RHSA-2026:98638HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (7)

CVE-2026-72222 →CVE-2026-89488 →CVE-2026-89638 →CVE-2026-90315 →CVE-2026-52929 →CVE-2026-68293 →CVE-2026-72221 →

📋 Description

CVE-2026-52929 — kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-68293 — kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads CVE-2026-72221 — kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race CVE-2026-72222 — kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback CVE-2026-89488 — kernel: openvswitch: Fix CT limit teardown use-after-free CVE-2026-89638 — kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions CVE-2026-90315 — kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.15.1.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.15.1.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.15.1.el10_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.15.1.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-devel-0:6.12.0-264.15.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content: ``` install sctp /bin/true blacklist sctp ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, disable the TLS handshake daemon if RPC-over-TLS is not required, or restrict NFS network access to trusted clients: 1. Stop and mask the TLS handshake service to prevent kernel TLS sessions: # systemctl stop tlshd.service # systemctl mask tlshd.service 2. Alternatively, restrict access to the NFS daemon (TCP port 2049) to trusted networks using firewalld: # firewall-cmd --permanent --zone=public --remove-service=nfs # firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet> # firewall-cmd --reload Caveats: Disabling tlshd prevents clients from establishing RPC connections secured by TLS, which may cause connection attempts requiring TLS transport security to fail. Restricting network access via firewalld blocks connections from non-allowlisted hosts. Warning: Reloading firewall configurations with 'firewall-cmd --reload' or stopping system services may momentarily disrupt existing network sessions and drop in-flight NFS requests. Workaround: To mitigate this vulnerability, prevent the openvswitch kernel module from loading on systems where Open vSwitch is not required: 1. Create a modprobe configuration file to disable the module: ``` echo "install openvswitch /bin/true" > /etc/modprobe.d/disable-openvswitch.conf ``` 2. If the module is already loaded, unload it: ``` modprobe -r openvswitch ``` Warning: Unloading the module or applying this configuration may require restarting services or rebooting the system if the module is currently in use. Caveat: Disabling the openvswitch module will prevent Open vSwitch from functioning and will break network connectivity in environments that depend on it, such as OpenShift Container Platform clusters utilizing OVN-Kubernetes or OpenShift SDN. Workaround: Mount SMB/CIFS shares with the `nosuid` mount option to prevent setuid and setgid binaries from executing with elevated permissions, or prevent the `cifs` module from loading if network SMB shares are not needed. 1. Apply `nosuid` to an active mount point: ``` mount -o remount,nosuid /path/to/cifs/mount ``` 2. Persist this setting by ensuring `nosuid` is present in the mount options within `/etc/fstab`: ``` //server/share /mnt/cifs cifs credentials=/etc/samba/creds,nosuid 0 0 ``` 3. Alternatively, if CIFS mounts are not required on the system, disable autoloading of the kernel module: ``` echo "install cifs /bin/true" > /etc/modprobe.d/cifs.conf ``` Caveats: Enforcing `nosuid` prevents any executable located on the mount point from running with elevated setuid or setgid privileges. Blacklisting the `cifs` module prevents all SMB/CIFS network file systems from mounting. Remounting filesystems can disrupt ongoing read and write operations.

🔗 References (10)