RHSA-2026:93412HighCVSS 9.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 1, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (18)

CVE-2026-53228 →CVE-2026-64303 →CVE-2026-68169 →CVE-2026-72083 →CVE-2026-74510 →CVE-2026-74582 →CVE-2026-80586 →CVE-2026-89603 →CVE-2026-98364 →CVE-2026-53270 →CVE-2026-74283 →CVE-2026-90011 →CVE-2026-98432 →CVE-2026-98466 →CVE-2026-93787 →CVE-2026-93827 →CVE-2026-98725 →CVE-2026-52929 →

📋 Description

CVE-2026-52929 — kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-53228 — kernel: ipv6: sit: reload inner IPv6 header after GSO offloads CVE-2026-53270 — kernel: ipvs: clear the svc scheduler ptr early on edit CVE-2026-64303 — kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path CVE-2026-68169 — kernel: mptcp: pm: userspace: fix use-after-free in get_local_id CVE-2026-72083 — kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE CVE-2026-74283 — kernel: tipc: require net admin for TIPCv2 netlink mutators CVE-2026-74510 — kernel: Bluetooth: mgmt: fix UAF in pair command cancellation CVE-2026-74582 — kernel: packet: use consistent hard_header_len in non-ring send paths CVE-2026-80586 — kernel: mptcp: options: reset DSS fields in case of unexpected size CVE-2026-89603 — kernel: entry: Fix seccomp bypass after ptrace with TSYNC CVE-2026-90011 — kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload CVE-2026-93787 — kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir CVE-2026-93827 — kernel: virtio-fs: avoid double-free on failed queue setup CVE-2026-98364 — kernel: xfrm: hold net_device reference under RCU in bundle creation CVE-2026-98432 — kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period CVE-2026-98466 — kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 CVE-2026-98725 — kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.64.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.64.1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.64.1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-687.64.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-devel-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-devel-matched-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-modules-0:5.14.0-687.64.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content: ``` install sctp /bin/true blacklist sctp ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this flaw on hosts that do not operate as storage target servers, prevent the LIO target kernel modules from loading: 1. Create a configuration file to prevent loading the target modules: # echo "install iscsi_target_mod /bin/true" > /etc/modprobe.d/disable-iscsi_target.conf # echo "install target_core_mod /bin/true" > /etc/modprobe.d/disable-target_core.conf 2. Stop the SCSI target daemon if active: # systemctl stop target.service Warning: Modifying kernel module loading or stopping target.service requires a service restart or system reboot, and will immediately interrupt active storage connections on systems acting as storage targets. If the machine must function as an iSCSI target, use network firewall rules to restrict access to the iSCSI target port (TCP port 3260) strictly to authorized initiator hosts. Workaround: Prevent the TIPC kernel module from loading if Transparent Inter-Process Communication is not explicitly required: 1. Create a configuration file to disable the module: # echo "install tipc /bin/true" > /etc/modprobe.d/disable-tipc.conf # echo "blacklist tipc" >> /etc/modprobe.d/disable-tipc.conf 2. Unload the module if it is currently loaded: # modprobe -r tipc Caveats: Disabling the tipc module will break applications and services that rely on TIPC for clustering or inter-process communication. Warning: If the tipc module is actively in use, running `modprobe -r` will fail and a system reboot is required for the configuration changes to take full effect. Workaround: To mitigate this vulnerability, disable the Bluetooth kernel module if Bluetooth functionality is not required. Create a file `/etc/modprobe.d/bluetooth-blacklist.conf` with the following content: ``` blacklist bluetooth install bluetooth /bin/true ``` Reboot the system for the changes to take effect. Disabling the Bluetooth module will remove all Bluetooth functionality from the system. Workaround: The vulnerability affects the Multipath TCP (MPTCP) feature in the Linux kernel. To mitigate this issue, MPTCP can be disabled by preventing the `mptcp` kernel module from loading. To disable the `mptcp` module: 1. Create a new file `/etc/modprobe.d/disable-mptcp.conf` with the following content: `install mptcp /bin/true blacklist mptcp` 2. Regenerate the initramfs to ensure the change takes effect on boot: `sudo dracut -f -v` 3. Reboot the system for the changes to take effect. Disabling MPTCP may impact network performance or functionality for applications that rely on Multipath TCP. Workaround: To mitigate this vulnerability, prevent the virtiofs kernel module from loading on the system if virtio-fs shared filesystems are not required. 1. Add a configuration rule to disable autoloading of the module: # echo "install virtiofs /bin/true" > /etc/modprobe.d/disable-virtiofs.conf 2. If the module is currently loaded, unload it: # modprobe -r virtiofs Warning: If virtiofs is in active use by mounted filesystems, unloading the module will fail. A system reboot may be required to completely unload the driver and ensure configuration changes take effect. Caveats: Disabling the virtiofs module prevents the guest system from mounting filesystems shared via virtio-fs from the hypervisor. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to revoke host stage-2 page-table mappings for per-CPU hypervisor stack memory during protected nVHE initialization: upgrade to Linux kernel 6.18.55, 7.2.9, 7.3 (or the fixed Kernel/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds), which walk each per-CPU hypervisor stack virtual address range using the ownership-transition walker to transfer pages out of host stage-2, closing all 2 injection vectors (host stage-2 hypervisor stack memory read, host stage-2 hypervisor stack memory modification). Until patched, this is only a concern on ARM64 Linux systems running protected KVM (pKVM / protected nVHE) mode — Non-ARM64 architectures and deployments without protected KVM mode enabled are unaffected — so Strictly limit root access and prevent privileged userspace processes from reading physical memory or interacting with debugging interfaces on the host. As a compensating measure, Enforce SELinux in enforcing mode to prevent privileged processes from accessing raw physical memory interfaces or debugging utilities capable of reading hypervisor stack pages and Enable Kernel Lockdown Mode to restrict privileged host userspace from reading or writing raw physical memory via /dev/mem and patching running kernel memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying hypervisor stack memory isolation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)

🔗 References (22)