RHSA-2026:45115HighCVSS 7.0

Red Hat Security Advisory: kernel security update

Published
July 24, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (4)

CVE-2026-64561 →CVE-2025-40026 →CVE-2026-52993 →CVE-2026-53059 →

📋 Description

CVE-2025-40026 — kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O CVE-2026-52993 — kernel: tipc: fix double-free in tipc_buf_append() CVE-2026-53059 — kernel: dm log: fix out-of-bounds write due to region_count overflow CVE-2026-64561 — kernel: KVM: x86: Check for invalid/obsolete root after making MMU pages available

🎯 Affected products122

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • kernel-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.147.1.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-abi-stablelists-0:4.18.0-553.147.1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.147.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.147.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.147.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.147.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +92 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules: ``` options kvm-intel nested=0 options kvm-amd nested=0 ``` Use `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled. In OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example. https://access.redhat.com/solutions/6979679

🔗 References (6)