This Red Hat security advisory addresses multiple Important-severity kernel vulnerabilities, including a critical (CVSS 9.8) out-of-bounds read in the SMB client (CVE-2026-46155) and a critical (CVSS 9.8) integer wraparound in the IPv6 IOAM subsystem (CVE-2026-43341) that could lead to denial of service or privilege escalation. The advisory provides patches for Red Hat Enterprise Linux 10 across all supported architectures, requiring a system reboot. For authoritative version ranges and specific fixed kernel versions for upstream Linux, refer to the NVD data provided for each CVE.
Red Hat Product Errata RHSA-2026:36541 - Security Advisory Issued: 2026-07-08 Updated: 2026-07-08 RHSA-2026:36541 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10.2.z] (JIRA:RHEL-162140) [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface [rhel-10.2.z] (JIRA:RHEL-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2467019 - CVE-2026-43074 kernel: eventpoll: defer struct eventpoll free to RCU grace period BZ - 2467113 - CVE-2026-43276 kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path BZ - 2468097 - CVE-2026-43341 kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill BZ - 2482660 - CVE-2026-46155 kernel: smb/client: fix out-of-bounds read in smb2_compound_op() BZ - 2483519 - CVE-2026-46242 kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF BZ - 2484477 - CVE-2026-46259 kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() CVEs CVE-2026-43074 CVE-2026-43276 CVE-2026-43341 CVE-2026-46155 CVE-2026-46242 CVE-2026-46259 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM kernel-6.12.0-211.31.1.el10_2.src.rpm SHA-256: 51ac5a58569aaa9f2a55ebfe8591454528976c181afaf93e94b170f5d3a442e0 x86_64 kernel-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 07716d85483f0b3622250ce6280a9eb308fcf47cd833784f4fe608e7be4722b2 kernel-abi-stablelists-6.12.0-211.31.1.el10_2.noarch.rpm SHA-256: d6aece694a1dfce25aca917f7fcf96ff7fab8db8642d329ae0127f628513903d kernel-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 251733ddeaee7fac44339d306f4c3edb05d8cc51a9a83262304f6d8f17b41ffd kernel-debug-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 772c51967fc7ffbb7310505cc777ee00bbd28482d2ed93902112b2e9733440db kernel-debug-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: d1a6b5621ffc39ffa785a54cbedf3c26c37888a397e82198f0b01564eef25f31 kernel-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 2ff0a8eb2dc2b020bd91a87b7fd0fa875f9aa78665ce7602179459a3f0440c48 kernel-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 2ff0a8eb2dc2b020bd91a87b7fd0fa875f9aa78665ce7602179459a3f0440c48 kernel-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 2ff0a8eb2dc2b020bd91a87b7fd0fa875f9aa78665ce7602179459a3f0440c48 kernel-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 2ff0a8eb2dc2b020bd91a87b7fd0fa875f9aa78665ce7602179459a3f0440c48 kernel-debug-devel-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 88321a09a342889527484c9d117f80f7fa75052a68a5572f580eddf34551ff33 kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 92b7d0ae74f793189f130cbd57609540d4e6ceb031eb72c29af52699eded6feb kernel-debug-modules-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c7419c34084e52e70485f9e2b9f3b7ecf4781b4375db13a249aa80693091e302 kernel-debug-modules-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: bcc410dd086261f35b70a25bb9b2071c6fecc49c13540ffab1c34359c9ebebd5 kernel-debug-modules-extra-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: ab0a0d41d01e0283a84f84497dd6c7ec45d3bcf886e954c3ffb44bbe8414969b kernel-debug-uki-virt-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c84c40f5211e25b0837b7d6b412bb974053e41623936d8f9ca7a45edc7cb138b kernel-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 16e01aab9f6a72ad5a4c72ac666e56d593d1f8b21a47b3bdf619c8c03c41e281 kernel-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 16e01aab9f6a72ad5a4c72ac666e56d593d1f8b21a47b3bdf619c8c03c41e281 kernel-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 16e01aab9f6a72ad5a4c72ac666e56d593d1f8b21a47b3bdf619c8c03c41e281 kernel-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 16e01aab9f6a72ad5a4c72ac666e56d593d1f8b21a47b3bdf619c8c03c41e281 kernel-debuginfo-common-x86_64-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 1f86da57246e7c2a2ec7ab75fb6dc762f8ffe3b36b2dcc5f7752b8ab8cc17fa9 kernel-debuginfo-common-x86_64-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 1f86da57246e7c2a2ec7ab75fb6dc762f8ffe3b36b2dcc5f7752b8ab8cc17fa9 kernel-debuginfo-common-x86_64-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 1f86da57246e7c2a2ec7ab75fb6dc762f8ffe3b36b2dcc5f7752b8ab8cc17fa9 kernel-debuginfo-common-x86_64-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 1f86da57246e7c2a2ec7ab75fb6dc762f8ffe3b36b2dcc5f7752b8ab8cc17fa9 kernel-devel-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 40c78c20a3c1bf696fa5b8419d18be75322d24aa9fd7e76f7265b20b237a1fb6 kernel-devel-matched-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 5562a654d284d7967bab4d78886fc71a0f46cdb339305994c9cc8a3a4d401f04 kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm SHA-256: ffc77fd86f0990ad37eddabf2233e3a35e6b53c393d7267128f2470ca70e2fa0 kernel-headers-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 3caaa56040e5e6c4125c040fe78ef4d54e4720d472ff9c4c94bcfbdf40335a61 kernel-modules-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 2a1ea096f1e0be77b6261d829b4e0f0a4449d30ddd5cb6221faf9a30202929f6 kernel-modules-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 37c7939290046d7676d29a3a8b5f53392b22ebe53dff6643d27009099c09a504 kernel-modules-extra-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 736da7cc72f43cb2fa075f91b735179c310140e7c2477cc39000540bb6865ec5 kernel-modules-extra-matched-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 179fddb0cf04557e95820e57d44a61dffe4c0ec20ebe254285a055d79825a234 kernel-rt-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c52627019ba1effa9576b6b83891586df62d7cd5fed5ce48b2d97fbc73d89310 kernel-rt-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c52627019ba1effa9576b6b83891586df62d7cd5fed5ce48b2d97fbc73d89310 kernel-rt-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c273941510581a21d8c50f1206c91b0d805deb1d18a0befe14275667e9cf875f kernel-rt-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: c273941510581a21d8c50f1206c91b0d805deb1d18a0befe14275667e9cf875f kernel-rt-debug-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: d2de7854f0b43d0bbda4cd31439918585a2e5b314d14f5068d2ecf17265d54a1 kernel-rt-debug-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: d2de7854f0b43d0bbda4cd31439918585a2e5b314d14f5068d2ecf17265d54a1 kernel-rt-debug-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 0e190d2ffee525f6b18380a5842619abf0ede5e922f1c980cf4d5da2d90525d8 kernel-rt-debug-core-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 0e190d2ffee525f6b18380a5842619abf0ede5e922f1c980cf4d5da2d90525d8 kernel-rt-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 9fff29d4ee585da8a6e8ae070bd53b72951a56d7b65da7c206e9ec2e16a6594a kernel-rt-debug-debuginfo-6.12.0-211.31.1.el10_2.x86_64.rpm SHA-256: 9fff29d