RHSA-2026:68531HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
September 17, 2026
Last Modified
September 25, 2026

🔗 CVE IDs covered (22)

CVE-2026-63921 →CVE-2026-46306 →CVE-2026-53075 →CVE-2026-53176 →CVE-2026-53192 →CVE-2026-63917 →CVE-2026-43233 →CVE-2026-43339 →CVE-2026-53228 →CVE-2026-53268 →CVE-2026-64002 →CVE-2026-68426 →CVE-2026-52920 →CVE-2026-53131 →CVE-2026-53239 →CVE-2026-53275 →CVE-2026-68143 →CVE-2026-23103 →CVE-2026-31663 →CVE-2026-46266 →CVE-2026-53223 →CVE-2026-63919 →

📋 Description

CVE-2026-23103 — kernel: ipvlan: Make the addrs_lock be per port CVE-2026-31663 — kernel: xfrm: hold dev ref until after transport_finish NF_HOOK CVE-2026-43233 — kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() CVE-2026-43339 — kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() CVE-2026-46266 — kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP CVE-2026-46306 — kernel: flow_dissector: do not dissect PPPoE PFC frames CVE-2026-52920 — kernel: netfilter: xt_policy: fix strict mode inbound policy matching CVE-2026-53075 — kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls CVE-2026-53131 — kernel: netfilter: require Ethernet MAC header before using eth_hdr() CVE-2026-53176 — kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN CVE-2026-53192 — kernel: ALSA: timer: Fix UAF at snd_timer_user_params() CVE-2026-53223 — kernel: net: guard timestamp cmsgs to real error queue skbs CVE-2026-53228 — kernel: ipv6: sit: reload inner IPv6 header after GSO offloads CVE-2026-53239 — kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() CVE-2026-53268 — kernel: netfilter: conntrack_irc: fix possible out-of-bounds read CVE-2026-53275 — kernel: ipv6: mcast: Fix use-after-free when processing MLD queries CVE-2026-63917 — kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() CVE-2026-63919 — kernel: xfrm: input: hold netns during deferred transport reinjection CVE-2026-63921 — kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() CVE-2026-64002 — kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() CVE-2026-68143 — kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change CVE-2026-68426 — kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

🎯 Affected products122

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • kernel-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.164.1.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-abi-stablelists-0:4.18.0-553.164.1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.164.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.164.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.164.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.164.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +92 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent module ib_isert from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent module ip6_vti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this vulnerability, prevent the `slip` kernel module from loading if the SLIP protocol is not required. Create a file `/etc/modprobe.d/disable-slip.conf` with the content `blacklist slip`. Then, regenerate the initramfs using `dracut -f -v`. A system reboot is required for the changes to be fully applied. This action may impact systems relying on the SLIP protocol for network communication.

🔗 References (25)