RHSA-2026:85321HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 19, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (17)

CVE-2026-31678 →CVE-2026-63801 →CVE-2026-63962 →CVE-2026-68117 →CVE-2026-68300 →CVE-2026-89633 →CVE-2026-98260 →CVE-2026-52917 →CVE-2026-63971 →CVE-2026-68162 →CVE-2026-68315 →CVE-2026-89631 →CVE-2026-52935 →CVE-2026-74588 →CVE-2026-74752 →CVE-2026-74509 →CVE-2026-98256 →

📋 Description

CVE-2026-31678 — kernel: openvswitch: defer tunnel netdev_put to RCU release CVE-2026-52917 — kernel: sctp: diag: reject stale associations in dump_one path CVE-2026-52935 — kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-63801 — kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done CVE-2026-63962 — kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() CVE-2026-63971 — kernel: sctp: fix race between sctp_wait_for_connect and peeloff CVE-2026-68117 — kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() CVE-2026-68162 — kernel: sctp: avoid auth_enable sysctl UAF during netns teardown CVE-2026-68300 — kernel: sctp: auth: verify auth requirement when auth_chunk is NULL CVE-2026-68315 — kernel: sctp: validate stream count in sctp_process_strreset_inreq() CVE-2026-74509 — kernel: Bluetooth: hci_sync: Fix advertising data UAFs CVE-2026-74588 — kernel: sctp: keep chunk->transport in step with the list it is queued on CVE-2026-74752 — kernel: sctp: validate cookie AUTH state before use CVE-2026-89631 — kernel: smb: client: reject a tree connect response whose byte count is too small CVE-2026-89633 — kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() CVE-2026-98256 — kernel: signal: Prevent exec() race CVE-2026-98260 — kernel: exec: Cleanup POSIX timers right after de_thread()

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.67.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.67.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.67.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.67.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.67.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the openvswitch module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the `bluetooth` service: ```bash systemctl stop bluetooth systemctl disable bluetooth ``` This action will prevent the Bluetooth stack from being active, thereby avoiding the vulnerable code path. A system reboot may be required for the changes to take full effect. Workaround: To prevent exploitation of this kernel vulnerability, the `sctp` module can be blacklisted. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the content `install sctp /bin/true` and `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot the system. This action will disable SCTP functionality; verify no critical services depend on it before implementation. A system reboot is required for the changes to take effect. Workaround: To mitigate this vulnerability, prevent the `sctp` kernel module from loading by creating a blacklist configuration as detailed below. [How do I prevent a kernel module from loading automatically?](https://access.redhat.com/solutions/41278) Note: Disabling the `sctp` module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied. Workaround: Prevent the cifs kernel module from loading if SMB/CIFS network share functionality is not required. 1. Add a configuration file to disable the module: # echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf 2. Unload the module if it is currently loaded: # modprobe -r cifs Caveats: Disabling the cifs module prevents mounting any CIFS or SMB network file shares. If the module is actively in use by mounted filesystems, it cannot be unloaded dynamically and a system reboot will be required for the configuration to take effect. If SMB connectivity is necessary, ensure systems only connect to trusted file servers. Workaround: Prevent the `cifs` kernel module from loading if mounting SMB network file shares is not required. 1. Create a configuration file to blacklist the module: ```text echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf ``` 2. If the module is currently loaded into memory, unload it: ```text modprobe -r cifs ``` Caveats: Disabling this module prevents the system from mounting remote CIFS and SMB file systems. If active SMB shares are in use, all shares must be unmounted before unloading the module, or a system restart is required to apply the changes.

🔗 References (21)