A critical vulnerability (CVE-2026-43037, CVSS 9.8) in the Linux kernel's `ip6_tunnel` module requires clearing the `skb2->cb[]` buffer in the `ip4ip6_err()` function. The flaw affects Linux kernel versions from 2.6.22 through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.167, and 6.2 through 6.6.133. Red Hat has released critical live-patch updates for RHEL 8 systems running kernel-4.18.0-553, which provide the fix without requiring a full reboot.
Red Hat Product Errata RHSA-2026:28749 - Security Advisory Issued: 2026-06-24 Updated: 2026-06-24 RHSA-2026:28749 - Security Advisory Overview Updated Packages Synopsis Critical: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update Type/Severity Security Advisory: Critical Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-4.18.0-553.53.1.el8_10. Security Fix(es): kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Fixes BZ - 2464351 - CVE-2026-43037 kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() CVEs CVE-2026-43037 References https://access.redhat.com/security/updates/classification/#critical Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM kpatch-patch-4_18_0-553_109_1-1-4.el8_10.src.rpm SHA-256: 00a4e5e44d70076cc88258dc17f2d84f9ca2b50a9f87592a9497d6ad8db7f956 kpatch-patch-4_18_0-553_125_1-1-1.el8_10.src.rpm SHA-256: 24b6bc820e85eaecdf1eed74ca5558d57fed5035bb08995c4e9c8a0fd9886358 kpatch-patch-4_18_0-553_53_1-1-11.el8_10.src.rpm SHA-256: 1354bf862c2686551e6fd3348dca507ad0456846b11438cd64f4a5585a949c0b kpatch-patch-4_18_0-553_72_1-1-8.el8_10.src.rpm SHA-256: 3edebddd6aba652bd27c28684880c4d3b02f7c3e9caa27b1da0263a73900233f kpatch-patch-4_18_0-553_85_1-1-6.el8_10.src.rpm SHA-256: 99ee19c07bad5d5ffaa727a7574c2afd82b4d3cece2de94207574ee8ea261c3c x86_64 kpatch-patch-4_18_0-553_109_1-1-4.el8_10.x86_64.rpm SHA-256: b530bd64dfaab23e3842eb4b342711ed23088123105aca829cdde19e5e509bdf kpatch-patch-4_18_0-553_109_1-debuginfo-1-4.el8_10.x86_64.rpm SHA-256: 16003aafefa58a1a8e91e8f95077b8a399c321d05e3e4c4e52fc75518f310846 kpatch-patch-4_18_0-553_109_1-debugsource-1-4.el8_10.x86_64.rpm SHA-256: c90d7862f4e239a88d3bf3b21f37c00ace94c3c3e01f329deed80d84c6383332 kpatch-patch-4_18_0-553_125_1-1-1.el8_10.x86_64.rpm SHA-256: 3f82cc5a0def28409786d8d3206822afc0251bc083ebce4ecf5c5448dc05afa8 kpatch-patch-4_18_0-553_125_1-debuginfo-1-1.el8_10.x86_64.rpm SHA-256: 3c5548269c794f4bdc995c963c5687e66c6662a55e323c9abba6f7986d517553 kpatch-patch-4_18_0-553_125_1-debugsource-1-1.el8_10.x86_64.rpm SHA-256: a360c4433a8b0cd3dc60997b034d701c776fc7f31f7e989528e5f530e70356fb kpatch-patch-4_18_0-553_53_1-1-11.el8_10.x86_64.rpm SHA-256: 5afccf96f5386b20010cfe604d6ec6b3831ff11d0adff468272abc9aa9eb43ad kpatch-patch-4_18_0-553_53_1-debuginfo-1-11.el8_10.x86_64.rpm SHA-256: e017e8c1aa635d207c3b31e850701b7f11a1870a4502d7deb4a2f608c53c830c kpatch-patch-4_18_0-553_53_1-debugsource-1-11.el8_10.x86_64.rpm SHA-256: d3985b2c2a870bd6367d36ad2951da7d9efb616af0eed49839ab60ae7d2ce923 kpatch-patch-4_18_0-553_72_1-1-8.el8_10.x86_64.rpm SHA-256: f787337164af92ed5f46d67d45d1a2957c9bece6e2493c6cee1ecb0452fb78a3 kpatch-patch-4_18_0-553_72_1-debuginfo-1-8.el8_10.x86_64.rpm SHA-256: c3cabdc832f28408729a340ea43fefb56d7a2e4489de1bc90a08db0f9ecaf25d kpatch-patch-4_18_0-553_72_1-debugsource-1-8.el8_10.x86_64.rpm SHA-256: 90438e37eb334759a0a69c8f78a013c33903f64dbabc10a5d74a1d94c2700f1f kpatch-patch-4_18_0-553_85_1-1-6.el8_10.x86_64.rpm SHA-256: f7817a38b62421fd7fbbec751baf60916c6535809ec831e4f6dd2f7b1ac65d70 kpatch-patch-4_18_0-553_85_1-debuginfo-1-6.el8_10.x86_64.rpm SHA-256: d6ed41e1fcc81b65d495b09d16f9bc8584cd70db76c6978428cc3af60840cdc0 kpatch-patch-4_18_0-553_85_1-debugsource-1-6.el8_10.x86_64.rpm SHA-256: c17fc7fd1d48082d709138c6d76484cb75f4bf22846e578214d0a967f2f27b5c Red Hat Enterprise Linux for Power, little endian 8 SRPM kpatch-patch-4_18_0-553_109_1-1-4.el8_10.src.rpm SHA-256: 00a4e5e44d70076cc88258dc17f2d84f9ca2b50a9f87592a9497d6ad8db7f956 kpatch-patch-4_18_0-553_125_1-1-1.el8_10.src.rpm SHA-256: 24b6bc820e85eaecdf1eed74ca5558d57fed5035bb08995c4e9c8a0fd9886358 kpatch-patch-4_18_0-553_53_1-1-11.el8_10.src.rpm SHA-256: 1354bf862c2686551e6fd3348dca507ad0456846b11438cd64f4a5585a949c0b kpatch-patch-4_18_0-553_72_1-1-8.el8_10.src.rpm SHA-256: 3edebddd6aba652bd27c28684880c4d3b02f7c3e9caa27b1da0263a73900233f kpatch-patch-4_18_0-553_85_1-1-6.el8_10.src.rpm SHA-256: 99ee19c07bad5d5ffaa727a7574c2afd82b4d3cece2de94207574ee8ea261c3c ppc64le kpatch-patch-4_18_0-553_109_1-1-4.el8_10.ppc64le.rpm SHA-256: f0963b426c295560b43828c7f8dd76613c896f2dad36d7c2f3e968d336ab339a kpatch-patch-4_18_0-553_109_1-debuginfo-1-4.el8_10.ppc64le.rpm SHA-256: 224dc67cbd91401e87ff3b7f451514a268a54fdc44a28e31d52f17fd069b7989 kpatch-patch-4_18_0-553_109_1-debugsource-1-4.el8_10.ppc64le.rpm SHA-256: b742f0a1de961cb68000e59d0ded7c082e8034091573bfebf06b1bd05737036d kpatch-patch-4_18_0-553_125_1-1-1.el8_10.ppc64le.rpm SHA-256: 65bac01ba85705996b9849d155680bf62b68695b035ee21c5eb29d4777014450 kpatch-patch-4_18_0-553_125_1-debuginfo-1-1.el8_10.ppc64le.rpm SHA-256: a46d1f379882b63939c49413dcd297c5520cbaa05f6e6ffeb41bd4abfdb1b7c7 kpatch-patch-4_18_0-553_125_1-debugsource-1-1.el8_10.ppc64le.rpm SHA-256: d178b0bc1552a9fd93dcb291555757fae17c964c503ce4296ec75fe28107e2ab kpatch-patch-4_18_0-553_53_1-1-11.el8_10.ppc64le.rpm SHA-256: 3727033f3cbfa02b25b00c24a8aaeb16ba96f7a6ca7f54ae45b077d6fbfec0eb kpatch-patch-4_18_0-553_53_1-debuginfo-1-11.el8_10.ppc64le.rpm SHA-256: e4a785e235804f20e20cb380726796ff8c585c0f14058d8fe2f46839867fbaa8 kpatch-patch-4_18_0-553_53_1-debugsource-1-11.el8_10.ppc64le.rpm SHA-256: 3898bf71a563b4956d5b0ed14f6c22706ff8cd0898e8838b1a32d1869a5a47bc kpatch-patch-4_18_0-553_72_1-1-8.el8_10.ppc64le.rpm SHA-256: e38657d55fbdd4aca885b6c9d32fe46f265eb384f81beb85515e0e281982ff97 kpatch-patch-4_18_0-553_72_1-debuginfo-1-8.el8_10.ppc64le.rpm SHA-256: 8f0723463db26d2b92101721ee87570b51618f626cc77680ebc4343e2167c0cb kpatch-patch-4_18_0-553_72_1-debugsource-1-8.el8_10.ppc64le.rpm SHA-256: b410cf04d5307e0a2d10cb6e118aa6446a216848cb8d986a1d1243c59ef2d8a0 kpatch-patch-4_18_0-553_85_1-1-6.el8_10.ppc64le.rpm SHA-256: 227d5a562fa8015c6229204375bb47bd865cbe5e7de38035ce7eee3904d85809 kpatch-patch-4_18_0-553_85_1-debuginfo-1-6.el8_10.ppc64le.rpm SHA-256: 2c087b736016884f7fec0b996b73a9dd88655edc4924e935fbcd663ac0e00fd2 kpatch-patch-4_18_0-553_85_1-debugsource-1-6.el8_10.ppc64le.rpm SHA-256: bd0bdea0e05c649eda45bf33ca7e72e2dda32e0b285c0c795f7018b836f708e4 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM kpatch-patch-4_18_0-553_109_1-1-4.el8_10.src.rpm SHA-256: 00a4e5e44d70076cc88258dc17f2d84f9ca2b50a9f87592a9497d6ad8db7f956 kpatch-patch-4_18_0-553_125_1-1-1.el8_10.src.rpm SHA-256: 24b6bc820e85eaecdf1eed74ca5558d57fed5035bb08995c4e9c8a0fd9886358 kpatch-patch-4_18_0-553_53_1-1-11.el8_10.src.rpm SHA-256: 1354bf862c2686551e6fd3348dca507ad0456846b11438cd64f4a5585a949c0b kpatch-patch-4_18_0-553_72_1-1-8.el8_10.src.rpm SHA-256: 3edebddd6aba652bd27c28684880c4d3b02f7c3e9caa27b1da0263a73900233f kpatch-patch-4_18_0-553_85_1-1-6.el8_10.src.rpm SHA-256: 99ee19c07bad5d5ffaa727a7574c2afd82b4d3cece2de94207574ee8ea261c3c x86_64 kpatch-patch-4_18_0-553_109_1-1-4.el8_10.x86_64.rpm SHA-256: b530bd64dfaab23e3842eb4b342711ed23088123105aca829cdde19e5e509bdf kpatch-patch-4_18_0-553_109_1-debuginfo-1-4.el8_10.x86_64.rpm SHA-256: 16003aafefa58a1a8e91e8f95077b8a399c321d05e3e4c4e52fc75518f310846 kpatch-patch-4_18_0-553_109_1-debugsource-1-4.el8_10.x86_64.rpm SHA-256: c90d7862f4e239a88d3bf3b21f37c00ace94c3c3e01f329deed80d84c6383332 kpatch-patch-4_18_0-553_125_1-1-1.el8_10.x86_64.rpm SHA-256: 3f82cc5a0def28409786d8d3206822afc0251bc083ebce4ecf5c5448dc05afa8 kpatch-patch-4_18_0-553_125_1-debuginfo-1-1.el8_10.x86_64.rpm SHA-256: 3c5548269c794f4bdc995c963c5687e66c6662a55e323c9abba6f7986d517553 kpatch-patch-4_18_0-553_125_1-debugsource-1-1.el8_10.x86_64.rpm SHA-256: a360c4433a8b0cd3dc60997b034d701c776fc7f31f7e989528e5f530e70356fb kpatch-patch-4_18_0-553_53_1-1-11.el8_10.x86_64.rpm SHA-256: 5afccf96f5386b20010cfe604d6ec6b3831ff11d0adff468272abc9aa9eb43ad kpatch-patch-4_18_0-553_53_1-debuginfo-1-11.el8_10.x86_64.rpm SHA-256: e017e8c1aa635d207c3b31e850701b7f11a1870a4502d7deb4a2f608c53c830c kpatch-patch-4_18_0-553_53_1-debugsource-1-11.el8_10.x86_64.rpm SHA-256: d3985b2c2a870bd6367d36ad2951da7d9efb616af0eed49839ab60ae7d2ce923 kpatch-patch-4_18_0-553_72_1-1-8.el8_10.x86_64.rpm SHA-256: f787337164af92ed5f46d67d45d1a2957c9bece6e2493c6cee1ecb0452fb78a3 kpatch-patch-4_18_0-553_72_1-debuginfo-1-8.el8_10.x86_64.rpm SHA-256: c3cabdc832f28408729a340ea43fefb56d7a2e4489de1bc90a08db0f9ecaf25d kpatch-patch-4_18_0-553_72_1-debugsource-1-8.el8_10.x86_64.rpm SHA-256: 90438e37eb334759a0a69c8f78a013c33903f64dbabc10a5d74a1d94c2700f1f kpatch-patch-4_18_0-553_85_1-1-6.el8_10.x86_64.rpm SHA-256: f7817a38b62421fd7fbbec751baf60916c6535809ec831e4f6dd2f7b1ac65d70 kpatch-patch-4_18_0-553_85_1-debuginfo-1-6.el8_10.x86_64.rpm SHA-256: d6ed41e1fcc81b65d495b09d16f9bc8584cd70db76c6978428cc3af60840cdc0 kpatch-patch-4_18_0-553_85_1-debugsource-