RHSA-2026:82807HighCVSS 7.8

Red Hat Security Advisory: kernel security update

Published
October 14, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (9)

CVE-2026-68236 →CVE-2026-68278 →CVE-2026-68409 →CVE-2026-72318 →CVE-2026-80887 →CVE-2026-31678 →CVE-2026-68108 →CVE-2026-89811 →CVE-2026-63920 →

📋 Description

CVE-2026-31678 — kernel: openvswitch: defer tunnel netdev_put to RCU release CVE-2026-63920 — kernel: ipv6: validate extension header length before copying to cmsg CVE-2026-68108 — kernel: drm/amdgpu/vce: fix integer overflow in image size CVE-2026-68236 — kernel: drm/amd/display: set new_stream to NULL after release CVE-2026-68278 — kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation CVE-2026-68409 — kernel: wifi: mac80211: defer link RX stats percpu free to RCU CVE-2026-72318 — kernel: cifs: validate DFS referral string offsets CVE-2026-80887 — kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound CVE-2026-89811 — kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

🎯 Affected products122

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bpftool-debuginfo-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • kernel-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.173.1.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-abi-stablelists-0:4.18.0-553.173.1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-core-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-0:4.18.0-553.173.1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.173.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.173.1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kernel-debug-core-0:4.18.0-553.173.1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • +92 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the openvswitch module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module. To blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content: ``` blacklist amdgpu ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use. Workaround: Prevent the 'drm_dp_mst' kernel module from loading to mitigate this vulnerability. This will disable DisplayPort Multi-Stream Transport functionality, which may affect multi-monitor setups using DisplayPort. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-drm_dp_mst.conf` with the following content: ``` blacklist drm_dp_mst ``` Then, regenerate the initramfs and reboot the system for the changes to take effect: ```bash drancut --force --kver $(uname -r) reboot ``` A system reboot is required for the module to be unloaded and the mitigation to be active. This may impact display functionality if DP MST is in use. Workaround: To mitigate this vulnerability, prevent the mac80211 kernel module from loading on systems where wireless networking is not required. 1. Create a configuration file to prevent the module from loading: ``` echo "install mac80211 /bin/true" > /etc/modprobe.d/disable-mac80211.conf echo "blacklist mac80211" >> /etc/modprobe.d/disable-mac80211.conf ``` 2. If the module is currently loaded, attempt to remove it: ``` modprobe -r mac80211 ``` Caveats: Disabling this module will disable wireless network interfaces relying on the mac80211 subsystem. Warning: If the mac80211 module is currently in use by active network hardware or dependent modules, unloading it will fail, and a system reboot is required for the configuration changes to take effect.

🔗 References (12)