This Red Hat security advisory addresses multiple Important-severity vulnerabilities in the Linux kernel, including use-after-free flaws in traffic control (act_ct) and Bluetooth subsystems that can lead to denial of service or privilege escalation, buffer overflows in ALSA firewire and HID wacom drivers, and various other memory corruption and validation issues in netfilter, SMB client, and filesystem components. The advisory applies to Red Hat Enterprise Linux 8 for multiple architectures and requires a system reboot after applying the update. For specific impact, CVSS scores, and detailed remediation steps, refer to the individual CVE pages linked in the advisory.
Red Hat Product Errata RHSA-2026:21706 - Security Advisory Issued: 2026-05-28 Updated: 2026-05-28 RHSA-2026:21706 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347) kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2404105 - CVE-2025-39981 kernel: Bluetooth: MGMT: Fix possible UAFs BZ - 2422699 - CVE-2025-68183 kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr BZ - 2424879 - CVE-2025-68347 kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events BZ - 2429602 - CVE-2025-71116 kernel: libceph: make decode_pool() more resilient against corrupted osdmaps BZ - 2448594 - CVE-2026-23243 kernel: Linux kernel: Denial of service and memory corruption in RDMA umad BZ - 2448745 - CVE-2026-23270 kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation BZ - 2454810 - CVE-2026-23455 kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() BZ - 2455334 - CVE-2026-31408 kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold BZ - 2461107 - CVE-2026-31532 kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() BZ - 2461757 - CVE-2026-31684 kernel: net: sched: act_csum: validate nested VLAN headers BZ - 2461759 - CVE-2026-31685 kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets BZ - 2464369 - CVE-2026-43027 kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup BZ - 2464455 - CVE-2026-43020 kernel: Bluetooth: MGMT: validate LTK enc_size on load BZ - 2464462 - CVE-2026-43051 kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq BZ - 2464476 - CVE-2026-31709 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl BZ - 2467059 - CVE-2026-43163 kernel: md/bitmap: fix GPF in write_page caused by resize race BZ - 2467064 - CVE-2026-43190 kernel: netfilter: xt_tcpmss: check remaining length before reading optlen BZ - 2467210 - CVE-2026-43158 kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks CVEs CVE-2025-39981 CVE-2025-68183 CVE-2025-68347 CVE-2025-71116 CVE-2026-23243 CVE-2026-23270 CVE-2026-23455 CVE-2026-31408 CVE-2026-31532 CVE-2026-31684 CVE-2026-31685 CVE-2026-31709 CVE-2026-43020 CVE-2026-43027 CVE-2026-43051 CVE-2026-43158 CVE-2026-43163 CVE-2026-43190 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM kernel-4.18.0-553.126.1.el8_10.src.rpm SHA-256: 89f3a3f88369f8ebf7fbb227b0fbc1fa7357e22ee2c9707f06ac0118bb0ba8a9 x86_64 bpftool-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 53451a6882dea0ad8d222d0c3489e4bfe9b83edf36630c67f16e62ff09c58ffc bpftool-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 8687f0bde6abbc64e77a5381374b1bd4074c215cc888c97a202e84f2aa71420a kernel-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: b240aebbd766e6f976dbcc3993964a964c78b2a14582b6fa13db11c007c9ce19 kernel-abi-stablelists-4.18.0-553.126.1.el8_10.noarch.rpm SHA-256: 787a836f30d1cb350afac36ce9642ea4a16e1dc9c87b3d7533177a2341df358d kernel-core-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 4c699f4fdaefe7065e330af6548d1e94d3c729c49f55d98244a1d84b38d7c427 kernel-cross-headers-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: a4bc7a8beb9085cbb21cffc35156a5bc8b6c263c003b78fdfbfd2e633d520b19 kernel-debug-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 15c8753ad179c94057a6e50943542963ffb284578e484cb1450b80936b389551 kernel-debug-core-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 105dd7dc7bafd2459f61129defaecffddcbd817f841c0e679419a611fd4bfd16 kernel-debug-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: b90c66c47075bf0c0fa0f15be551525571aa5241a67888394b1f20d1d073a7fb kernel-debug-devel-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: a5f35bf3fa0a13583ff80d19bab9a6c6a32c92bb1649fe5ddc61c6652d0f2e3b kernel-debug-modules-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: be33e56ea6b05c05408e6a762d6f0088ba62e3e50fd62996cd127784a1f5942c kernel-debug-modules-extra-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 5b98fdfba0976a0e4a6a84b517e9187486cef87c9bb06ca3d154d7820b987b30 kernel-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 350a9056f38e861f7be18f1c04dd799a03f265ac26df487d8efa2c088c6e41d2 kernel-debuginfo-common-x86_64-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: a4c373f69e85a81ecbd67a5943ee57976d97cca2d5a5e6bafba43609a7e38e67 kernel-devel-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 48a84e44cf2f34cdef32836afc57656d1eb503204d47b6ae4b3b96f13601d3b2 kernel-doc-4.18.0-553.126.1.el8_10.noarch.rpm SHA-256: 60a281e1872afb8f3e1088944b67fddd362958c92ff74b1f97dd9b1ea8472db3 kernel-headers-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 99d09dc7ceb551ddf01562b42e5abd8d5b2d5363f8d0e07016b3edc3e086d7a6 kernel-modules-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: aa208782f6b1c6271e77363720e35b90c3ba3249a3dcfe1029eb4538d115b03d kernel-modules-extra-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 92b6cd5cce1cd60c4f1aed10f76fea35996042250c06c4d13cc08b744b9b377d kernel-tools-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 9399e59a6c0ef6acaf700b141046b0e07110a38c6c0eb929671c185b9a3f981c kernel-tools-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: c9d24ab2f7c6c2f08b40b2646e4aa17e7b20afeaa6c3f9ea7ae4d8b15c33a2b1 kernel-tools-libs-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 701e4ecba701c91d107cb6009773b040acbf0d1997ba52f141c6b80a22c0b076 perf-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 61858f67924fb37611917a647e171b2e0fd1dcad18490890079467161f1873e8 perf-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: cdaa81bde8a696258737b3e2428837763b6adafc48d78736558ddc0d32e01363 python3-perf-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: 12216b9492c91d5b5d5831f9e803cf0b054d3e4bcd38e2dd18619ca925a44efd python3-perf-debuginfo-4.18.0-553.126.1.el8_10.x86_64.rpm SHA-256: c8860acee75a943237f257c8483ccc9f32dc6af7cd74c656a45ca0f6edebdbe6 Red Hat Enterprise Linux for IBM z Systems 8 SRPM kernel-4.18.0-553.126.1.el8_10.src.rpm SHA-256: 89f3a3f88369f8ebf7fbb227b0fbc1fa7357e22ee2c9707f06ac0118bb0ba8a9 s390x bpftool-4.18.0-553.126.1.el8_10.s390x.rpm SHA-256: fe5cc29fb2fcd4261727ed82ba6e2eb559f7ccdfb57867ff9fec35cd036490fc bpftool-debuginfo-4.18.0-553.126.1.el8_10.s390x.rpm SHA-256: 66f14d02160b06430f994d63a21bbbc750810ae8ff056112637ce0639eb30f3e kernel-4.18.0-553.126.1.el8_10.s390x.rpm SHA-256: e5b597f2963d0e70a6a04b9d937ad5896bdfc74289b54581718b625bd67a93af kernel-abi-stablelists-4.18.0-553.126.1.el8_10.noarch.rpm SHA-256: 787a836f30d1cb350afac36ce9642ea4a16e1dc9c87b3d7533177a2341df358d kernel-core-4.18.0-553.126.1.el8_10.s390x.rpm SHA-256: c009aab6da3