RLSA-2026:67471

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

[rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:Rocky Linux-245035)
RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)
[Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)
[usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)
RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific

{
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:67471"
}

References

Credits

- Rocky Enterprise Software Foundation
- Red Hat

Affected packages

Rocky Linux:10 / kernel

Package

Name: kernel
Purl: pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10&epoch=0

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

0:6.12.0-211.55.1.el10_2

Database specific

Show details

{
    "yum_repository": "BaseOS"
}

Database specific

source

"https://storage.googleapis.com/resf-osv-data/RLSA-2026:67471.json"