RHSA-2026:88477HighCVSS 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 23, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (18)

CVE-2026-64048 →CVE-2026-64266 →CVE-2026-64481 →CVE-2026-68278 →CVE-2026-89811 →CVE-2026-64572 →CVE-2026-68236 →CVE-2026-80590 →CVE-2026-80887 →CVE-2025-38147 →CVE-2026-68202 →CVE-2026-89791 →CVE-2026-93817 →CVE-2026-64114 →CVE-2026-68245 →CVE-2026-68448 →CVE-2026-80536 →CVE-2026-97493 →

📋 Description

CVE-2025-38147 — kernel: calipso: Don't call calipso functions for AF_INET sk. CVE-2026-64048 — kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot CVE-2026-64114 — kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 CVE-2026-64266 — kernel: fuse: re-lock request before returning from fuse_ref_folio() CVE-2026-64481 — kernel: ALSA: hda/cs35l41: Fix firmware load work teardown CVE-2026-64572 — kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path CVE-2026-68202 — kernel: ALSA: seq: close a re-opened queue timer in the destructor CVE-2026-68236 — kernel: drm/amd/display: set new_stream to NULL after release CVE-2026-68245 — kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() CVE-2026-68278 — kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation CVE-2026-68448 — kernel: ovl: check access to copy_file_range source with src mounter creds CVE-2026-80536 — kernel: xfs: bounds-check buffer log item's dirty bitmap CVE-2026-80590 — kernel: inet: frags: strip GSO state from fragments before reassembly CVE-2026-80887 — kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound CVE-2026-89791 — kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() CVE-2026-89811 — kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension CVE-2026-93817 — kernel: perf: Fix addr_filter_ranges lifetime CVE-2026-97493 — kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.68.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.68.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.68.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.68.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.68.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent module snd_seq from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue on systems that do not require AMD graphics hardware, prevent the amdgpu module from loading: 1. Create a configuration file in /etc/modprobe.d to disable the driver: # echo "install amdgpu /bin/true" > /etc/modprobe.d/disable-amdgpu.conf 2. If the amdgpu module is already loaded in the running kernel, a system reboot is required for the configuration to take effect. Warning: Disabling this module prevents the initialization of AMD graphics adapters, which disables graphical desktop environments, display output, and GPU acceleration on systems relying on AMD hardware. Workaround: Prevent the 'drm_dp_mst' kernel module from loading to mitigate this vulnerability. This will disable DisplayPort Multi-Stream Transport functionality, which may affect multi-monitor setups using DisplayPort. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-drm_dp_mst.conf` with the following content: ``` blacklist drm_dp_mst ``` Then, regenerate the initramfs and reboot the system for the changes to take effect: ```bash drancut --force --kver $(uname -r) reboot ``` A system reboot is required for the module to be unloaded and the mitigation to be active. This may impact display functionality if DP MST is in use. Workaround: To mitigate this issue, prevent module xfs from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, restrict the creation of unprivileged user namespaces. This can prevent unprivileged local users from exploiting the vulnerability via tap devices. To disable unprivileged user namespaces, set the kernel.unprivileged_userns_clone sysctl to 0: sysctl -w kernel.unprivileged_userns_clone=0 To make this change persistent across reboots, add the following line to a file in /etc/sysctl.d/, for example, /etc/sysctl.d/99-disable-userns.conf: kernel.unprivileged_userns_clone = 0 After modifying the sysctl configuration, apply the changes: sysctl --system Disabling unprivileged user namespaces may impact applications that rely on this feature, such as container runtimes or sandboxing tools. Workaround: To mitigate this vulnerability, prevent the vmwgfx kernel module from loading if VMware virtual graphics acceleration is not needed: 1. Create a configuration file to prevent the module from being loaded: # echo "install vmwgfx /bin/true" > /etc/modprobe.d/disable-vmwgfx.conf 2. If the module is currently loaded, reboot the system for the change to take effect: # reboot Warning: Disabling this module prevents VMware guest graphics acceleration and may impair graphical desktop environments running inside VMware virtual machines. A reboot is necessary if the driver is already active in memory. Workaround: Prevent the amdgpu kernel module from loading: 1. Create a configuration file to prevent module loading: # echo "install amdgpu /bin/true" > /etc/modprobe.d/disable-amdgpu.conf 2. Rebuild the initial RAM disk: # dracut -f Warning: A system reboot is required for this change to take effect if the driver is currently loaded. Disabling the amdgpu driver prevents graphical acceleration and GPU compute operations on systems with AMD graphics hardware, and display servers may fail or revert to basic framebuffer mode. Workaround: Restrict unprivileged access to the perf event subsystem by setting the `kernel.perf_event_paranoid` sysctl parameter. 1. Apply the setting immediately: ``` sysctl -w kernel.perf_event_paranoid=3 ``` 2. Persist the configuration across system reboots: ``` echo 'kernel.perf_event_paranoid = 3' > /etc/sysctl.d/99-perf.conf ``` Caveats: Setting `kernel.perf_event_paranoid` to 3 disables the use of the `perf_event_open()` system call for unprivileged users, preventing them from using performance monitoring tools such as `perf`. Only processes with `CAP_SYS_ADMIN` or `CAP_PERFMON` capabilities will be permitted to access performance events.

🔗 References (21)