RHSA-2026:41229HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
July 17, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (3)

CVE-2026-64600 →CVE-2026-46113 →CVE-2026-53359 →

📋 Description

CVE-2026-46113 — kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN CVE-2026-53359 — kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role CVE-2026-64600 — kernel: XFS data corruption using reflink

🎯 Affected products74

  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bpftool-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bpftool-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bpftool-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bpftool-debuginfo-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bpftool-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bpftool-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-0:4.18.0-477.154.1.el8_8.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-0:4.18.0-477.154.1.el8_8.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-abi-stablelists-0:4.18.0-477.154.1.el8_8.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-abi-stablelists-0:4.18.0-477.154.1.el8_8.noarch as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-core-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-core-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-core-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-debug-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-debug-core-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-core-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-core-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-debug-debuginfo-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • kernel-debug-devel-0:4.18.0-477.154.1.el8_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-devel-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • kernel-debug-devel-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • +44 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules: ``` options kvm-intel nested=0 options kvm-amd nested=0 ``` Use `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled. In OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example. https://access.redhat.com/solutions/6979679 Workaround: This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below: 1. Install and configure SystemTap Install the SystemTap package and its dependencies following the instructions at: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap 2. Create the mitigation script Create a file named `refluxfs_mitigation.stp` with the following contents: ~~~ probe begin { printf("refluxfs mitigation loaded\n") } probe module("xfs").function("xfs_file_remap_range").call { $remap_flags = 0xffff } probe module("xfs").function("xfs_file_remap_range").return { $return = -95 } probe end { printf("refluxfs mitigation unloaded\n") } ~~~ 3. Load the mitigation As the `root` user, execute SystemTap in guru mode: ~~~ stap -g refluxfs_mitigation.stp ~~~ Once the script is compiled and loaded, the following message will appear: ~~~ refluxfs mitigation loaded ~~~ With the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall. Important considerations: 1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the "Sign a SystemTap module" section of: https://www.redhat.com/en/blog/secure-boot-systemtap 2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied. 3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux.

🔗 References (6)