RHSA-2026:34094

Details:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)

• kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)

• kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)

• kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

• kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

• kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

• kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

• kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

• kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

Bug Fix(es) and Enhancement(s):

• iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.6.z] (JIRA:RHEL-172991)

• [rhel-9] WARNING: possible recursive locking detected - vmd_enable_domain+0x757/0x910 [rhel-9.6.z] (JIRA:RHEL-174469)

• RHEL9.4 - s390/mm: Add missing secure storage access fixups...