Red Hat Product Errata RHSA-2026:42919 - Security Advisory Issued: 2026-07-21 Updated: 2026-07-21 RHSA-2026:42919 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) kernel: fanotify: fix false positive on permission events (CVE-2026-46150) kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:RHEL-173103) tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-10.2.z] (JIRA:RHEL-183975) [RHEL10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z] (JIRA:RHEL-186311) ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:RHEL-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2429611 - CVE-2025-71113 kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc BZ - 2432366 - CVE-2025-71147 kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd BZ - 2439941 - CVE-2026-23168 kernel: flex_proportions: make fprop_new_period() hardirq safe BZ - 2460644 - CVE-2026-31530 kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() BZ - 2482523 - CVE-2026-46116 kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete BZ - 2482612 - CVE-2026-46150 kernel: fanotify: fix false positive on permission events BZ - 2482615 - CVE-2026-46215 kernel: drm: Set old handle to NULL before prime swap in change_handle BZ - 2492284 - CVE-2026-52976 kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() BZ - 2492318 - CVE-2026-52950 kernel: drm/xe/dma-buf: fix UAF with retry loop BZ - 2492390 - CVE-2026-53009 kernel: ice: fix double-free of tx_buf skb BZ - 2492458 - CVE-2026-53071 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp CVEs CVE-2025-71113 CVE-2025-71147 CVE-2026-23168 CVE-2026-31530 CVE-2026-46116 CVE-2026-46150 CVE-2026-46215 CVE-2026-52950 CVE-2026-52976 CVE-2026-53009 CVE-2026-53071 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM kernel-6.12.0-211.37.1.el10_2.src.rpm SHA-256: 47cc6b347fc09d355fd27bc7868457152267eaf59f3401964b1fee02dc3c9196 x86_64 kernel-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 42076ab60484da266c5d0ec6d61b85f4a03312cff1f30b4872486b56f560a357 kernel-abi-stablelists-6.12.0-211.37.1.el10_2.noarch.rpm SHA-256: 1bba786f509e0119f537ccc8a296d837da04684903f53c72d6660b2797326253 kernel-core-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: bc564496566b49cbd923df3438aacb34c89fe139c0c3e5e6f86605a50fc13642 kernel-debug-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 4a7c2fed5557aee7b1c51c4754dcf5a6aa28613f23ab9dd001bf71290a1ccefa kernel-debug-core-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 949acdef4e1ab1543de60309d00e146bef0b3b9d3acf0e0f6a8365c4ce6a7d77 kernel-debug-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 4197d88b814f1453ab92f4d4ec710c5a467d61c476d1cb0761fa5402c0e68ea3 kernel-debug-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 4197d88b814f1453ab92f4d4ec710c5a467d61c476d1cb0761fa5402c0e68ea3 kernel-debug-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 4197d88b814f1453ab92f4d4ec710c5a467d61c476d1cb0761fa5402c0e68ea3 kernel-debug-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 4197d88b814f1453ab92f4d4ec710c5a467d61c476d1cb0761fa5402c0e68ea3 kernel-debug-devel-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 0b3c9d3fbc50f7ae12fd05172362b90a4f5e341d7f00d2193416381c5ab5b35d kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 31022e9e785bb081cad80899f0cdcd7fcd841b2c60f2afc580c55f8c1ec02d93 kernel-debug-modules-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1ae7d96d7600d92832b5ccbc4994d49b89012d495a6f3d286aa53600e742a60b kernel-debug-modules-core-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 7f22b4ecd9ba8b6e4df08ab53c5d33ec892c96eb95cc489a2be85ca842db9ef6 kernel-debug-modules-extra-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 3dd131cff484d14f505dcfa245011204a2889685d43ddc718ecab2467904d537 kernel-debug-uki-virt-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1d8b11b797909133434deb117c7b5c66fd366e19641bfd1cfd10dfec573859a0 kernel-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1f5ad86bd2b0c53a9789f258d601abef7b45999958a159af050d3d55215a62f1 kernel-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1f5ad86bd2b0c53a9789f258d601abef7b45999958a159af050d3d55215a62f1 kernel-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1f5ad86bd2b0c53a9789f258d601abef7b45999958a159af050d3d55215a62f1 kernel-debuginfo-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 1f5ad86bd2b0c53a9789f258d601abef7b45999958a159af050d3d55215a62f1 kernel-debuginfo-common-x86_64-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: f6086143723ff8eaf07f1d820ddaa6b0ed84c05ecebcba4dcbfd9ee915abc176 kernel-debuginfo-common-x86_64-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: f6086143723ff8eaf07f1d820ddaa6b0ed84c05ecebcba4dcbfd9ee915abc176 kernel-debuginfo-common-x86_64-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: f6086143723ff8eaf07f1d820ddaa6b0ed84c05ecebcba4dcbfd9ee915abc176 kernel-debuginfo-common-x86_64-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: f6086143723ff8eaf07f1d820ddaa6b0ed84c05ecebcba4dcbfd9ee915abc176 kernel-devel-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: c9159f5f2c5bebd2166a0be0f39fd88f13fbc87b2115d3579a29723b68dd383e kernel-devel-matched-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 8cbfd9eab92ee296e8a651d3c579b53fb55e92847bab3141bc35716a90e55a9a kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm SHA-256: de94dfbee5b77238d61b52478e0f23b227e44160a79cb192279796754249cc71 kernel-headers-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 6963f4182a0f6f71452a9f3361b566853e154d4c9d9c71d928760c912558de41 kernel-modules-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 5ed3d7262dd741355a397d95b28d9cf1f1699641febd2e006fa43a845915ab0d kernel-modules-core-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 0af037e05096aae6f6ef4bb3257a4d3c312d8b6ecd398af68b042080a3e0f380 kernel-modules-extra-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: 6e0a014811110ea2a1c0cae948a0de69712018b5a8ccb6cfdd29b4d8e873b45b kernel-modules-extra-matched-6.12.0-211.37.1.el10_2.x86_64.rpm SHA-256: fc4f69d5253a98d5d57dca5c423a5b387c7366846557467b3a5