This Red Hat security advisory addresses multiple Important-severity kernel vulnerabilities, including a use-after-free in Bluetooth SCO (CVE-2026-31408) and an overflow in asymmetric key generation (CVE-2025-68724), which could lead to privilege escalation, denial of service, or information disclosure. For example, CVE-2025-38653 (CVSS 7.8) affects Linux kernel versions 6.0 to 6.1.147, 6.2 to 6.6.101, 6.7 to 6.12.41, and 6.13 to 6.15.9, and is fixed in versions 6.1.148, 6.6.102, 6.12.42, 6.15.10, and 6.16.1. The update requires a system reboot and applies to Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Errata RHSA-2026:39371 - Security Advisory Issued: 2026-07-14 Updated: 2026-07-14 RHSA-2026:39371 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2390372 - CVE-2025-38653 kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al BZ - 2422699 - CVE-2025-68183 kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr BZ - 2424886 - CVE-2025-68724 kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id BZ - 2455334 - CVE-2026-31408 kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold BZ - 2464369 - CVE-2026-43027 kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup BZ - 2467019 - CVE-2026-43074 kernel: eventpoll: defer struct eventpoll free to RCU grace period BZ - 2468061 - CVE-2026-43330 kernel: crypto: caam - fix overflow on long hmac keys BZ - 2468155 - CVE-2026-43414 kernel: scsi: qla2xxx: Completely fix fcport double free BZ - 2482523 - CVE-2026-46116 kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete BZ - 2482634 - CVE-2026-46173 kernel: exit: prevent preemption of oopsing TASK_DEAD task BZ - 2482654 - CVE-2026-46135 kernel: nvmet-tcp: fix race between ICReq handling and queue teardown BZ - 2483519 - CVE-2026-46242 kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF BZ - 2486982 - CVE-2026-46316 kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry BZ - 2497033 - CVE-2026-53359 kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role CVEs CVE-2025-38653 CVE-2025-68183 CVE-2025-68724 CVE-2026-31408 CVE-2026-43027 CVE-2026-43074 CVE-2026-43330 CVE-2026-43414 CVE-2026-46116 CVE-2026-46135 CVE-2026-46173 CVE-2026-46242 CVE-2026-46316 CVE-2026-53359 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM kernel-6.12.0-55.88.1.el10_0.src.rpm SHA-256: 8fc3c072687922b9504655278c84dbaa63f8ba80ce244fa88b3e2a07a6c8b03c x86_64 kernel-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: f8eff6ada8989fb0bcc925a6b3ecd6b72b2b0ccab84b4ee6e6cd31b3380d97e3 kernel-abi-stablelists-6.12.0-55.88.1.el10_0.noarch.rpm SHA-256: 607e116245d3cc8f2a589fbafeacae9c76ce13ff551deccbc2a0e78c976ac6c2 kernel-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b5ab8c8489b3f8e2daf83511f37a713c5288bdd10e54a764198104832e2b91dd kernel-debug-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: c36abe6e2752806f3980c4174cb4ae34ec3764ef86b03908a9a8e46031c75b10 kernel-debug-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 2b31c4b1c11256f8e8be867db437eae71755525f3bc297608edde3a7682b958f kernel-debug-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 18e4258843bec838120caec18007b71ef02d8aa01a6433f04026261b46ad999b kernel-debug-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 18e4258843bec838120caec18007b71ef02d8aa01a6433f04026261b46ad999b kernel-debug-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 18e4258843bec838120caec18007b71ef02d8aa01a6433f04026261b46ad999b kernel-debug-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 18e4258843bec838120caec18007b71ef02d8aa01a6433f04026261b46ad999b kernel-debug-devel-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b67efbcecc58cb7e46e403d2d6a13a574d9a78f73841cfaba6186aad4d9916bb kernel-debug-devel-matched-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: cadaeef2f9d2d897a8bffca8bfa61e7b8a27b80603251215284ba67a8588074b kernel-debug-modules-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: fe4f4c2887c539266954006e571101868a594f158e6c81e475017f6b0fdfd3d3 kernel-debug-modules-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 55898c035305b26d64da5dc3652a655706a77682c71e72afea9c738926aef22d kernel-debug-modules-extra-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: c75950b85a769dc2002a9a8793f87df6057cc99968ae7f3324c4588fa0b732b9 kernel-debug-uki-virt-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 1f818077ff57b25f4a558273083e7865c995e97d9e646735e2eb15cb8ad8301f kernel-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b26b1853b357874bc0ef765dc17ec7dd55005844a97561f8acce640abe302118 kernel-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b26b1853b357874bc0ef765dc17ec7dd55005844a97561f8acce640abe302118 kernel-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b26b1853b357874bc0ef765dc17ec7dd55005844a97561f8acce640abe302118 kernel-debuginfo-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b26b1853b357874bc0ef765dc17ec7dd55005844a97561f8acce640abe302118 kernel-debuginfo-common-x86_64-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b7027cb631f218e36d2e9a2f5eb8f16796243e943a081b79e5352cfd02a2e330 kernel-debuginfo-common-x86_64-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b7027cb631f218e36d2e9a2f5eb8f16796243e943a081b79e5352cfd02a2e330 kernel-debuginfo-common-x86_64-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b7027cb631f218e36d2e9a2f5eb8f16796243e943a081b79e5352cfd02a2e330 kernel-debuginfo-common-x86_64-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b7027cb631f218e36d2e9a2f5eb8f16796243e943a081b79e5352cfd02a2e330 kernel-devel-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: a56195b6cf23c65b2be59afd5b0bd989b0246bbaba97677f7f6feec5df9735ef kernel-devel-matched-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 2f1fa2a76fa93c9327c6b218157c5421542d9c1b14b92777d766725256f25ad6 kernel-doc-6.12.0-55.88.1.el10_0.noarch.rpm SHA-256: 45b17aeb9700425ba830320b5c4723a34a80cba79bcbfd461565c9de8e1afff9 kernel-headers-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: ddcfc96a6c9fa3ce6ed4ea6a8ba454daff09bdb80ea6ba11a83c4cf88046bf40 kernel-modules-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: b725bb55973727dbcb71eac66af7a7bf662f6f77d4ab16911a37c66837ad40bd kernel-modules-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: db07e9900a3cfaf033a130e9a62c0b04f7832a7b7e7157f77ce02cd4c1d1d0c2 kernel-modules-extra-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 1f34d0826b12f20f36022fd381646c6812a309db12066ff36d3bf6e6d25759b5 kernel-rt-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: df6256e8ed1dce3ffbab4986dafbd4dc524a0ba4245e033fdc890936c706c766 kernel-rt-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: df6256e8ed1dce3ffbab4986dafbd4dc524a0ba4245e033fdc890936c706c766 kernel-rt-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 53737a4edcc3d25eb535d53df7dea3838c1da54445cf5f8001213743cfe34d4d kernel-rt-core-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 53737a4edcc3d25eb535d53df7dea3838c1da54445cf5f8001213743cfe34d4d kernel-rt-debug-6.12.0-55.88.1.el10_0.x86_64.rpm SHA-256: 2a05345d78279e1d25b2baca628a2f0b3c1d1091bf5a23d9c5486d4b6c6fb76e kernel-rt-debug-6.12.0-55.88.1.el10_0.x86