This Red Hat security advisory addresses multiple Important-severity vulnerabilities in the Linux kernel for RHEL 9.4, including use-after-free, double-free, and buffer overflow flaws in components like netfilter, MPTCP, RDMA, and IPv6 RPL that could lead to privilege escalation or denial of service. The update provides fixes for eight specific CVEs, though individual CVSS scores are not listed in the advisory text. Affected systems are those running specific RHEL 9.4 Update Services for SAP Solutions and Extended Life Cycle variants, and a full system reboot is required after applying the patch.
Red Hat Product Errata RHSA-2026:27713 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:27713 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) Bug Fix(es) and Enhancement(s): [rhel-9] WARNING: possible recursive locking detected - vmd_enable_domain+0x757/0x910 [rhel-9.4.z] (JIRA:RHEL-174468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2454810 - CVE-2026-23455 kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() BZ - 2461503 - CVE-2026-31669 kernel: mptcp: fix slab-use-after-free in __inet_lookup_established BZ - 2467144 - CVE-2026-43128 kernel: RDMA/umem: Fix double dma_buf_unpin in failure path BZ - 2468124 - CVE-2026-43329 kernel: netfilter: flowtable: strictly check for maximum number of actions BZ - 2479492 - CVE-2026-46331 kernel: net/sched: act_pedit: extend the writable skb range per key BZ - 2480457 - CVE-2026-43501 kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows BZ - 2482166 - CVE-2026-45852 kernel: RDMA/rxe: Fix double free in rxe_srq_from_init BZ - 2482634 - CVE-2026-46173 kernel: exit: prevent preemption of oopsing TASK_DEAD task CVEs CVE-2026-23455 CVE-2026-31669 CVE-2026-43128 CVE-2026-43329 CVE-2026-43501 CVE-2026-45852 CVE-2026-46173 CVE-2026-46331 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM kernel-5.14.0-427.134.1.el9_4.src.rpm SHA-256: 2433bf4c0532325396f46cc2a1a86d8134cabdb2db9406a74e3e8240e911012a x86_64 bpftool-7.3.0-427.134.1.el9_4.x86_64.rpm SHA-256: 431354fb55f5d8f53ab95a9c1cd5c4b7b34b979f0f8b96ba1b6e60c61f9bee99 bpftool-debuginfo-7.3.0-427.134.1.el9_4.x86_64.rpm SHA-256: da58bc80860eefdfa378aec16efb82c05409f996ce809b042f92d9908af477fc bpftool-debuginfo-7.3.0-427.134.1.el9_4.x86_64.rpm SHA-256: da58bc80860eefdfa378aec16efb82c05409f996ce809b042f92d9908af477fc kernel-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 15ecff80d664cfb0e3153f04fa099999b5c94b986530c371e9f6f2fa9cdee839 kernel-abi-stablelists-5.14.0-427.134.1.el9_4.noarch.rpm SHA-256: ef088f3f19ff3e3f53ed2629c01e6a638e47f6a9351c69347eabc93934877496 kernel-core-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 7e63a45a378306d9825da40a26afd92e1be3ad92b5f8a956fba7f2e2005edebf kernel-debug-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: cbe68662c93cc8841760fcdfb54b91f49097c43a000410c3ecbc05d70055fd01 kernel-debug-core-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 76230b53bf1aa9184eb494fa83db37b7944b9e9b64f1d052062f84ded1f377ea kernel-debug-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: f0f5871001c4987cda01891f9db4668c1d17d4bfd5efce0e163d84da93b2b924 kernel-debug-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: f0f5871001c4987cda01891f9db4668c1d17d4bfd5efce0e163d84da93b2b924 kernel-debug-devel-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 0b33bbc8ba88ef0eeb92c100e1cd4097a066de1dead23bd792e93a4e0f0e23f2 kernel-debug-devel-matched-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 9fedd4bccac4c946003908466e770bb726f218c9e105bf7138441f740f63aa1d kernel-debug-modules-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: dfdc4e658ce10a654e776effe7aab0c9c8784e669c4ed95ab12f22ccb61ca167 kernel-debug-modules-core-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 4c9dea44f4539dbedc353f707a18d1d1687ec38792ec93e17ceea383301e5755 kernel-debug-modules-extra-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 3e906ae92a4ef30faa5a41f8c7489d146bbeb2e48c14faa645db6b6a216b81a2 kernel-debug-uki-virt-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: f0f49a43f1e0d9c16d887f43f52ba94a1d36c8b89fb1ef1fc8fd394a809fd2e3 kernel-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 9c6ae1ec8440f2c535a6e7932f419f9db1edbdd3907088b3f6bd800053dac72d kernel-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 9c6ae1ec8440f2c535a6e7932f419f9db1edbdd3907088b3f6bd800053dac72d kernel-debuginfo-common-x86_64-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: fccf09fd783c1af85923f243d6ea65e09cb1e48398786fa16731f6e0ba0d344c kernel-debuginfo-common-x86_64-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: fccf09fd783c1af85923f243d6ea65e09cb1e48398786fa16731f6e0ba0d344c kernel-devel-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 85fb4ea2c31129a7559f1719fd9abee72c18a0037108cfe82b8846d552383041 kernel-devel-matched-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 099482f4b1bddf1d81fe6ef7eafbb72c17b390e29601c7d785e6bf27c7f58590 kernel-doc-5.14.0-427.134.1.el9_4.noarch.rpm SHA-256: 619d338dbd98c17b1dd1cdc9a08435a17eeab66c8cf79a6825a1c65ac8157953 kernel-headers-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 62bde8452088b81e8182299f5e8d073a55d542825e948432a5927d9bb69d84f2 kernel-modules-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 3c1aca80f7a68a11660833e06f681bbdb623d46775566ad4da22b5462d806557 kernel-modules-core-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 3e4e80643d91ffa117394a05cfc5d64e0e54ff9149782120d319df68c4a86330 kernel-modules-extra-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 619d275fd0c6701089218aa53744917e5d4302f70e16991b68e1292cc64ac51e kernel-rt-debug-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: d999eb427177ac1c07453bfc019590a76854a5a2448b2a249db915debb1e819f kernel-rt-debug-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: d999eb427177ac1c07453bfc019590a76854a5a2448b2a249db915debb1e819f kernel-rt-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 1889ed5070c4125204986e9584e0e633c256c94479cbe6bbc786f602a391ec62 kernel-rt-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 1889ed5070c4125204986e9584e0e633c256c94479cbe6bbc786f602a391ec62 kernel-tools-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 14712560bdc937c3932b53e4d10fac45be6eb460fbfb08405ed574554d18a47c kernel-tools-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: bf300c2c019adc9df92b7a95c3b88061491f8d41999523fc3d5f7ea3367694bf kernel-tools-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: bf300c2c019adc9df92b7a95c3b88061491f8d41999523fc3d5f7ea3367694bf kernel-tools-libs-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 7acd17a962c87c9f0ccd431cb952e5cafbe70772977d2c53168431b7f56456ca kernel-uki-virt-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 8340911df70fa0de716ffb1b1e9163f8ae31972332ec17e575f1631fbd5fcd98 libperf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 04959e54250a75fad6dbf5fc9a2c2f5ce9f2d84b1f609ccfe9274c71efa81d15 libperf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 04959e54250a75fad6dbf5fc9a2c2f5ce9f2d84b1f609ccfe9274c71efa81d15 perf-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 6aeb3304bda2de0942a83c39279c9d38740e35ed63201a545c6c6681ac3277f9 perf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 5e009d958eb5dc13b674d8763750f663183eb04691bda3688de9a213528b16a6 perf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 5e009d958eb5dc13b674d8763750f663183eb04691bda3688de9a213528b16a6 python3-perf-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 0679a6d59b90e243f3570e2aa2070edd683e610ae1326c4ad60ca6ac9628417d python3-perf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 7f9826a2facaecb10b5052722bb6fd207bb854270db3eb1b5f5405311796fd74 python3-perf-debuginfo-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 7f9826a2facaecb10b5052722bb6fd207bb854270db3eb1b5f5405311796fd74 rtla-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: d87842059390a0ab43aad908ddd001227d6bdf3268d145641ea97a535ffc6e22 rv-5.14.0-427.134.1.el9_4.x86_64.rpm SHA-256: 2b44b0552eec9f4808ffd827099afceeb2b1d49e96daf2d194cc404db62a93d4 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM kernel-5.14.0-427.134.1.el9_4.src.rpm SHA-256: 2433bf4c053232