RHSA-2026:81406HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 12, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (11)

CVE-2026-72289 →CVE-2026-43332 →CVE-2026-63925 →CVE-2026-64385 →CVE-2026-68123 →CVE-2026-72318 →CVE-2026-80521 →CVE-2026-89970 →CVE-2026-64191 →CVE-2026-64507 →CVE-2026-64508 →

📋 Description

CVE-2026-43332 — kernel: thermal: core: Fix thermal zone device registration error path CVE-2026-63925 — kernel: macsec: fix replay protection at XPN lower-PN wrap CVE-2026-64191 — kernel: i2c: stub: Reject I2C block transfers with invalid length CVE-2026-64385 — kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation CVE-2026-64507 — kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation CVE-2026-64508 — kernel: bpf: Support for hardening against JIT spraying CVE-2026-68123 — kernel: openvswitch: fix GSO userspace truncation underflow CVE-2026-72289 — kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it CVE-2026-72318 — kernel: cifs: validate DFS referral string offsets CVE-2026-80521 — kernel: af_unix: Unlink scc_entry in unix_del_edge() CVE-2026-89970 — kernel: nvmet-auth: Synchronize timeout work during SQ teardown

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue on systems where unprivileged BPF is enabled, configure the kernel to disallow unprivileged users from loading BPF programs. 1. Temporarily apply the configuration at runtime: # sysctl -w kernel.unprivileged_bpf_disabled=1 2. To make this setting persistent across system reboots, write the parameter to a sysctl configuration file: # echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/99-disable-unprivileged-bpf.conf # sysctl --system Caveats: Disabling unprivileged BPF prevents unprivileged user processes and unprivileged containers from loading BPF programs, which may impact non-root monitoring or tracing tools. Privileged accounts and processes retaining CAP_SYS_ADMIN or CAP_BPF are unaffected and can still load programs. Modifying this sysctl setting takes effect immediately and does not require a system restart or service reload. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server. 1. Create a modprobe configuration file to disable the module: # echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf 2. If the module is already loaded, remove it: # modprobe -r nvmet Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities. Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.

🔗 References (14)