RHSA-2026:95367HighCVSS 8.8

Red Hat Security Advisory: kernel security update

Published
November 5, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (8)

CVE-2026-72221 →CVE-2026-72222 →CVE-2026-74586 →CVE-2026-89488 →CVE-2026-90315 →CVE-2026-98974 →CVE-2026-64378 →CVE-2026-72080 →

📋 Description

CVE-2026-64378 — kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() CVE-2026-72080 — kernel: fs/resctrl: Fix use-after-free during unmount CVE-2026-72221 — kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race CVE-2026-72222 — kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback CVE-2026-74586 — kernel: sctp: clear new_transport when removing a peer CVE-2026-89488 — kernel: openvswitch: Fix CT limit teardown use-after-free CVE-2026-90315 — kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers CVE-2026-98974 — kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.74.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.74.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.74.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.74.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.74.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, disable the TLS handshake daemon if RPC-over-TLS is not required, or restrict NFS network access to trusted clients: 1. Stop and mask the TLS handshake service to prevent kernel TLS sessions: # systemctl stop tlshd.service # systemctl mask tlshd.service 2. Alternatively, restrict access to the NFS daemon (TCP port 2049) to trusted networks using firewalld: # firewall-cmd --permanent --zone=public --remove-service=nfs # firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet> # firewall-cmd --reload Caveats: Disabling tlshd prevents clients from establishing RPC connections secured by TLS, which may cause connection attempts requiring TLS transport security to fail. Restricting network access via firewalld blocks connections from non-allowlisted hosts. Warning: Reloading firewall configurations with 'firewall-cmd --reload' or stopping system services may momentarily disrupt existing network sessions and drop in-flight NFS requests. Workaround: To mitigate this issue on systems where the SCTP protocol is not needed, prevent the sctp kernel module from loading: 1. Add the module configuration to prevent loading: # echo "install sctp /bin/true" > /etc/modprobe.d/sctp-disable.conf 2. Unload the module from the active system if loaded: # modprobe -r sctp Warning: If the sctp module is currently in use, unloading will fail and a system reboot will be required to apply the changes. Disabling this module will cause any applications requiring SCTP networking functionality to fail. Workaround: To mitigate this vulnerability, prevent the openvswitch kernel module from loading on systems where Open vSwitch is not required: 1. Create a modprobe configuration file to disable the module: ``` echo "install openvswitch /bin/true" > /etc/modprobe.d/disable-openvswitch.conf ``` 2. If the module is already loaded, unload it: ``` modprobe -r openvswitch ``` Warning: Unloading the module or applying this configuration may require restarting services or rebooting the system if the module is currently in use. Caveat: Disabling the openvswitch module will prevent Open vSwitch from functioning and will break network connectivity in environments that depend on it, such as OpenShift Container Platform clusters utilizing OVN-Kubernetes or OpenShift SDN. Workaround: --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to restrict unprivileged access to XFS_IOC_EXCHANGE_RANGE and FICLONERANGE ioctls or mount XFS filesystems without exchange-range and reflink on multi-user boundaries: upgrade to the fixed Erlang/Kernel/Kernel Rt/Kpatch builds, which calculate new file sizes using exchange offsets and exchanged data lengths for TO_EOF operations and flush the page cache prior to range exchange, closing all 3 injection vectors (FICLONERANGE ioctl block sharing, XFS_IOC_EXCHANGE_RANGE ioctl with TO_EOF flag, direct pwrite overwrite bypassing copy-on-write). Until patched, this is only a concern on Linux deployments with XFS filesystems mounted with reflink and exchange-range features where unprivileged local users have file read and write access — Non-Linux platforms and filesystems without reflink and exchange-range enabled are unaffected — so restrict unprivileged user access to XFS volumes supporting reflink and exchange-range, monitor donor file creation in shared directories, and restrict read permissions on critical files to prevent block cloning. As a compensating measure, log XFS ioctl syscall invocations and suspicious file write events across the local filesystem using auditd, enforce SELinux in enforcing mode to provide MAC containment that limits domain transitions if shared files are altered, map local login users into restricted SELinux confined domains to limit execution privileges and post-exploitation capabilities, monitor with an EDR agent to detect suspicious local privilege escalation behaviors and unexpected writes to system files, use Falco or eBPF runtime security probes to detect anomalous FICLONERANGE and XFS_IOC_EXCHANGE_RANGE ioctl operations and file modifications in real time, and use AIDE or file integrity monitoring to detect unauthorized modifications to critical system binaries and configuration files. These controls limit blast radius and contain exploitation, but they do not fix the underlying file size exchange calculation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)

🔗 References (11)