RHSA-2026:71700HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
September 25, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (17)

CVE-2026-46199 →CVE-2026-46204 →CVE-2026-31539 →CVE-2026-52912 →CVE-2026-53203 →CVE-2026-53290 →CVE-2026-68273 →CVE-2026-64098 →CVE-2026-68108 →CVE-2026-68121 →CVE-2026-68267 →CVE-2026-80714 →CVE-2026-68266 →CVE-2025-40323 →CVE-2026-46230 →CVE-2026-46311 →CVE-2026-68257 →

📋 Description

CVE-2025-40323 — kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released CVE-2026-31539 — kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available CVE-2026-46199 — kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg CVE-2026-46204 — kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB CVE-2026-46230 — kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg CVE-2026-46311 — kernel: drm/amdgpu/userq: fix access to stale wptr mapping CVE-2026-52912 — kernel: netfilter: nf_queue: hold bridge skb->dev while queued CVE-2026-53203 — kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl CVE-2026-53290 — kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close CVE-2026-64098 — kernel: drm/virtio: use uninterruptible resv lock for plane updates CVE-2026-68108 — kernel: drm/amdgpu/vce: fix integer overflow in image size CVE-2026-68121 — kernel: pppoe: reload header pointer after dev_hard_header() CVE-2026-68257 — kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation CVE-2026-68266 — kernel: drm/xe: Hold a dma-buf reference for imported BOs CVE-2026-68267 — kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists CVE-2026-68273 — kernel: drm/amdgpu: Fix context pstate override handling CVE-2026-80714 — kernel: ipvs: do not propagate one-packet flag to synced conns

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.52.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.52.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.52.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.52.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.52.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module. To blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content: ``` blacklist amdgpu ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: To mitigate this issue, prevent the `ip_vs` kernel module from loading. This can be achieved by creating a blacklist rule. Note that this may impact systems utilizing IPVS for load balancing. 1. Create a configuration file to blacklist the module: `echo "blacklist ip_vs" > /etc/modprobe.d/disable-ip_vs.conf` 2. Regenerate the initramfs to ensure the blacklist is applied at boot: `dracut -f -v` 3. Reboot the system for the changes to take effect: `reboot` Alternatively, if the module is currently loaded, it can be unloaded (if no dependencies exist): `rmmod ip_vs` However, a system reboot is recommended to ensure the module is not loaded on subsequent boots.

🔗 References (19)