Linux · Security advisory · July 8, 2026

RHSA-2026:36348: Security update for 12 packages

RHSA-2026:36348, released July 8, 2026, fixes 6 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0054

45th percentile

Priority of the 6 CVEs

Patch now 0
                                Urgent 1
                                High 5
                                Routine 0

Fixed package versions

Product	Release	Fixed in
kernel-rt	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-core	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug-core	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug-devel	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug-kvm	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug-modules	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-debug-modules-extra	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-devel	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-kvm	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-modules	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10
kernel-rt-modules-extra	RHEL 8	0:4.18.0-553.140.1.rt7.481.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2025-10263	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	9.3	0.0054	Exploitation Less Likely
High	CVE-2026-43198	tcp: fix potential race in tcp_v6_syn_recv_sock()	9.8	0.0030	None reported
High	CVE-2026-46209	kernel-uek-core: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1...	8.4	0.0014	None reported
High	CVE-2026-43450	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: f...	8.8	0.0013	None reported
High	CVE-2026-46259	linux: In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading...	8.4	0.0012	None reported
High	CVE-2026-46227	sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL	8.4	0.0010	None reported

Also fixes CVE-2025-10263

SUSE-SU-2026:22835-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 16.0
OPENSUSE-SU-2026:21388-1
dtb-aarch64, kernel-64kb, kernel-azure and 10 more on opensuse-leap 16.0
SUSE-SU-2026:2799-1
kernel-livepatch-SLE15-SP7-RT_Update_17 on sles 15.7
ELSA-2026-34911
kernel, kernel-abi-stablelists, kernel-core and 27 more on ol 10
KB5093998
Windows 11 Version 22H2 for ARM64-based Systems, Windows 11 Version 22H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems and 1 more
KB5094127
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems and 4 more
KB5095051
Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems
KB5094126
Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more

Vendor advisory

https://access.redhat.com/errata/RHSA-2026:36348

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo