RHSA-2026:85774HighCVSS 8.8

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Published
October 20, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (9)

CVE-2026-89479 →CVE-2026-89631 →CVE-2026-93288 →CVE-2026-93817 →CVE-2026-74752 →CVE-2026-98320 →CVE-2026-52935 →CVE-2026-53196 →CVE-2026-74588 →

📋 Description

CVE-2026-52935 — kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-53196 — kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() CVE-2026-74588 — kernel: sctp: keep chunk->transport in step with the list it is queued on CVE-2026-74752 — kernel: sctp: validate cookie AUTH state before use CVE-2026-89479 — kernel: sctp: stop processing a packet once its association is deleted CVE-2026-89631 — kernel: smb: client: reject a tree connect response whose byte count is too small CVE-2026-93288 — kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state CVE-2026-93817 — kernel: perf: Fix addr_filter_ranges lifetime CVE-2026-98320 — kernel: netfilter: flowtable: hold reference on ct until flow is released

🎯 Affected products32

  • Red Hat Enterprise Linux NFV (v. 8)
  • Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.176.1.rt7.517.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.176.1.rt7.517.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-core-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-core-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-kvm-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-devel-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-devel-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-kvm-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.176.1.rt7.517.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To prevent exploitation of this kernel vulnerability, the `sctp` module can be blacklisted. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the content `install sctp /bin/true` and `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot the system. This action will disable SCTP functionality; verify no critical services depend on it before implementation. A system reboot is required for the changes to take effect. Workaround: To mitigate this vulnerability, prevent the `sctp` kernel module from loading by creating a blacklist configuration as detailed below. [How do I prevent a kernel module from loading automatically?](https://access.redhat.com/solutions/41278) Note: Disabling the `sctp` module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied. Workaround: Prevent the cifs kernel module from loading if SMB/CIFS network share functionality is not required. 1. Add a configuration file to disable the module: # echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf 2. Unload the module if it is currently loaded: # modprobe -r cifs Caveats: Disabling the cifs module prevents mounting any CIFS or SMB network file shares. If the module is actively in use by mounted filesystems, it cannot be unloaded dynamically and a system reboot will be required for the configuration to take effect. If SMB connectivity is necessary, ensure systems only connect to trusted file servers. Workaround: Prevent the nfnetlink_log kernel module from being loaded by creating a configuration file: # echo "install nfnetlink_log /bin/true" > /etc/modprobe.d/disable-nfnetlink_log.conf If the module is currently loaded, attempt to unload it: # modprobe -r nfnetlink_log Caveats: If the module is in use, unloading it dynamically will fail, and a system reboot will be required for the configuration to take effect. Disabling nfnetlink_log prevents netfilter from logging packets via this netlink interface. Workaround: Restrict unprivileged access to the perf event subsystem by setting the `kernel.perf_event_paranoid` sysctl parameter. 1. Apply the setting immediately: ``` sysctl -w kernel.perf_event_paranoid=3 ``` 2. Persist the configuration across system reboots: ``` echo 'kernel.perf_event_paranoid = 3' > /etc/sysctl.d/99-perf.conf ``` Caveats: Setting `kernel.perf_event_paranoid` to 3 disables the use of the `perf_event_open()` system call for unprivileged users, preventing them from using performance monitoring tools such as `perf`. Only processes with `CAP_SYS_ADMIN` or `CAP_PERFMON` capabilities will be permitted to access performance events. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (13)