This Red Hat security advisory addresses multiple critical kernel vulnerabilities, including a use-after-free in traffic control (act_ct) that can lead to denial of service or privilege escalation (CVE-2026-23270, CVSS 7.8 HIGH), a zero-length check flaw in netfilter's H.323 conntrack helper (CVE-2026-23455, CVSS 9.1 CRITICAL), and a slab-use-after-free in MPTCP (CVE-2026-31669, CVSS 9.8 CRITICAL). Affected Linux kernel versions are extensive; for example, CVE-2026-31669 affects versions from 5.12.1 through 5.15.202, 5.16 through 6.1.168, 6.2 through 6.6.134, and others, with fixes provided in versions 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, and 6.19.13. The update is rated Important and a system reboot is required for the patch to take effect.
Red Hat Product Errata RHSA-2026:35863 - Security Advisory Issued: 2026-07-06 Updated: 2026-07-06 RHSA-2026:35863 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) Bug Fix(es) and Enhancement(s): NVMe-FC: Panic during NVMe Controller Reset tests (JIRA:RHEL-178449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2448745 - CVE-2026-23270 kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation BZ - 2454810 - CVE-2026-23455 kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() BZ - 2461503 - CVE-2026-31669 kernel: mptcp: fix slab-use-after-free in __inet_lookup_established BZ - 2467215 - CVE-2026-43279 kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing BZ - 2467228 - CVE-2026-43198 kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() BZ - 2467234 - CVE-2026-43125 kernel: dlm: validate length in dlm_search_rsb_tree BZ - 2468124 - CVE-2026-43329 kernel: netfilter: flowtable: strictly check for maximum number of actions BZ - 2481980 - CVE-2026-46090 kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop BZ - 2482166 - CVE-2026-45852 kernel: RDMA/rxe: Fix double free in rxe_srq_from_init BZ - 2482532 - CVE-2026-46181 kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() CVEs CVE-2026-23270 CVE-2026-23455 CVE-2026-31669 CVE-2026-43125 CVE-2026-43198 CVE-2026-43279 CVE-2026-43329 CVE-2026-45852 CVE-2026-46090 CVE-2026-46181 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 SRPM kernel-4.18.0-477.150.1.el8_8.src.rpm SHA-256: de899e83ffa683daaa63fb36bf00d66293f0f8929b792b0c9f7d0d5fb7546544 x86_64 bpftool-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: f25f942242db993a719cd52085966576408df0d58d89eec893794ac15ce38f35 bpftool-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 6e9c008900fc97f04b4a6d7e087b0af42b15afba2184ecf6150d831cac1b9a57 kernel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 1106cf3e641efe0142fa3bcbb8861138004ce80a878bc5ff8dab2a3542431ea8 kernel-abi-stablelists-4.18.0-477.150.1.el8_8.noarch.rpm SHA-256: a3917422837ca48c80de5f1be848c1e328b665931b40eb5d720cbfc4b4a64721 kernel-core-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 1f951df4c76709010cdd754b5e9ac027ff7efc4cb500471cc841e74dc8424b8c kernel-cross-headers-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: e5a2c0cefbeb493d3a0f16c9be7aec977bcbd828bfa117626cec99f2d134774e kernel-debug-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 4736fecdff888615583bb0917675024b6c65949deb2e97f1d2c0b19b68c23a33 kernel-debug-core-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 6971e51efb83d05779d16ed8e34eb0c352857a8464a9f071282b1e46746501ef kernel-debug-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: b1d76c50d1b0ea1d5b6750dc3a1c1ba4a1150b6625964e4b6ebaad126d94a076 kernel-debug-devel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 913f319503a7951e6709c083d78965d656c9fe0be31812b788ab8dd35ff14319 kernel-debug-modules-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 30fbe288669764e06f134bcb0b6701228acdef418dfcc528f96a5f54df6b70f8 kernel-debug-modules-extra-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 94c05e62a1a98fc880384d670feedda82847ca8e97be4a73e48a307573fe531d kernel-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: fbeab2d679f3e9525db21b4ae6ad4be384761bbe4c42bbd235900b3471e7adb6 kernel-debuginfo-common-x86_64-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 8ecf82ff6578bdfa6d0d50a35dc55b59840cc14ac444ede51d56479008c265d1 kernel-devel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: d90dd4e3b8c76fd9c4a803fa5fb4d0fcbf1f7eaa52ebc7e1a0578cc30543d2fd kernel-doc-4.18.0-477.150.1.el8_8.noarch.rpm SHA-256: a4231bc64aff68d55ce366c038848255114de8a521496cfdfb45125732b5c119 kernel-headers-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 865aeb47555d77e7bc9c70b4d36cdf40aa2c7f8d7816117123c6617f1d2282d1 kernel-modules-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 373cb3afa81af623a917f7fe16949777a740630dfb78d2f500232f2824c4ba4f kernel-modules-extra-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 937fd6f915c35464650faf833ac8555bd312861b954a3d41c4e94a69506e8fe1 kernel-tools-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 18614804be247b6e2fbca5ca78cff4ba590ff0418fe789af3719f10f4bf594b2 kernel-tools-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 5980d47f3d9e0e629acab9e81a8673896a77c4a1e8adae09c2fcba5be7219a21 kernel-tools-libs-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 64ebcaf9d5f49447e1d5af6c9ada9a00443d5df15a87e04aef6d421d98f7809e perf-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 284675359093209682cd3e14a0637f3af2f1a5a8f31733ae9651151516602985 perf-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: d694990ba5ace39bf55766a9be719665c55845c095e62fbe1684fba7bcca9190 python3-perf-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 71d017a5e17e92fae838ec5d8760db92ae9202f649d05836a086e6623adb72d7 python3-perf-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 9db8cd9f45ca59b8e72a9822a2e6b540b3986a0aa64c82028cec90b30ed464af Red Hat Enterprise Linux Server - TUS 8.8 SRPM kernel-4.18.0-477.150.1.el8_8.src.rpm SHA-256: de899e83ffa683daaa63fb36bf00d66293f0f8929b792b0c9f7d0d5fb7546544 x86_64 bpftool-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: f25f942242db993a719cd52085966576408df0d58d89eec893794ac15ce38f35 bpftool-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 6e9c008900fc97f04b4a6d7e087b0af42b15afba2184ecf6150d831cac1b9a57 kernel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 1106cf3e641efe0142fa3bcbb8861138004ce80a878bc5ff8dab2a3542431ea8 kernel-abi-stablelists-4.18.0-477.150.1.el8_8.noarch.rpm SHA-256: a3917422837ca48c80de5f1be848c1e328b665931b40eb5d720cbfc4b4a64721 kernel-core-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 1f951df4c76709010cdd754b5e9ac027ff7efc4cb500471cc841e74dc8424b8c kernel-cross-headers-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: e5a2c0cefbeb493d3a0f16c9be7aec977bcbd828bfa117626cec99f2d134774e kernel-debug-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 4736fecdff888615583bb0917675024b6c65949deb2e97f1d2c0b19b68c23a33 kernel-debug-core-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 6971e51efb83d05779d16ed8e34eb0c352857a8464a9f071282b1e46746501ef kernel-debug-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: b1d76c50d1b0ea1d5b6750dc3a1c1ba4a1150b6625964e4b6ebaad126d94a076 kernel-debug-devel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 913f319503a7951e6709c083d78965d656c9fe0be31812b788ab8dd35ff14319 kernel-debug-modules-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 30fbe288669764e06f134bcb0b6701228acdef418dfcc528f96a5f54df6b70f8 kernel-debug-modules-extra-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 94c05e62a1a98fc880384d670feedda82847ca8e97be4a73e48a307573fe531d kernel-debuginfo-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: fbeab2d679f3e9525db21b4ae6ad4be384761bbe4c42bbd235900b3471e7adb6 kernel-debuginfo-common-x86_64-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 8ecf82ff6578bdfa6d0d50a35dc55b59840cc14ac444ede51d56479008c265d1 kernel-devel-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: d90dd4e3b8c76fd9c4a803fa5fb4d0fcbf1f7eaa52ebc7e1a0578cc30543d2fd kernel-doc-4.18.0-477.150.1.el8_8.noarch.rpm SHA-256: a4231bc64aff68d55ce366c038848255114de8a521496cfdfb45125732b5c119 kernel-headers-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 865aeb47555d77e7bc9c70b4d36cdf40aa2c7f8d7816117123c6617f1d2282d1 kernel-modules-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 373cb3afa81af623a917f7fe16949777a740630dfb78d2f500232f2824c4ba4f kernel-modules-extra-4.18.0-477.150.1.el8_8.x86_64.rpm SHA-256: 937fd6f915c35464650faf833ac8555bd312861b954a3d41c4e94a69506e8fe1 kern