RHSA-2026:77689HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 8, 2026
Last Modified
October 9, 2026

🔗 CVE IDs covered (14)

CVE-2026-72317 →CVE-2026-74744 →CVE-2026-89669 →CVE-2026-89690 →CVE-2026-23103 →CVE-2026-53360 →CVE-2026-53365 →CVE-2026-63970 →CVE-2026-89530 →CVE-2026-89663 →CVE-2026-53398 →CVE-2026-64035 →CVE-2026-64115 →CVE-2026-64162 →

📋 Description

CVE-2026-23103 — kernel: ipvlan: Make the addrs_lock be per port CVE-2026-53360 — kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53365 — kernel: vsock/virtio: fix zerocopy completion for multi-skb sends CVE-2026-53398 — kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup CVE-2026-63970 — kernel: vsock/virtio: bind uarg before filling zerocopy skb CVE-2026-64035 — kernel: igc: set tx buffer type for SMD frames CVE-2026-64115 — kernel: vsock/vmci: fix UAF when peer resets connection during handshake CVE-2026-64162 — kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() CVE-2026-72317 — kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker CVE-2026-74744 — kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev CVE-2026-89530 — kernel: svcrdma: Reject inline replies that overflow the pull-up buffer CVE-2026-89663 — kernel: nfsd: revoke copy-notify stateids before dropping their reference CVE-2026-89669 — kernel: nfsd: initialize copy-notify stateid before publishing it CVE-2026-89690 — kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.56.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.56.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.56.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.56.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.56.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module. Workaround: If confidential VMs are not in use, this vulnerability can be mitigated by disabling SEV-SNP support on the host, removing the attack surface entirely. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53360-mitigation.conf`. In that file, disable SEV-SNP for the `kvm_amd` kernel module: ``` options kvm_amd sev_snp=0 ``` To validate, read the file `/sys/module/kvm_amd/parameters/sev_snp`. This file should read `N` to indicate that the feature is disabled. If SEV-SNP cannot be disabled, run SEV-SNP hosts on isolated environments and restrict the ability to create SNP-enabled VMs to trusted tenants/administrators only. Workaround: The vulnerable code path is only reachable when using virtio-vsock with zerocopy transmit on virtual machines using the vhost-vsock or virtio-vsock transport. Systems that do not use VM socket communication (AF_VSOCK) are not affected. To prevent the vulnerable code path from being reached, the vhost_vsock kernel module can be unloaded and blacklisted if vsock functionality is not required: ``` modprobe -r vhost_vsock echo "blacklist vhost_vsock" > /etc/modprobe.d/vsock-blacklist.conf ``` Systems that rely on VM-to-host socket communication (e.g., QEMU guest agent communication) cannot use this mitigation and should prioritize applying the kernel fix. Workaround: If the Intel Ethernet PTP functionality is not required, the `idpf` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file. 1. Create a file named `/etc/modprobe.d/blacklist-idpf.conf` with the following content: ``` blacklist idpf install idpf /bin/true ``` 2. Regenerate the initramfs to ensure the blacklist is applied during boot: - For systems using Dracut: `dracut -f -v` - For systems using mkinitcpio: `mkinitcpio -P` 3. Reboot the system for the changes to take effect. This mitigation may impact systems that rely on Intel Ethernet PTP for time synchronization. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, disable the NFS server service or restrict access to trusted networks: 1. If the system does not require NFS server functionality, stop and disable the service: ``` systemctl stop nfs-server.service systemctl disable --now nfs-server.service ``` To prevent the kernel module from being automatically loaded, create a modprobe configuration: ``` echo "install nfsd /bin/true" > /etc/modprobe.d/disable-nfsd.conf ``` 2. If the NFS server must remain operational, restrict network access to port 2049 using firewalld to ensure only authorized clients can connect: ``` firewall-cmd --permanent --remove-service=nfs firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> firewall-cmd --permanent --zone=trusted --add-service=nfs firewall-cmd --reload ``` Caveats: Stopping the NFS server or blacklisting nfsd prevents all NFS exports. Applying firewall rules or disabling the service will disconnect active NFS clients and requires a firewall reload or service restart.

🔗 References (17)