RHSA-2026:91565HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 28, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (16)

CVE-2026-63978 →CVE-2026-64523 →CVE-2026-80824 →CVE-2026-74515 →CVE-2026-53236 →CVE-2026-64027 →CVE-2026-68338 →CVE-2026-72083 →CVE-2026-89638 →CVE-2026-89777 →CVE-2026-74631 →CVE-2026-53388 →CVE-2026-63979 →CVE-2026-64109 →CVE-2026-68136 →CVE-2026-93262 →

📋 Description

CVE-2026-53236 — kernel: tcp: restrict SO_ATTACH_FILTER to priv users CVE-2026-53388 — kernel: fuse: re-lock request before replacing page cache folio CVE-2026-63978 — kernel: net/handshake: Drain pending requests at net namespace exit CVE-2026-63979 — kernel: net/handshake: hand off the pinned file reference to accept_doit CVE-2026-64027 — kernel: net: shaper: rework the VALID marking (again) CVE-2026-64109 — kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() CVE-2026-64523 — kernel: net/handshake: Take a long-lived file reference at submit CVE-2026-68136 — kernel: net: gro: fix double aggregation of flush-marked skbs CVE-2026-68338 — kernel: net/packet: avoid fanout hook re-registration after unregister CVE-2026-72083 — kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE CVE-2026-74515 — kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled CVE-2026-74631 — kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice CVE-2026-80824 — kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() CVE-2026-89638 — kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions CVE-2026-89777 — kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure CVE-2026-93262 — kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush()

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.69.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.69.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.69.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.69.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.69.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw on hosts that do not operate as storage target servers, prevent the LIO target kernel modules from loading: 1. Create a configuration file to prevent loading the target modules: # echo "install iscsi_target_mod /bin/true" > /etc/modprobe.d/disable-iscsi_target.conf # echo "install target_core_mod /bin/true" > /etc/modprobe.d/disable-target_core.conf 2. Stop the SCSI target daemon if active: # systemctl stop target.service Warning: Modifying kernel module loading or stopping target.service requires a service restart or system reboot, and will immediately interrupt active storage connections on systems acting as storage targets. If the machine must function as an iSCSI target, use network firewall rules to restrict access to the iSCSI target port (TCP port 3260) strictly to authorized initiator hosts. Workaround: To mitigate this issue, prevent module smc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mount SMB/CIFS shares with the `nosuid` mount option to prevent setuid and setgid binaries from executing with elevated permissions, or prevent the `cifs` module from loading if network SMB shares are not needed. 1. Apply `nosuid` to an active mount point: ``` mount -o remount,nosuid /path/to/cifs/mount ``` 2. Persist this setting by ensuring `nosuid` is present in the mount options within `/etc/fstab`: ``` //server/share /mnt/cifs cifs credentials=/etc/samba/creds,nosuid 0 0 ``` 3. Alternatively, if CIFS mounts are not required on the system, disable autoloading of the kernel module: ``` echo "install cifs /bin/true" > /etc/modprobe.d/cifs.conf ``` Caveats: Enforcing `nosuid` prevents any executable located on the mount point from running with elevated setuid or setgid privileges. Blacklisting the `cifs` module prevents all SMB/CIFS network file systems from mounting. Remounting filesystems can disrupt ongoing read and write operations. Workaround: Prevent the `raid456` kernel module from loading if software RAID 4, 5, or 6 functionality is not required. 1. Add the blacklist configuration by creating `/etc/modprobe.d/blacklist-raid456.conf` with the following entries: blacklist raid456 install raid456 /bin/true 2. Unload the module if it is currently loaded: # modprobe -r raid456 Warning: If software RAID 4, 5, or 6 is currently in use or required for storage arrays, this workaround cannot be applied, as disabling the module will prevent storage devices from functioning. A system reboot may be required if the module is actively in use by existing mounts.

🔗 References (19)