RHSA-2026:81552HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
October 13, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (13)

CVE-2026-63925 →CVE-2026-68245 →CVE-2026-89811 →CVE-2026-89894 →CVE-2026-89970 →CVE-2026-46309 →CVE-2026-64507 →CVE-2026-64508 →CVE-2026-68123 →CVE-2026-68236 →CVE-2026-68278 →CVE-2026-72318 →CVE-2026-80887 →

📋 Description

CVE-2026-46309 — kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise CVE-2026-63925 — kernel: macsec: fix replay protection at XPN lower-PN wrap CVE-2026-64507 — kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation CVE-2026-64508 — kernel: bpf: Support for hardening against JIT spraying CVE-2026-68123 — kernel: openvswitch: fix GSO userspace truncation underflow CVE-2026-68236 — kernel: drm/amd/display: set new_stream to NULL after release CVE-2026-68245 — kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() CVE-2026-68278 — kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation CVE-2026-72318 — kernel: cifs: validate DFS referral string offsets CVE-2026-80887 — kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound CVE-2026-89811 — kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension CVE-2026-89894 — kernel: media: cx231xx: reject geometry changes while the VBI queue is busy CVE-2026-89970 — kernel: nvmet-auth: Synchronize timeout work during SQ teardown

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.57.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.57.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.57.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.57.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.57.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue on systems where unprivileged BPF is enabled, configure the kernel to disallow unprivileged users from loading BPF programs. 1. Temporarily apply the configuration at runtime: # sysctl -w kernel.unprivileged_bpf_disabled=1 2. To make this setting persistent across system reboots, write the parameter to a sysctl configuration file: # echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/99-disable-unprivileged-bpf.conf # sysctl --system Caveats: Disabling unprivileged BPF prevents unprivileged user processes and unprivileged containers from loading BPF programs, which may impact non-root monitoring or tracing tools. Privileged accounts and processes retaining CAP_SYS_ADMIN or CAP_BPF are unaffected and can still load programs. Modifying this sysctl setting takes effect immediately and does not require a system restart or service reload. Workaround: Prevent the 'drm_dp_mst' kernel module from loading to mitigate this vulnerability. This will disable DisplayPort Multi-Stream Transport functionality, which may affect multi-monitor setups using DisplayPort. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-drm_dp_mst.conf` with the following content: ``` blacklist drm_dp_mst ``` Then, regenerate the initramfs and reboot the system for the changes to take effect: ```bash drancut --force --kver $(uname -r) reboot ``` A system reboot is required for the module to be unloaded and the mitigation to be active. This may impact display functionality if DP MST is in use. Workaround: Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server. 1. Create a modprobe configuration file to disable the module: # echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf 2. If the module is already loaded, remove it: # modprobe -r nvmet Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities. Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.

🔗 References (16)