RHSA-2026:33486 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux for NVIDIA.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

A special build of the kernel packages for Red Hat Enterprise Linux for
NVIDIA.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

For detailed information on changes in this release, see the RHEL for NVIDIA Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

• BZ - 2460538 - CVE-2026-31431 kernel: crypto: algif_aead - Revert to operating out-of-place
• BZ - 2464351 - CVE-2026-43037 kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
• BZ - 2467771 - CVE-2026-43284 kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel
• BZ - 2477015 - CVE-2026-46300 kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel
• BZ - 2477802 - CVE-2026-46333 kernel: Read root-owned files as an unprivileged user
• BZ - 2481486 - CVE-2026-46243 kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions
• VOYAGER-10 - Backport kernel support for EGM
• VOYAGER-286 - Backport mm: Implement ECC handling for pfn with no struct page
• VOYAGER-488 - Backport iommu: Report effective PCIe ATS support status
• VOYAGER-75 - soc/tegra: pmc: Add support for Tegra410
• VOYAGER-83 - i3c support for T410 (Vera)
• VOYAGER-74 - soc/tegra: Use Arm SMCCC to get chip ID, revision, and platform info
• VOYAGER-240 - [Epic]: NVIDIA:Vera: arm64: Add workaround to convert MT_NORMAL_NC to Device-nGnRE
• VOYAGER-72 - Kernel support for Vera PMU
• VOYAGER-82 - i2c support for T410 (Vera)
• VOYAGER-89 - Allow ATS to be always on for certain ATS-capable devices
• VOYAGER-732 - [Epic]: Backport sched/fair: SMT-aware asymmetric CPU capacity
• VOYAGER-490 - Backport iommu/tegra241-cmdqv: Fix initialization and uAPI related to HYP_OWN
• VOYAGER-281 - Backport iommu/arm-smmu-v3: Introduce an RCU-protected invalidation array
• VOYAGER-256 - [Epic]: NVIDIA:Vera: Add support for FEAT_{LS64, LS64_V} and related tests
• VOYAGER-93 - Backport arm64 MPAM support
• VOYAGER-1034 - CVE-2026-43037 kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() [voyager-26.02]
• VOYAGER-222 - [Epic]: Backport soc/tegra: fuse: Do not register SoC device on ACPI boot - rhel-10.2
• VOYAGER-223 - [Epic]: Backport GPIO support for Tegra410 (Vera) - rhel-10.2
• VOYAGER-224 - [Epic]: NVIDIA:Kernel support for future arm64 CPU - RHEL 10.2
• VOYAGER-238 - [Epic]: NVIDIA:Backport gpio: tegra186: Simplify GPIO line name prefix handling - RHEL 10.2
• VOYAGER-6 - Backport VMM can handle guest SEA via KVM_EXIT_ARM_SEA
• VOYAGER-73 - Backport perf/arm_cspmu: Preparatory patches for NVIDIA T410 PMU
• VOYAGER-239 - [Epic]: NVIDIA:CPPC: Backport online CPU fixes - RHEL 10.2
• VOYAGER-418 - Backport iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate
• VOYAGER-419 - Backport iommu/arm-smmu-v3: Fix hitless STE update in nesting cases

CVEs

• CVE-2026-31431
• CVE-2026-43037
• CVE-2026-43284
• CVE-2026-43503
• CVE-2026-46243
• CVE-2026-46300
• CVE-2026-46333

References

• https://access.redhat.com/security/updates/classification/#critical
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_nvidia/