Multiple Vulnerabilities in Red Hat Linux Kernel Allow Code Execution
Summary
CERT-FR issued an advisory warning of multiple vulnerabilities in Red Hat Linux kernel affecting multiple product versions. Four CVEs are referenced: CVE-2025-71238, CVE-2026-23144, CVE-2026-23171, and CVE-2026-23204. The vulnerabilities expose affected systems to arbitrary code execution, privilege escalation, data confidentiality breaches, security policy bypass, and denial of service. Organizations using Red Hat Enterprise Linux or CodeReady Linux Builder on ARM 64, IBM z Systems, Power (little endian), and x86_64 architectures should apply vendor patches from RHSA-2026:8342.
What changed
CERT-FR published advisory CERTFR-2026-AVI-0452 disclosing multiple kernel-level vulnerabilities in Red Hat Linux products across ARM 64, IBM z Systems, Power, and x86_64 architectures. Four CVEs are in scope, exposing systems to arbitrary code execution, local privilege escalation, confidentiality breaches, and denial of service.
Organizations running affected Red Hat Enterprise Linux 10.0 or Red Hat CodeReady Linux Builder 10.0 versions should patch systems immediately using updates referenced in Red Hat security bulletin RHSA-2026:8342. System administrators and security teams should prioritize patching given the potential for remote exploitation leading to full system compromise.
What to do next
- Refer to Red Hat security bulletin RHSA-2026:8342 for patches
Archived snapshot
Apr 17, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 17 avril 2026 N° CERTFR-2026-AVI-0452 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Multiples vulnérabilités dans le noyau Linux de Red Hat
Gestion du document
| Référence | CERTFR-2026-AVI-0452 |
| Titre | Multiples vulnérabilités dans le noyau Linux de Red Hat |
| Date de la première version | 17 avril 2026 |
| Date de la dernière version | 17 avril 2026 |
| Source(s) | Bulletin de sécurité Red Hat RHSA-2026:8342 du 15 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risques
- Atteinte à la confidentialité des données
- Contournement de la politique de sécurité
- Déni de service
- Exécution de code arbitraire
- Élévation de privilèges
Systèmes affectés
- Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64
- Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x
- Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le
- Red Hat CodeReady Linux Builder for x8664 - Extended Update Support 10.0 x8664
- Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64
- Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x
- Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le
- Red Hat Enterprise Linux for x8664 - 4 years of updates 10.0 x8664
- Red Hat Enterprise Linux for x8664 - Extended Update Support 10.0 x8664
Résumé
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité Red Hat RHSA-2026:8342 du 15 avril 2026
- https://access.redhat.com/errata/RHSA-2026:8342
- Référence CVE CVE-2025-71238
- https://www.cve.org/CVERecord?id=CVE-2025-71238
- Référence CVE CVE-2026-23144
- https://www.cve.org/CVERecord?id=CVE-2026-23144
- Référence CVE CVE-2026-23171
- https://www.cve.org/CVERecord?id=CVE-2026-23171
- Référence CVE CVE-2026-23204
- https://www.cve.org/CVERecord?id=CVE-2026-23204
Gestion détaillée du document
- le 17 avril 2026 Version initiale
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.