RHSA-2026:39179HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
July 14, 2026
Last Modified
July 28, 2026

🔗 CVE IDs covered (3)

CVE-2026-46086 →CVE-2026-46116 →CVE-2026-64600 →

📋 Description

CVE-2026-46086 — kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46116 — kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete CVE-2026-64600 — kernel: XFS data corruption using reflink

🎯 Affected products122

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • kernel-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.144.1.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-abi-stablelists-0:4.18.0-553.144.1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.144.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.144.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.144.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +92 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below: 1. Install and configure SystemTap Install the SystemTap package and its dependencies following the instructions at: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap 2. Create the mitigation script Create a file named `refluxfs_mitigation.stp` with the following contents: ~~~ probe begin { printf("refluxfs mitigation loaded\n") } probe module("xfs").function("xfs_file_remap_range").call { $remap_flags = 0xffff } probe module("xfs").function("xfs_file_remap_range").return { $return = -95 } probe end { printf("refluxfs mitigation unloaded\n") } ~~~ 3. Load the mitigation As the `root` user, execute SystemTap in guru mode: ~~~ stap -g refluxfs_mitigation.stp ~~~ Once the script is compiled and loaded, the following message will appear: ~~~ refluxfs mitigation loaded ~~~ With the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall. Important considerations: 1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the "Sign a SystemTap module" section of: https://www.redhat.com/en/blog/secure-boot-systemtap 2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied. 3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux.

🔗 References (6)