RHSA-2026:86033HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 20, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (15)

CVE-2026-80590 →CVE-2026-89633 →CVE-2026-98260 →CVE-2026-63974 →CVE-2026-64024 →CVE-2026-64114 →CVE-2026-52935 →CVE-2026-63962 →CVE-2026-64032 →CVE-2026-74509 →CVE-2026-93817 →CVE-2026-99999 →CVE-2026-31678 →CVE-2026-63899 →CVE-2026-64572 →

📋 Description

CVE-2026-31678 — kernel: openvswitch: defer tunnel netdev_put to RCU release CVE-2026-52935 — kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-63899 — kernel: USB: serial: mxuport: fix memory corruption with small endpoint CVE-2026-63962 — kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() CVE-2026-63974 — kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close CVE-2026-64024 — kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction CVE-2026-64032 — kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port CVE-2026-64114 — kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 CVE-2026-64572 — kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path CVE-2026-74509 — kernel: Bluetooth: hci_sync: Fix advertising data UAFs CVE-2026-80590 — kernel: inet: frags: strip GSO state from fragments before reassembly CVE-2026-89633 — kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() CVE-2026-93817 — kernel: perf: Fix addr_filter_ranges lifetime CVE-2026-98260 — kernel: exec: Cleanup POSIX timers right after de_thread() CVE-2026-99999 — kernel: ipv4: validate checksum_start before completing checksum

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.59.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.59.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.59.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.59.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.59.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the openvswitch module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: To mitigate this issue, disable the Bluetooth service if it is not required. To disable the Bluetooth service: `sudo systemctl stop bluetooth` `sudo systemctl disable bluetooth` Alternatively, prevent the `bluetooth` kernel module from loading by creating a file `/etc/modprobe.d/bluetooth.conf` with the content `blacklist bluetooth`. Then, regenerate the initramfs using `sudo dracut -f -v`. A system reboot is required for the module blacklisting to take effect. Disabling Bluetooth may impact functionality that relies on Bluetooth connectivity. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the `bluetooth` service: ```bash systemctl stop bluetooth systemctl disable bluetooth ``` This action will prevent the Bluetooth stack from being active, thereby avoiding the vulnerable code path. A system reboot may be required for the changes to take full effect. Workaround: To mitigate this issue, restrict the creation of unprivileged user namespaces. This can prevent unprivileged local users from exploiting the vulnerability via tap devices. To disable unprivileged user namespaces, set the kernel.unprivileged_userns_clone sysctl to 0: sysctl -w kernel.unprivileged_userns_clone=0 To make this change persistent across reboots, add the following line to a file in /etc/sysctl.d/, for example, /etc/sysctl.d/99-disable-userns.conf: kernel.unprivileged_userns_clone = 0 After modifying the sysctl configuration, apply the changes: sysctl --system Disabling unprivileged user namespaces may impact applications that rely on this feature, such as container runtimes or sandboxing tools. Workaround: Prevent the `cifs` kernel module from loading if mounting SMB network file shares is not required. 1. Create a configuration file to blacklist the module: ```text echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf ``` 2. If the module is currently loaded into memory, unload it: ```text modprobe -r cifs ``` Caveats: Disabling this module prevents the system from mounting remote CIFS and SMB file systems. If active SMB shares are in use, all shares must be unmounted before unloading the module, or a system restart is required to apply the changes. Workaround: Restrict unprivileged access to the perf event subsystem by setting the `kernel.perf_event_paranoid` sysctl parameter. 1. Apply the setting immediately: ``` sysctl -w kernel.perf_event_paranoid=3 ``` 2. Persist the configuration across system reboots: ``` echo 'kernel.perf_event_paranoid = 3' > /etc/sysctl.d/99-perf.conf ``` Caveats: Setting `kernel.perf_event_paranoid` to 3 disables the use of the `perf_event_open()` system call for unprivileged users, preventing them from using performance monitoring tools such as `perf`. Only processes with `CAP_SYS_ADMIN` or `CAP_PERFMON` capabilities will be permitted to access performance events.

🔗 References (19)