Linux · Security advisory · January 17, 2026

RLSA-2026:0453: kernel security update

RLSA-2026:0453, released January 17, 2026, fixes 9 CVEs in kernel (version 0:6.12.0-124.27.1.el10_1). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0064
51st percentile

Priority of the 9 CVEs

Patch now 0 Urgent 0 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
kernelrocky 100:6.12.0-124.27.1.el10_1

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-40240 sctp: avoid NULL dereference when chunk data buffer is missing 8.6 0.0064 None reported
High CVE-2025-40176 tls: wait for pending async decryptions if tls_strp_msg_hold fails 9.8 0.0049 None reported
High CVE-2025-40277 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE 7.8 0.0025 None reported
High CVE-2025-39806 kernel-64k-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: H... 7.8 0.0024 None reported
High CVE-2025-68287 usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths 7.8 0.0023 None reported
High CVE-2025-39840 libperf: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: H... 7.8 0.0015 None reported
High CVE-2025-39843 mm: slub: avoid wake up kswapd in set_track_prepare 7.8 0.0012 None reported
High CVE-2025-39966 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: c... 7.8 0.0011 None reported
High CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver 7.8 0.0011 None reported
Showing 1 to 9 of 9 1