RHSA-2026:83207HighCVSS 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 15, 2026
Last Modified
October 17, 2026

🔗 CVE IDs covered (20)

CVE-2026-68140 →CVE-2026-74641 →CVE-2026-89526 →CVE-2026-89689 →CVE-2026-93207 →CVE-2026-72262 →CVE-2026-74574 →CVE-2026-80985 →CVE-2026-53011 →CVE-2026-63899 →CVE-2026-63974 →CVE-2026-64030 →CVE-2026-64032 →CVE-2026-45859 →CVE-2026-68377 →CVE-2026-89894 →CVE-2026-90036 →CVE-2026-93228 →CVE-2026-46319 →CVE-2026-64162 →

📋 Description

CVE-2026-45859 — kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation CVE-2026-46319 — kernel: net/sched: act_ct: Only release RCU read lock after ct_ft CVE-2026-53011 — kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch CVE-2026-63899 — kernel: USB: serial: mxuport: fix memory corruption with small endpoint CVE-2026-63974 — kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close CVE-2026-64030 — kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs CVE-2026-64032 — kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port CVE-2026-64162 — kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() CVE-2026-68140 — kernel: net/iucv: fix use-after-free of a severed iucv_path CVE-2026-68377 — kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key CVE-2026-72262 — kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get CVE-2026-74574 — kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() CVE-2026-74641 — kernel: ALSA: usx2y: bound the hwdep mmap fault offset CVE-2026-80985 — kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry CVE-2026-89526 — kernel: svcrdma: Validate Read chunk positions before reconstruction CVE-2026-89689 — kernel: nfsd: don't free session slots that are still in use CVE-2026-89894 — kernel: media: cx231xx: reject geometry changes while the VBI queue is busy CVE-2026-90036 — kernel: NFSD: Prevent client use-after-free during blocked-lock reaping CVE-2026-93207 — kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry CVE-2026-93228 — kernel: svcrdma: Reject Write/Reply chunks with segcount 0

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.66.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.66.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.66.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.66.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.66.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent module act_ct from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, disable the Bluetooth service if it is not required. To disable the Bluetooth service: `sudo systemctl stop bluetooth` `sudo systemctl disable bluetooth` Alternatively, prevent the `bluetooth` kernel module from loading by creating a file `/etc/modprobe.d/bluetooth.conf` with the content `blacklist bluetooth`. Then, regenerate the initramfs using `sudo dracut -f -v`. A system reboot is required for the module blacklisting to take effect. Disabling Bluetooth may impact functionality that relies on Bluetooth connectivity. Workaround: If the Intel Ethernet PTP functionality is not required, the `idpf` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file. 1. Create a file named `/etc/modprobe.d/blacklist-idpf.conf` with the following content: ``` blacklist idpf install idpf /bin/true ``` 2. Regenerate the initramfs to ensure the blacklist is applied during boot: - For systems using Dracut: `dracut -f -v` - For systems using mkinitcpio: `mkinitcpio -P` 3. Reboot the system for the changes to take effect. This mitigation may impact systems that rely on Intel Ethernet PTP for time synchronization. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Linux kernel community recommends updating to a stable kernel release containing the fix (6.6.148, 6.12.101, 6.18.42, or 7.1.6 depending on the stable series); for Red Hat products, apply the kernel updates provided for the affected product streams. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The vulnerability resides in the `idxd` kernel module. If the Intel Data Streaming Accelerator (DSA) functionality is not actively used or required, the `idxd` module can be prevented from loading to mitigate this issue. To blacklist the module: 1. Create a new file `/etc/modprobe.d/blacklist-idxd.conf` with the following content: ``` blacklist idxd ``` 2. Regenerate the initramfs to ensure the blacklist takes effect on boot: ```bash sudo dracut -f -v ``` or for systems using `mkinitrd`: ```bash sudo mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r) ``` 3. Reboot the system for the changes to take effect. This mitigation may impact functionality that relies on the Intel Data Streaming Accelerator. If `idxd` functionality is required, this mitigation is not applicable. Workaround: To mitigate this issue, prevent module snd-usb-usx2y and ALSA (Advanced Linux Sound Architecture) from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this vulnerability, prevent the Shared Memory Communications (`smc`) kernel module from loading on the system: 1. Add a configuration rule in `/etc/modprobe.d/` to disable autoloading: ``` echo "install smc /bin/true" >> /etc/modprobe.d/disable-smc.conf ``` 2. If the module is already loaded, attempt to unload it: ``` modprobe -r smc ``` Warning: Disabling this module prevents applications from establishing SMC (SMC-R/SMC-D) connections, which may cause them to fall back to standard TCP or fail if SMC is strictly required. If the module cannot be unloaded because it is currently in use, a full system reboot is necessary to enforce the mitigation. Workaround: To mitigate this vulnerability, prevent the `svcrdma` kernel module from being loaded by creating a configuration file in `/etc/modprobe.d/`: 1. Run the following command as root: # echo "install svcrdma /bin/true" > /etc/modprobe.d/disable-svcrdma.conf 2. If the module is currently loaded, unload it from memory: # modprobe -r svcrdma Warning: Attempting to unload the module while it is actively handling connections can disrupt active services. If the module cannot be safely unloaded at runtime, a system restart will be required to apply the changes. Caveats: Disabling the `svcrdma` module prevents the system from serving NFS or RPC traffic over RDMA transports. Standard NFS over TCP or UDP network interfaces is unaffected. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to kernel packages that contain the upstream fix resolves the issue; fixes have already shipped for some affected Red Hat Enterprise Linux streams and are being pursued for the remaining affected streams.

🔗 References (23)