RHSA-2026:83156HighCVSS 8.8

Red Hat Security Advisory: kernel security update

Published
October 14, 2026
Last Modified
October 17, 2026

🔗 CVE IDs covered (18)

CVE-2026-93207 →CVE-2026-46319 →CVE-2026-53011 →CVE-2026-68140 →CVE-2026-68377 →CVE-2026-64030 →CVE-2026-68409 →CVE-2026-72262 →CVE-2026-74705 →CVE-2026-80985 →CVE-2026-93228 →CVE-2026-72320 →CVE-2026-81003 →CVE-2026-89526 →CVE-2026-68404 →CVE-2026-72288 →CVE-2026-74641 →CVE-2026-90036 →

📋 Description

CVE-2026-46319 — kernel: net/sched: act_ct: Only release RCU read lock after ct_ft CVE-2026-53011 — kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch CVE-2026-64030 — kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs CVE-2026-68140 — kernel: net/iucv: fix use-after-free of a severed iucv_path CVE-2026-68377 — kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key CVE-2026-68404 — kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect CVE-2026-68409 — kernel: wifi: mac80211: defer link RX stats percpu free to RCU CVE-2026-72262 — kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get CVE-2026-72288 — kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling CVE-2026-72320 — kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups CVE-2026-74641 — kernel: ALSA: usx2y: bound the hwdep mmap fault offset CVE-2026-74705 — kernel: udp: fix potential use-after-free in tunnel segmentation CVE-2026-80985 — kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry CVE-2026-81003 — kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device CVE-2026-89526 — kernel: svcrdma: Validate Read chunk positions before reconstruction CVE-2026-90036 — kernel: NFSD: Prevent client use-after-free during blocked-lock reaping CVE-2026-93207 — kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry CVE-2026-93228 — kernel: svcrdma: Reject Write/Reply chunks with segcount 0

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.58.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.58.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.58.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.58.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.58.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent module act_ct from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Linux kernel community recommends updating to a stable kernel release containing the fix (6.6.148, 6.12.101, 6.18.42, or 7.1.6 depending on the stable series); for Red Hat products, apply the kernel updates provided for the affected product streams. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, prevent the mac80211 kernel module from loading on systems where wireless networking is not required. 1. Create a configuration file to prevent the module from loading: ``` echo "install mac80211 /bin/true" > /etc/modprobe.d/disable-mac80211.conf echo "blacklist mac80211" >> /etc/modprobe.d/disable-mac80211.conf ``` 2. If the module is currently loaded, attempt to remove it: ``` modprobe -r mac80211 ``` Caveats: Disabling this module will disable wireless network interfaces relying on the mac80211 subsystem. Warning: If the mac80211 module is currently in use by active network hardware or dependent modules, unloading it will fail, and a system reboot is required for the configuration changes to take effect. Workaround: To mitigate this issue, prevent module snd-usb-usx2y and ALSA (Advanced Linux Sound Architecture) from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this vulnerability, prevent the Shared Memory Communications (`smc`) kernel module from loading on the system: 1. Add a configuration rule in `/etc/modprobe.d/` to disable autoloading: ``` echo "install smc /bin/true" >> /etc/modprobe.d/disable-smc.conf ``` 2. If the module is already loaded, attempt to unload it: ``` modprobe -r smc ``` Warning: Disabling this module prevents applications from establishing SMC (SMC-R/SMC-D) connections, which may cause them to fall back to standard TCP or fail if SMC is strictly required. If the module cannot be unloaded because it is currently in use, a full system reboot is necessary to enforce the mitigation. Workaround: To mitigate this vulnerability, prevent the `svcrdma` kernel module from being loaded by creating a configuration file in `/etc/modprobe.d/`: 1. Run the following command as root: # echo "install svcrdma /bin/true" > /etc/modprobe.d/disable-svcrdma.conf 2. If the module is currently loaded, unload it from memory: # modprobe -r svcrdma Warning: Attempting to unload the module while it is actively handling connections can disrupt active services. If the module cannot be safely unloaded at runtime, a system restart will be required to apply the changes. Caveats: Disabling the `svcrdma` module prevents the system from serving NFS or RPC traffic over RDMA transports. Standard NFS over TCP or UDP network interfaces is unaffected. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to kernel packages that contain the upstream fix resolves the issue; fixes have already shipped for some affected Red Hat Enterprise Linux streams and are being pursued for the remaining affected streams.

🔗 References (20)