RHSA-2026:71602HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
September 24, 2026
Last Modified
September 30, 2026

🔗 CVE IDs covered (22)

CVE-2026-46311 →CVE-2026-53005 →CVE-2026-68257 →CVE-2026-68266 →CVE-2025-71116 →CVE-2026-22984 →CVE-2026-53290 →CVE-2026-68267 →CVE-2025-40323 →CVE-2025-68285 →CVE-2026-46204 →CVE-2026-53203 →CVE-2026-68108 →CVE-2026-89481 →CVE-2026-23136 →CVE-2026-46230 →CVE-2026-64098 →CVE-2026-68121 →CVE-2026-68273 →CVE-2026-80714 →CVE-2026-22990 →CVE-2026-46199 →

📋 Description

CVE-2025-40323 — kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released CVE-2025-68285 — kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() CVE-2025-71116 — kernel: libceph: make decode_pool() more resilient against corrupted osdmaps CVE-2026-22984 — kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() CVE-2026-22990 — kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() CVE-2026-23136 — kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state CVE-2026-46199 — kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg CVE-2026-46204 — kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB CVE-2026-46230 — kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg CVE-2026-46311 — kernel: drm/amdgpu/userq: fix access to stale wptr mapping CVE-2026-53005 — kernel: af_unix: Drop all SCM attributes for SOCKMAP CVE-2026-53203 — kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl CVE-2026-53290 — kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close CVE-2026-64098 — kernel: drm/virtio: use uninterruptible resv lock for plane updates CVE-2026-68108 — kernel: drm/amdgpu/vce: fix integer overflow in image size CVE-2026-68121 — kernel: pppoe: reload header pointer after dev_hard_header() CVE-2026-68257 — kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation CVE-2026-68266 — kernel: drm/xe: Hold a dma-buf reference for imported BOs CVE-2026-68267 — kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists CVE-2026-68273 — kernel: drm/amdgpu: Fix context pstate override handling CVE-2026-80714 — kernel: ipvs: do not propagate one-packet flag to synced conns CVE-2026-89481 — kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.60.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.60.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.60.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.60.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-devel-matched-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-modules-0:6.12.0-211.60.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue and if Ceph not being used, then prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module. To blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content: ``` blacklist amdgpu ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: To mitigate this issue, prevent the `ip_vs` kernel module from loading. This can be achieved by creating a blacklist rule. Note that this may impact systems utilizing IPVS for load balancing. 1. Create a configuration file to blacklist the module: `echo "blacklist ip_vs" > /etc/modprobe.d/disable-ip_vs.conf` 2. Regenerate the initramfs to ensure the blacklist is applied at boot: `dracut -f -v` 3. Reboot the system for the changes to take effect: `reboot` Alternatively, if the module is currently loaded, it can be unloaded (if no dependencies exist): `rmmod ip_vs` However, a system reboot is recommended to ensure the module is not loaded on subsequent boots. Workaround: Prevent the nvme-tcp kernel module from loading if NVMe over TCP storage is not required on the system. 1. Add an entry to /etc/modprobe.d to prevent the module from loading: # echo "install nvme-tcp /bin/true" >> /etc/modprobe.d/disable-nvme-tcp.conf 2. If the module is currently loaded and not in use by any storage target, unload it: # modprobe -r nvme-tcp Caveats: Disabling this module prevents the system from connecting to NVMe over TCP block storage devices. Warning: Do not attempt to unload this module if active NVMe over TCP storage is mounted or in use, as doing so will cause I/O failure and potential data loss. If the module cannot be cleanly unloaded, a system restart is required for the change to take full effect. Additionally, restrict NVMe-oF connections to verified, trusted storage targets over isolated or encrypted network fabrics.

🔗 References (24)