RHSA-2026:59149HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update

Published
August 24, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (5)

CVE-2026-46227 →CVE-2026-64531 →CVE-2026-43499 →CVE-2026-45984 →CVE-2026-46116 →

📋 Description

CVE-2026-43499 — kernel: rtmutex: Use waiter::task instead of current in remove_waiter() CVE-2026-45984 — kernel: gfs2: Fix use-after-free in iomap inline data write path CVE-2026-46116 — kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete CVE-2026-46227 — kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL CVE-2026-64531 — kernel: net: openvswitch: reject oversized nested action attrs

🎯 Affected products8

  • Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-0:1-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-0:1-7.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-0:1-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-debuginfo-0:1-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-debuginfo-0:1-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-debugsource-0:1-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kpatch-patch-5_14_0-687_10_1-debugsource-0:1-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. If OVS is not required on a given system, unloading the openvswitch module (`modprobe -r openvswitch`) eliminates the attack surface entirely. For systems that require OVS but cannot patch immediately, the single most effective mitigation is disabling unprivileged user namespaces (`sysctluser.max_user_namespaces=0`), which blocks the primary path an unprivileged attacker uses to obtain CAP_NET_ADMIN and reach the vulnerable netlink interface. Standard kernel hardening (KASLR, SMEP, SMAP, kptr_restrict) is enabled by default on supported RHEL kernels and significantly increases exploitation complexity, but these controls are defense-in-depth and not a substitute for patching or removing the vulnerable module.

🔗 References (8)