RHSA-2026:98608HighCVSS 9.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 11, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (90)

CVE-2026-90036 →CVE-2026-93207 →CVE-2026-98222 →CVE-2026-63899 →CVE-2026-64481 →CVE-2026-72289 →CVE-2026-93228 →CVE-2026-63970 →CVE-2026-68236 →CVE-2026-89669 →CVE-2026-89791 →CVE-2026-93817 →CVE-2026-93827 →CVE-2026-98725 →CVE-2025-38147 →CVE-2026-68143 →CVE-2026-89811 →CVE-2026-53388 →CVE-2026-68108 →CVE-2026-89676 →CVE-2026-98256 →CVE-2024-57793 →CVE-2026-46076 →CVE-2026-53361 →CVE-2026-72083 →CVE-2026-74283 →CVE-2026-80536 →CVE-2026-89972 →CVE-2026-90008 →CVE-2026-53264 →CVE-2026-64162 →CVE-2026-68278 →CVE-2026-74509 →CVE-2026-80887 →CVE-2026-89689 →CVE-2026-89690 →CVE-2026-64115 →CVE-2026-74516 →CVE-2026-81003 →CVE-2026-89603 →CVE-2026-89675 →CVE-2026-89775 →CVE-2026-90011 →CVE-2026-93288 →CVE-2026-98260 →CVE-2026-53398 →CVE-2026-63962 →CVE-2026-68123 →CVE-2026-68202 →CVE-2026-89894 →CVE-2026-90227 →CVE-2026-93262 →CVE-2026-98974 →CVE-2026-31678 →CVE-2026-46176 →CVE-2026-46319 →CVE-2026-64303 →CVE-2026-68448 →CVE-2026-74705 →CVE-2026-98364 →CVE-2026-53011 →CVE-2026-64042 →CVE-2026-64266 →CVE-2026-72317 →CVE-2026-74574 →CVE-2026-89530 →CVE-2026-98432 →CVE-2026-68245 →CVE-2026-68377 →CVE-2026-74641 →CVE-2026-80824 →CVE-2025-38004 →CVE-2026-74746 →CVE-2026-64508 →CVE-2026-89631 →CVE-2026-89777 →CVE-2026-98320 →CVE-2026-43248 →CVE-2026-63794 →CVE-2026-64191 →CVE-2026-64507 →CVE-2026-74510 →CVE-2026-80921 →CVE-2026-89663 →CVE-2026-89970 →CVE-2024-57998 →CVE-2026-53365 →CVE-2026-80521 →CVE-2026-81000 →CVE-2026-89526 →

📋 Description

CVE-2024-57793 — kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors CVE-2024-57998 — kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() CVE-2025-38004 — kernel: can: bcm: add locking for bcm_op runtime updates CVE-2025-38147 — kernel: calipso: Don't call calipso functions for AF_INET sk. CVE-2026-31678 — kernel: openvswitch: defer tunnel netdev_put to RCU release CVE-2026-43248 — kernel: vhost: move vdpa group bound check to vhost_vdpa CVE-2026-46076 — kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 CVE-2026-46176 — kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() CVE-2026-46319 — kernel: net/sched: act_ct: Only release RCU read lock after ct_ft CVE-2026-53011 — kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch CVE-2026-53264 — kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle CVE-2026-53361 — kernel: af_unix: Set gc_in_progress to true in unix_gc() CVE-2026-53365 — kernel: vsock/virtio: fix zerocopy completion for multi-skb sends CVE-2026-53388 — kernel: fuse: re-lock request before replacing page cache folio CVE-2026-53398 — kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup CVE-2026-63794 — kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path CVE-2026-63899 — kernel: USB: serial: mxuport: fix memory corruption with small endpoint CVE-2026-63962 — kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() CVE-2026-63970 — kernel: vsock/virtio: bind uarg before filling zerocopy skb CVE-2026-64042 — kernel: vfio/pci: Check BAR resources before exporting a DMABUF CVE-2026-64115 — kernel: vsock/vmci: fix UAF when peer resets connection during handshake CVE-2026-64162 — kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() CVE-2026-64191 — kernel: i2c: stub: Reject I2C block transfers with invalid length CVE-2026-64266 — kernel: fuse: re-lock request before returning from fuse_ref_folio() CVE-2026-64303 — kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path CVE-2026-64481 — kernel: ALSA: hda/cs35l41: Fix firmware load work teardown CVE-2026-64507 — kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation CVE-2026-64508 — kernel: bpf: Support for hardening against JIT spraying CVE-2026-68108 — kernel: drm/amdgpu/vce: fix integer overflow in image size CVE-2026-68123 — kernel: openvswitch: fix GSO userspace truncation underflow CVE-2026-68143 — kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change CVE-2026-68202 — kernel: ALSA: seq: close a re-opened queue timer in the destructor CVE-2026-68236 — kernel: drm/amd/display: set new_stream to NULL after release CVE-2026-68245 — kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() CVE-2026-68278 — kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation CVE-2026-68377 — kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key CVE-2026-68448 — kernel: ovl: check access to copy_file_range source with src mounter creds CVE-2026-72083 — kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE CVE-2026-72289 — kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it CVE-2026-72317 — kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker CVE-2026-74283 — kernel: tipc: require net admin for TIPCv2 netlink mutators CVE-2026-74509 — kernel: Bluetooth: hci_sync: Fix advertising data UAFs CVE-2026-74510 — kernel: Bluetooth: mgmt: fix UAF in pair command cancellation CVE-2026-74516 — kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active CVE-2026-74574 — kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() CVE-2026-74641 — kernel: ALSA: usx2y: bound the hwdep mmap fault offset CVE-2026-74705 — kernel: udp: fix potential use-after-free in tunnel segmentation CVE-2026-74746 — kernel: netfilter: flowtable: publish GC-visible tuple last CVE-2026-80521 — kernel: af_unix: Unlink scc_entry in unix_del_edge() CVE-2026-80536 — kernel: xfs: bounds-check buffer log item's dirty bitmap CVE-2026-80824 — kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() CVE-2026-80887 — kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound CVE-2026-80921 — kernel: KVM: s390: vsie: zero stale crypto bits CVE-2026-81000 — kernel: net: tun: bound receive headroom CVE-2026-81003 — kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device CVE-2026-89526 — kernel: svcrdma: Validate Read chunk positions before reconstruction CVE-2026-89530 — kernel: svcrdma: Reject inline replies that overflow the pull-up buffer CVE-2026-89603 — kernel: entry: Fix seccomp bypass after ptrace with TSYNC CVE-2026-89631 — kernel: smb: client: reject a tree connect response whose byte count is too small CVE-2026-89663 — kernel: nfsd: revoke copy-notify stateids before dropping their reference CVE-2026-89669 — kernel: nfsd: initialize copy-notify stateid before publishing it CVE-2026-89675 — kernel: nfsd: fix UAF in async copy cancel and shutdown CVE-2026-89676 — kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY CVE-2026-89689 — kernel: nfsd: don't free session slots that are still in use CVE-2026-89690 — kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF CVE-2026-89775 — kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation CVE-2026-89777 — kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure CVE-2026-89791 — kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() CVE-2026-89811 — kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension CVE-2026-89894 — kernel: media: cx231xx: reject geometry changes while the VBI queue is busy CVE-2026-89970 — kernel: nvmet-auth: Synchronize timeout work during SQ teardown CVE-2026-89972 — kernel: nvme: add missing SRCU grace period in error path CVE-2026-90008 — kernel: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame CVE-2026-90011 — kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload CVE-2026-90036 — kernel: NFSD: Prevent client use-after-free during blocked-lock reaping CVE-2026-90227 — kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() CVE-2026-93207 — kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry CVE-2026-93228 — kernel: svcrdma: Reject Write/Reply chunks with segcount 0 CVE-2026-93262 — kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() CVE-2026-93288 — kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state CVE-2026-93817 — kernel: perf: Fix addr_filter_ranges lifetime CVE-2026-93827 — kernel: virtio-fs: avoid double-free on failed queue setup CVE-2026-98222 — kernel: KEYS: encrypted: fix integer overflow of datablob_len CVE-2026-98256 — kernel: signal: Prevent exec() race CVE-2026-98260 — kernel: exec: Cleanup POSIX timers right after de_thread() CVE-2026-98320 — kernel: netfilter: flowtable: hold reference on ct until flow is released CVE-2026-98364 — kernel: xfrm: hold net_device reference under RCU in bundle creation CVE-2026-98432 — kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period CVE-2026-98725 — kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() CVE-2026-98974 — kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.14.1.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.14.1.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.14.1.el10_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.14.1.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-devel-0:6.12.0-264.14.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent the openvswitch module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Workaround: To mitigate this issue, prevent module vdpa from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue, prevent module act_ct from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The vulnerable code path is only reachable when using virtio-vsock with zerocopy transmit on virtual machines using the vhost-vsock or virtio-vsock transport. Systems that do not use VM socket communication (AF_VSOCK) are not affected. To prevent the vulnerable code path from being reached, the vhost_vsock kernel module can be unloaded and blacklisted if vsock functionality is not required: ``` modprobe -r vhost_vsock echo "blacklist vhost_vsock" > /etc/modprobe.d/vsock-blacklist.conf ``` Systems that rely on VM-to-host socket communication (e.g., QEMU guest agent communication) cannot use this mitigation and should prioritize applying the kernel fix. Workaround: If the Intel Ethernet PTP functionality is not required, the `idpf` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file. 1. Create a file named `/etc/modprobe.d/blacklist-idpf.conf` with the following content: ``` blacklist idpf install idpf /bin/true ``` 2. Regenerate the initramfs to ensure the blacklist is applied during boot: - For systems using Dracut: `dracut -f -v` - For systems using mkinitcpio: `mkinitcpio -P` 3. Reboot the system for the changes to take effect. This mitigation may impact systems that rely on Intel Ethernet PTP for time synchronization. Workaround: To mitigate this issue on systems where unprivileged BPF is enabled, configure the kernel to disallow unprivileged users from loading BPF programs. 1. Temporarily apply the configuration at runtime: # sysctl -w kernel.unprivileged_bpf_disabled=1 2. To make this setting persistent across system reboots, write the parameter to a sysctl configuration file: # echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/99-disable-unprivileged-bpf.conf # sysctl --system Caveats: Disabling unprivileged BPF prevents unprivileged user processes and unprivileged containers from loading BPF programs, which may impact non-root monitoring or tracing tools. Privileged accounts and processes retaining CAP_SYS_ADMIN or CAP_BPF are unaffected and can still load programs. Modifying this sysctl setting takes effect immediately and does not require a system restart or service reload. Workaround: If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module. To blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content: ``` blacklist amdgpu ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use. Workaround: To mitigate this vulnerability, prevent the `slip` kernel module from loading if the SLIP protocol is not required. Create a file `/etc/modprobe.d/disable-slip.conf` with the content `blacklist slip`. Then, regenerate the initramfs using `dracut -f -v`. A system reboot is required for the changes to be fully applied. This action may impact systems relying on the SLIP protocol for network communication. Workaround: To mitigate this issue, prevent module snd_seq from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: To mitigate this issue on systems that do not require AMD graphics hardware, prevent the amdgpu module from loading: 1. Create a configuration file in /etc/modprobe.d to disable the driver: # echo "install amdgpu /bin/true" > /etc/modprobe.d/disable-amdgpu.conf 2. If the amdgpu module is already loaded in the running kernel, a system reboot is required for the configuration to take effect. Warning: Disabling this module prevents the initialization of AMD graphics adapters, which disables graphical desktop environments, display output, and GPU acceleration on systems relying on AMD hardware. Workaround: Prevent the 'drm_dp_mst' kernel module from loading to mitigate this vulnerability. This will disable DisplayPort Multi-Stream Transport functionality, which may affect multi-monitor setups using DisplayPort. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-drm_dp_mst.conf` with the following content: ``` blacklist drm_dp_mst ``` Then, regenerate the initramfs and reboot the system for the changes to take effect: ```bash drancut --force --kver $(uname -r) reboot ``` A system reboot is required for the module to be unloaded and the mitigation to be active. This may impact display functionality if DP MST is in use. Workaround: To mitigate this flaw on hosts that do not operate as storage target servers, prevent the LIO target kernel modules from loading: 1. Create a configuration file to prevent loading the target modules: # echo "install iscsi_target_mod /bin/true" > /etc/modprobe.d/disable-iscsi_target.conf # echo "install target_core_mod /bin/true" > /etc/modprobe.d/disable-target_core.conf 2. Stop the SCSI target daemon if active: # systemctl stop target.service Warning: Modifying kernel module loading or stopping target.service requires a service restart or system reboot, and will immediately interrupt active storage connections on systems acting as storage targets. If the machine must function as an iSCSI target, use network firewall rules to restrict access to the iSCSI target port (TCP port 3260) strictly to authorized initiator hosts. Workaround: Prevent the TIPC kernel module from loading if Transparent Inter-Process Communication is not explicitly required: 1. Create a configuration file to disable the module: # echo "install tipc /bin/true" > /etc/modprobe.d/disable-tipc.conf # echo "blacklist tipc" >> /etc/modprobe.d/disable-tipc.conf 2. Unload the module if it is currently loaded: # modprobe -r tipc Caveats: Disabling the tipc module will break applications and services that rely on TIPC for clustering or inter-process com…

🔗 References (95)