RHSA-2026:90365HighCVSS 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 26, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (15)

CVE-2026-64523 →CVE-2026-68476 →CVE-2026-74515 →CVE-2026-93262 →CVE-2026-63978 →CVE-2024-57974 →CVE-2026-72242 →CVE-2026-80824 →CVE-2026-98320 →CVE-2026-63979 →CVE-2026-64266 →CVE-2026-89638 →CVE-2026-89777 →CVE-2026-98222 →CVE-2026-53388 →

📋 Description

CVE-2024-57974 — kernel: udp: Deal with race between UDP socket address change and rehash CVE-2026-53388 — kernel: fuse: re-lock request before replacing page cache folio CVE-2026-63978 — kernel: net/handshake: Drain pending requests at net namespace exit CVE-2026-63979 — kernel: net/handshake: hand off the pinned file reference to accept_doit CVE-2026-64266 — kernel: fuse: re-lock request before returning from fuse_ref_folio() CVE-2026-64523 — kernel: net/handshake: Take a long-lived file reference at submit CVE-2026-68476 — kernel: ipvs: reload ip header after head reallocation CVE-2026-72242 — kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() CVE-2026-74515 — kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled CVE-2026-80824 — kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() CVE-2026-89638 — kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions CVE-2026-89777 — kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure CVE-2026-93262 — kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() CVE-2026-98222 — kernel: KEYS: encrypted: fix integer overflow of datablob_len CVE-2026-98320 — kernel: netfilter: flowtable: hold reference on ct until flow is released

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.61.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.61.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.61.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.61.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.61.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mount SMB/CIFS shares with the `nosuid` mount option to prevent setuid and setgid binaries from executing with elevated permissions, or prevent the `cifs` module from loading if network SMB shares are not needed. 1. Apply `nosuid` to an active mount point: ``` mount -o remount,nosuid /path/to/cifs/mount ``` 2. Persist this setting by ensuring `nosuid` is present in the mount options within `/etc/fstab`: ``` //server/share /mnt/cifs cifs credentials=/etc/samba/creds,nosuid 0 0 ``` 3. Alternatively, if CIFS mounts are not required on the system, disable autoloading of the kernel module: ``` echo "install cifs /bin/true" > /etc/modprobe.d/cifs.conf ``` Caveats: Enforcing `nosuid` prevents any executable located on the mount point from running with elevated setuid or setgid privileges. Blacklisting the `cifs` module prevents all SMB/CIFS network file systems from mounting. Remounting filesystems can disrupt ongoing read and write operations. Workaround: Prevent the `raid456` kernel module from loading if software RAID 4, 5, or 6 functionality is not required. 1. Add the blacklist configuration by creating `/etc/modprobe.d/blacklist-raid456.conf` with the following entries: blacklist raid456 install raid456 /bin/true 2. Unload the module if it is currently loaded: # modprobe -r raid456 Warning: If software RAID 4, 5, or 6 is currently in use or required for storage arrays, this workaround cannot be applied, as disabling the module will prevent storage devices from functioning. A system reboot may be required if the module is actively in use by existing mounts.

🔗 References (18)