Red Hat Product Errata RHSA-2026:23329 - Security Advisory Issued: 2026-06-04 Updated: 2026-06-04 RHSA-2026:23329 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2390372 - CVE-2025-38653 kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al BZ - 2424881 - CVE-2025-68366 kernel: nbd: defer config unlock in nbd_genl_connect BZ - 2461480 - CVE-2026-31613 kernel: smb: client: fix OOB reads parsing symlink error response BZ - 2464476 - CVE-2026-31709 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl BZ - 2468124 - CVE-2026-43329 kernel: netfilter: flowtable: strictly check for maximum number of actions BZ - 2468131 - CVE-2026-43322 kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete BZ - 2481486 - CVE-2026-46243 kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions CVEs CVE-2025-38653 CVE-2025-68366 CVE-2026-31613 CVE-2026-31709 CVE-2026-43322 CVE-2026-43329 CVE-2026-46243 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM kernel-6.12.0-211.20.1.el10_2.src.rpm SHA-256: 593ee19e0ad8554665bd67e6b6f033ee3995ae3ae1c118b8028c3c1c91da78c1 x86_64 kernel-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 6d360b1cba6efab5adee65459ed20dd023ea145a170391228581e4ed5ef57cd1 kernel-abi-stablelists-6.12.0-211.20.1.el10_2.noarch.rpm SHA-256: 90b135e7781936d00b830be08f36394b3a630e643cbce463e0fe22f7ba4900e8 kernel-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 58f27eba3ddcdeaa0bbd4d4e4241abd99e51d788395b222b7262faf366638263 kernel-debug-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4b71f85a0c04628a80f7c25f13f1c621f53e48ef80fbc6f56704a6d4d9e4e53c kernel-debug-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 451b3ac1d33a139788c9de204a2ffd4453de0c746e4af9dbfdb4809d6321a14d kernel-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4dacabbc36b7a41e174edae910d1e1378790f4ef30ff04a5d0a14cc447f5f0b9 kernel-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4dacabbc36b7a41e174edae910d1e1378790f4ef30ff04a5d0a14cc447f5f0b9 kernel-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4dacabbc36b7a41e174edae910d1e1378790f4ef30ff04a5d0a14cc447f5f0b9 kernel-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4dacabbc36b7a41e174edae910d1e1378790f4ef30ff04a5d0a14cc447f5f0b9 kernel-debug-devel-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 7b6c2474088989a4995c89284a1fe3d61a25387092d6cf8bd1f7158e9a7daf34 kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 23f5a30ccc44460d33c922596ed92ae156f3f4ef75b08aac91f45229ee04f625 kernel-debug-modules-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 29bf3158ed590eeb7becd56800b87692475d85e6f2a67b8d6e23a2d2eabac15d kernel-debug-modules-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: a2834ac0625862a0378904597dbb2c20acd6d352f65601792a123f6e15e87c82 kernel-debug-modules-extra-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: e2f6591a2b0fa41a75d39f4de0b9a723276215829e5f37ccdcd9291e31eae3d7 kernel-debug-uki-virt-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 68aa04d271af9e42b8b396c2b6fc953c041a6059de1d1ca4eb4902b5d4b35215 kernel-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: b6ee844441ea19cd041b34e2e77264ae1fafc33e2f79ce5f568aebc8ec2a8e0c kernel-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: b6ee844441ea19cd041b34e2e77264ae1fafc33e2f79ce5f568aebc8ec2a8e0c kernel-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: b6ee844441ea19cd041b34e2e77264ae1fafc33e2f79ce5f568aebc8ec2a8e0c kernel-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: b6ee844441ea19cd041b34e2e77264ae1fafc33e2f79ce5f568aebc8ec2a8e0c kernel-debuginfo-common-x86_64-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4577fae5c1a6dd45c3216541b90076bf199a8bbcd60f9180e717931cea62c170 kernel-debuginfo-common-x86_64-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4577fae5c1a6dd45c3216541b90076bf199a8bbcd60f9180e717931cea62c170 kernel-debuginfo-common-x86_64-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4577fae5c1a6dd45c3216541b90076bf199a8bbcd60f9180e717931cea62c170 kernel-debuginfo-common-x86_64-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 4577fae5c1a6dd45c3216541b90076bf199a8bbcd60f9180e717931cea62c170 kernel-devel-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: dfae9c3fd0bf62a0234e92cd4aec8167089bf6d3040529b69f7b4e00a4e9bea2 kernel-devel-matched-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 74c8639238aa703dc4e351d4a7057ab263063d4b596b00e831d47b679d979c7c kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm SHA-256: f38c6ae6822939f724b696969e39f43b7740a13468f11c579db1e3fb57ac55ed kernel-headers-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 077b7ab8d25aa5cf2d7ccca511561ec907b538dd7f21db08dbee45f6615a3f72 kernel-modules-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 02f474220cf254eef5d79113f7e5afcf90c32654167bf4ad5da430228f1df767 kernel-modules-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: eb5091b90f1afd17439205f90e11b19edd85a874ee041ba922c5120eb4fb5f39 kernel-modules-extra-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 210b2627d8d6ecc410eadce83cecb4ffd8512e3a34cb3eedb4637345c516d2ac kernel-modules-extra-matched-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 12b2dafa4e2e0cc3c4696326dc0125371a77d713597f6c5a7c33fca40467f260 kernel-rt-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: ff99b72cea05787815744fab42dbff466f8ff96b35e2effba79ad8955d55e0a0 kernel-rt-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: ff99b72cea05787815744fab42dbff466f8ff96b35e2effba79ad8955d55e0a0 kernel-rt-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 855c97fd8a7001c71cda0b29109fb12d2960b68de9a2948b4c645896f3a058b4 kernel-rt-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 855c97fd8a7001c71cda0b29109fb12d2960b68de9a2948b4c645896f3a058b4 kernel-rt-debug-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 97dd568e0499789a6bbff1b56aa8facb490441cfdf5b4c1a6d55e7e2bc42787c kernel-rt-debug-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 97dd568e0499789a6bbff1b56aa8facb490441cfdf5b4c1a6d55e7e2bc42787c kernel-rt-debug-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 02acdebdd54f8ec948fa5dd0be420a2762866fd18a858b3d5df017a33477c011 kernel-rt-debug-core-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 02acdebdd54f8ec948fa5dd0be420a2762866fd18a858b3d5df017a33477c011 kernel-rt-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 04b3b0efd192d098344345e13ce090b0e0b0b9fdfba783846557f9fbf73df5a1 kernel-rt-debug-debuginfo-6.12.0-211.20.1.el10_2.x86_64.rpm SHA-256: 04b3b0efd192d098344345e13ce090b0e0b0b9fdfba783846557f9fbf73df5a1 kernel