Red Hat Product Errata RHSA-2026:27731 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:27731 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation (CVE-2025-38154) kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) Bug Fix(es) and Enhancement(s): libceph: CEPH_CRYPTO_AES256KRB5 (--key-type aes256k) support [rhel-10.0.z] (JIRA:RHEL-168933) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2376056 - CVE-2025-38154 kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation BZ - 2414506 - CVE-2025-40170 kernel: net: use dst_dev_rcu() in sk_setup_caps() BZ - 2414521 - CVE-2025-40135 kernel: ipv6: use RCU in ip6_xmit() BZ - 2414523 - CVE-2025-40158 kernel: ipv6: use RCU in ip6_output() BZ - 2439852 - CVE-2026-23136 kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state BZ - 2460646 - CVE-2026-31474 kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() BZ - 2467005 - CVE-2026-43116 kernel: netfilter: ctnetlink: ensure safe access to master conntrack BZ - 2479492 - CVE-2026-46331 kernel: net/sched: act_pedit: extend the writable skb range per key BZ - 2479832 - CVE-2026-46323 kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs BZ - 2480457 - CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows BZ - 2482031 - CVE-2026-45898 kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list BZ - 2482564 - CVE-2026-46227 kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL BZ - 2482608 - CVE-2026-46125 kernel: wifi: mac80211: remove station if connection prep fails CVEs CVE-2025-38154 CVE-2025-40135 CVE-2025-40158 CVE-2025-40170 CVE-2026-23136 CVE-2026-31474 CVE-2026-43116 CVE-2026-43501 CVE-2026-45898 CVE-2026-46125 CVE-2026-46227 CVE-2026-46323 CVE-2026-46331 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM kernel-6.12.0-55.82.1.el10_0.src.rpm SHA-256: bdd795381c864e70d3f986ba97acacf9de538424a2da013dac99e1e6746673aa x86_64 kernel-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 3f7f041979d552dc8ac763411413e8da8dc655340a20e30abfb8bfba1508b8b7 kernel-abi-stablelists-6.12.0-55.82.1.el10_0.noarch.rpm SHA-256: 5e8297e756b51fc641ad2f88a2632e689eccbd47afbf3668b51ca1a97c55d69d kernel-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: f74ade4c3f5eba9b7996e3027277ccbfd16355140b07f0cdb1ac269fcb937741 kernel-debug-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 7536c601908b691d58fec8908719ea4bdb22975f49b60f6c6bd4ffbfaa9840a2 kernel-debug-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 58972605d4da352b91c0d545f66cfc72d03ea88aca7a9af3bfa3aaa16f6b3d08 kernel-debug-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e22bf8331c9d6a2b88f7e0ba361354aafe75196edfca99dd2181ba1d91f1684f kernel-debug-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e22bf8331c9d6a2b88f7e0ba361354aafe75196edfca99dd2181ba1d91f1684f kernel-debug-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e22bf8331c9d6a2b88f7e0ba361354aafe75196edfca99dd2181ba1d91f1684f kernel-debug-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e22bf8331c9d6a2b88f7e0ba361354aafe75196edfca99dd2181ba1d91f1684f kernel-debug-devel-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 598767f7f33412fd3fd22e54f9ea9911c615903cea48e6adbeb816b1ac9211cb kernel-debug-devel-matched-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 83423b4d88af76b7a916c150887aa1adb38660a339d0cab7af8b0730757823e9 kernel-debug-modules-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 05f58b50098dce592a9fafdeac1afa6a90466d1199bed0110b19d2db22c53f4f kernel-debug-modules-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 6362ce1079bd95678280e7e244211761ee5f3d6515ec0ffa9fb633137fee158d kernel-debug-modules-extra-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: b614cf7e1e2cf5a38552719974c931a4f946904cba6d94262cc9a42ac3298dd1 kernel-debug-uki-virt-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 0cf27a564a40a5bc267e4abccaae9b33f286f7dee2866257da3a979f0903b4d7 kernel-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 4eaa13510e61546143a79196fb2563faf8c3818379db1abd05b6e0a44e4c11b0 kernel-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 4eaa13510e61546143a79196fb2563faf8c3818379db1abd05b6e0a44e4c11b0 kernel-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 4eaa13510e61546143a79196fb2563faf8c3818379db1abd05b6e0a44e4c11b0 kernel-debuginfo-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 4eaa13510e61546143a79196fb2563faf8c3818379db1abd05b6e0a44e4c11b0 kernel-debuginfo-common-x86_64-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: cbe94fd1072a025fcd528d6cb1089dba8eb7434793824902f7edb8b7bceeeb04 kernel-debuginfo-common-x86_64-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: cbe94fd1072a025fcd528d6cb1089dba8eb7434793824902f7edb8b7bceeeb04 kernel-debuginfo-common-x86_64-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: cbe94fd1072a025fcd528d6cb1089dba8eb7434793824902f7edb8b7bceeeb04 kernel-debuginfo-common-x86_64-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: cbe94fd1072a025fcd528d6cb1089dba8eb7434793824902f7edb8b7bceeeb04 kernel-devel-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 9cc374e41fdcd200ee7bb81835cf3945eb7fb2d7577c05eed342f4f096fb9794 kernel-devel-matched-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 5d2c50ef9a9c3768afd39e7f6d2f4ef84478bb05361a284f27719f26460a1be5 kernel-doc-6.12.0-55.82.1.el10_0.noarch.rpm SHA-256: d241342cba0265e9e1cce93eb0077636ebd090fe972b72b53cc10be6d0d14142 kernel-headers-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: c9ae0cb2d1be00dd11e3987927d73a5dd321123e9316f6b477854bde91ab0ccf kernel-modules-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 98412743fc8b4d593c1c1c9de1eb13f9e974a6b3b494ad0f3bbac49ae39e9c18 kernel-modules-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: ebf30701ef154387317627350fdf55530c6f88728eb6246ddb183adb45c5ff6f kernel-modules-extra-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e792f64282a5466de68de88f6add8e258eb5e7d2c964eda1dc80ec4ccef734a1 kernel-rt-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e929eb361cc14134f72a38947e1945aa1b11a9c71f7d7160a235d1c333b257ca kernel-rt-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: e929eb361cc14134f72a38947e1945aa1b11a9c71f7d7160a235d1c333b257ca kernel-rt-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 042ee611a630c26ee0778257b724ba5393563d307d65b0c78cc94551b815be9f kernel-rt-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: 042ee611a630c26ee0778257b724ba5393563d307d65b0c78cc94551b815be9f kernel-rt-debug-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: edb200b432c6e80e1ede7b5013465f2273e73d4421acf2b4eef29120be551dd0 kernel-rt-debug-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: edb200b432c6e80e1ede7b5013465f2273e73d4421acf2b4eef29120be551dd0 kernel-rt-debug-core-6.12.0-55.82.1.el10_0.x86_64.rpm SHA-256: