RHSA-2026:77690HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 8, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (16)

CVE-2026-89669 →CVE-2026-53360 →CVE-2026-63970 →CVE-2026-64035 →CVE-2026-89663 →CVE-2026-53398 →CVE-2026-64115 →CVE-2026-89675 →CVE-2026-53365 →CVE-2026-74705 →CVE-2026-74744 →CVE-2026-89530 →CVE-2026-89690 →CVE-2026-23103 →CVE-2026-72317 →CVE-2026-89676 →

📋 Description

CVE-2026-23103 — kernel: ipvlan: Make the addrs_lock be per port CVE-2026-53360 — kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use CVE-2026-53365 — kernel: vsock/virtio: fix zerocopy completion for multi-skb sends CVE-2026-53398 — kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup CVE-2026-63970 — kernel: vsock/virtio: bind uarg before filling zerocopy skb CVE-2026-64035 — kernel: igc: set tx buffer type for SMD frames CVE-2026-64115 — kernel: vsock/vmci: fix UAF when peer resets connection during handshake CVE-2026-72317 — kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker CVE-2026-74705 — kernel: udp: fix potential use-after-free in tunnel segmentation CVE-2026-74744 — kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev CVE-2026-89530 — kernel: svcrdma: Reject inline replies that overflow the pull-up buffer CVE-2026-89663 — kernel: nfsd: revoke copy-notify stateids before dropping their reference CVE-2026-89669 — kernel: nfsd: initialize copy-notify stateid before publishing it CVE-2026-89675 — kernel: nfsd: fix UAF in async copy cancel and shutdown CVE-2026-89676 — kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY CVE-2026-89690 — kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.64.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.64.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.64.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.64.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.64.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module. Workaround: If confidential VMs are not in use, this vulnerability can be mitigated by disabling SEV-SNP support on the host, removing the attack surface entirely. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53360-mitigation.conf`. In that file, disable SEV-SNP for the `kvm_amd` kernel module: ``` options kvm_amd sev_snp=0 ``` To validate, read the file `/sys/module/kvm_amd/parameters/sev_snp`. This file should read `N` to indicate that the feature is disabled. If SEV-SNP cannot be disabled, run SEV-SNP hosts on isolated environments and restrict the ability to create SNP-enabled VMs to trusted tenants/administrators only. Workaround: The vulnerable code path is only reachable when using virtio-vsock with zerocopy transmit on virtual machines using the vhost-vsock or virtio-vsock transport. Systems that do not use VM socket communication (AF_VSOCK) are not affected. To prevent the vulnerable code path from being reached, the vhost_vsock kernel module can be unloaded and blacklisted if vsock functionality is not required: ``` modprobe -r vhost_vsock echo "blacklist vhost_vsock" > /etc/modprobe.d/vsock-blacklist.conf ``` Systems that rely on VM-to-host socket communication (e.g., QEMU guest agent communication) cannot use this mitigation and should prioritize applying the kernel fix. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, disable the NFS server service or restrict access to trusted networks: 1. If the system does not require NFS server functionality, stop and disable the service: ``` systemctl stop nfs-server.service systemctl disable --now nfs-server.service ``` To prevent the kernel module from being automatically loaded, create a modprobe configuration: ``` echo "install nfsd /bin/true" > /etc/modprobe.d/disable-nfsd.conf ``` 2. If the NFS server must remain operational, restrict network access to port 2049 using firewalld to ensure only authorized clients can connect: ``` firewall-cmd --permanent --remove-service=nfs firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> firewall-cmd --permanent --zone=trusted --add-service=nfs firewall-cmd --reload ``` Caveats: Stopping the NFS server or blacklisting nfsd prevents all NFS exports. Applying firewall rules or disabling the service will disconnect active NFS clients and requires a firewall reload or service restart. Workaround: If NFS server capabilities are not required on the system, stop and disable the NFS service: # systemctl stop nfs-server.service # systemctl disable nfs-server.service If the NFS server must remain enabled, restrict access to the NFS port (port 2049) to trusted network interfaces or authorized clients using firewalld: # firewall-cmd --permanent --remove-service=nfs # firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> # firewall-cmd --reload Caveat: Disabling the nfs-server service prevents all remote clients from mounting and accessing NFS shares hosted on the system. Warning: Stopping the nfs-server service or reloading firewall configurations will disrupt active network connections and terminate ongoing file transfer sessions.

🔗 References (19)