernel-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: ec4aaad9ef8695e209bba6abdd82fcc9ac485e12f504e81f7caa348cf3390e77 kernel-debuginfo-common-x86_64-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 05cb8707e45bf1f8d7accd604e7c67754b0daebd44d65c6b1f73766d223bcf85 kernel-devel-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 300179de17102504ccb13610266e4cb4440bdae5a3942077b1699c5b384eae2b kernel-doc-4.18.0-553.134.1.el8_10.noarch.rpm SHA-256: 1e6d46d52eade0d76d973179841cfe9ec17bffa56922e005f7d98eba13f6357f kernel-headers-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 2b1c8c3a880a8376ff67149375c6e977b800efddcf3cedf31244bc6ba8b8a3fb kernel-modules-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 96e106fef6b0b2d274ceacae3675686e02fe1b0e7e64363cc14886a35729378b kernel-modules-extra-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: a2aab195a60bd4acc8c58e25368e7b4641449cc1b0fb5d420ba4ed7f7b398746 kernel-tools-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: c5bad083ed72723557738566df6b947c0369d9adbfbec1d9eaca6f09907141d6 kernel-tools-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 266d97bbc2c2166bdec9cc94f1f4806bd4ed9f38ea713685e142db980773cb8b kernel-tools-libs-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 5a6c0c35a9b2fe7707d3466e905683e8a64cb0f80279e4c01529a427369378b6 perf-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: ffa9e24ace2ba6823e19482396f54ac1363c101bc3553cd31cb006fad55e18a2 perf-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: fb55c6a47a47df9f25a3bcbc85a01e1ca273383568566f5e3b4e888a49229aa4 python3-perf-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: 6e71a5d2c9810ab6860e8fe8a28ea251ab9db3e8ae809a00427859390127efbb python3-perf-debuginfo-4.18.0-553.134.1.el8_10.x86_64.rpm SHA-256: faed2703119bf74868401371cd90128346c22a56f34d906ffacc5f8bd68ad3b3 Red Hat Enterprise Linux for IBM z Systems 8 SRPM kernel-4.18.0-553.134.1.el8_10.src.rpm SHA-256: 218258d666606810d0be70ec4c7efd06cb7f24f88a9af0d7acb64a60147dcc62 s390x bpftool-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 09e406e912e4df08add3dd40612dc6179ff5354127af61a2ca3e6b3ebd3c24f1 bpftool-debuginfo-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 443281b503f655ce911391470af9002f503ca73d04d2c898e62aa76230ec3156 kernel-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: c117e0eb8be7bdfbf050c90b1482a8babebba2a8b2a73215cedefbcb5361de76 kernel-abi-stablelists-4.18.0-553.134.1.el8_10.noarch.rpm SHA-256: edf783ddbe28bdde501a38af6f4d7c73e601a31804bdac3865f0a14acf6b8139 kernel-core-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 92e105191176e99dc70d7c27861647f08ffc857cb0ad2f612e7a52a845e6113b kernel-cross-headers-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: e9b7462b1c467ae8cc779a8784934ed45650c6e68a3c20c93241f62689f1263c kernel-debug-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: f57c66fb508bc6e565cfcae5b0c9adcf9bc434784b0d70ee273e2dcf37662afe kernel-debug-core-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 75d15a53c2da828c1568498fea2dd3f87f510c8598b67dda234dfbf13e8bc8ae kernel-debug-debuginfo-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 4032c5ba75dce67f77986dc3aaa9c952f498eed82938daefc6d750a1eb59f8b3 kernel-debug-devel-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 44df129892db1a2985aa6b89cc2e4875f341909ceddbe4abc1b2a512110901de kernel-debug-modules-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 362cfd33feb26ab8406bcc7afeee0faf431c11e827ec1d0be8f54507b3c86849 kernel-debug-modules-extra-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 81cd51c23479444083f152552659a8ef61fd353be88e3d1a8573a025617ff8bb kernel-debuginfo-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: c89b58cb79dce9abeae446e39f3b2b05b2086f24e63145ba9285129e61361f29 kernel-debuginfo-common-s390x-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 387b6876ad9ff2cd3a91c1b6163d7a68a14d087437f93e243aa4667eca8511be kernel-devel-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: c0e0cd92bbe57e11c6b0bb750b4d30ccc304a92b6490d166c87290ca66a3ce3e kernel-doc-4.18.0-553.134.1.el8_10.noarch.rpm SHA-256: 1e6d46d52eade0d76d973179841cfe9ec17bffa56922e005f7d98eba13f6357f kernel-headers-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 3bc31798bb02417964f9185d8d83e049734f7e28893fda286f513534adea0c6a kernel-modules-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 71c31e2a91617cd71f5c58269d3bf189d56fee527c71b7654205fe59f9d5b9cc kernel-modules-extra-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 2bf5088c9816fee0f8f5f449e95911c3457dc55af34a9f7aae7d769adecd5c76 kernel-tools-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: dd391c5474cb5a66756c127c919d3e2df09d9bac318f1873920dd1778f2fc50b kernel-tools-debuginfo-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 8549fd9b58cb64615dc3d4f802212f61d9212f91439b45f52918cc2d5e2e7c97 kernel-zfcpdump-4.18.0-553.134.1.el8_10.s390x.rpm SHA-256: 799147c7597b240bc1f4af30458b491ea208571dd17382b6