Red Hat alert RHSA-2026:27731-01 (kernel) [LWN.net]

An update for kernel is now available for Red Hat Enterprise Linux 10.0
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating
system.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of
service and privilege escalation (CVE-2025-38154)

* kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

* kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

* kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

* kernel: Linux kernel: Denial of Service in libceph OSD client due to
unreset sparse-read state (CVE-2026-23136)

* kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
(CVE-2026-31474)

* kernel: netfilter: ctnetlink: ensure safe access to master conntrack
(CVE-2026-43116)

* kernel: net/sched: act_pedit: extend the writable skb range per key
(CVE-2026-46331)

* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of
zerocopy skbs (CVE-2026-46323)

* kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
(CVE-2026-43501)

* kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list
(CVE-2026-45898)

* kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
SCTP_SENDALL (CVE-2026-46227)

* kernel: wifi: mac80211: remove station if connection prep fails
(CVE-2026-46125)

Bug Fix(es) and Enhancement(s):

* libceph: CEPH_CRYPTO_AES256KRB5 (--key-type aes256k) support [rhel-10.0.z]
(JIRA:RHEL-168933)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0
International License (https://creativecommons.org/licenses/by/4.0/). If you
distribute this content, or a modified version of it, you must provide
attribution to Red Hat Inc. and provide a link to the original.

Original: https://access.redhat.com/security/data/csaf/v2/advisories/2026/rhsa-2026_27731.json