RHSA-2026:99133HighCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (17)

CVE-2026-90207 →CVE-2026-99153 →CVE-2026-80584 →CVE-2026-80586 →CVE-2026-89956 →CVE-2026-68162 →CVE-2026-74588 →CVE-2026-74752 →CVE-2026-80981 →CVE-2026-98318 →CVE-2026-74586 →CVE-2026-80553 →CVE-2026-80951 →CVE-2026-99152 →CVE-2026-80571 →CVE-2026-89479 →CVE-2026-89633 →

📋 Description

CVE-2026-68162 — kernel: sctp: avoid auth_enable sysctl UAF during netns teardown CVE-2026-74586 — kernel: sctp: clear new_transport when removing a peer CVE-2026-74588 — kernel: sctp: keep chunk->transport in step with the list it is queued on CVE-2026-74752 — kernel: sctp: validate cookie AUTH state before use CVE-2026-80553 — kernel: s390/vfio_ccw: Cancel existing workqueues CVE-2026-80571 — kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak CVE-2026-80584 — kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls CVE-2026-80586 — kernel: mptcp: options: reset DSS fields in case of unexpected size CVE-2026-80951 — kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len CVE-2026-80981 — kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() CVE-2026-89479 — kernel: sctp: stop processing a packet once its association is deleted CVE-2026-89633 — kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() CVE-2026-89956 — kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects CVE-2026-90207 — kernel: ALSA: seq: midi: Serialize input teardown with event_input CVE-2026-98318 — kernel: smb: client: validate absolute native symlink targets before NT fixups CVE-2026-99152 — kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses CVE-2026-99153 — kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.16.1.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.16.1.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.16.1.el10_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-264.16.1.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-64k-devel-0:6.12.0-264.16.1.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue on systems where the SCTP protocol is not needed, prevent the sctp kernel module from loading: 1. Add the module configuration to prevent loading: # echo "install sctp /bin/true" > /etc/modprobe.d/sctp-disable.conf 2. Unload the module from the active system if loaded: # modprobe -r sctp Warning: If the sctp module is currently in use, unloading will fail and a system reboot will be required to apply the changes. Disabling this module will cause any applications requiring SCTP networking functionality to fail. Workaround: To prevent exploitation of this kernel vulnerability, the `sctp` module can be blacklisted. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the content `install sctp /bin/true` and `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot the system. This action will disable SCTP functionality; verify no critical services depend on it before implementation. A system reboot is required for the changes to take effect. Workaround: To mitigate this vulnerability, prevent the `sctp` kernel module from loading by creating a blacklist configuration as detailed below. [How do I prevent a kernel module from loading automatically?](https://access.redhat.com/solutions/41278) Note: Disabling the `sctp` module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The vulnerability affects the Multipath TCP (MPTCP) feature in the Linux kernel. To mitigate this issue, MPTCP can be disabled by preventing the `mptcp` kernel module from loading. To disable the `mptcp` module: 1. Create a new file `/etc/modprobe.d/disable-mptcp.conf` with the following content: `install mptcp /bin/true blacklist mptcp` 2. Regenerate the initramfs to ensure the change takes effect on boot: `sudo dracut -f -v` 3. Reboot the system for the changes to take effect. Disabling MPTCP may impact network performance or functionality for applications that rely on Multipath TCP. Workaround: To mitigate this vulnerability, prevent the Silvaco I3C master controller driver module from loading: 1. Blacklist the kernel module: # echo "blacklist svc-i3c-master" >> /etc/modprobe.d/blacklist-svc-i3c-master.conf 2. Configure the module to fail loading if called directly or as a dependency: # echo "install svc-i3c-master /bin/false" >> /etc/modprobe.d/blacklist-svc-i3c-master.conf Caveats: Disabling this module prevents the system from communicating with Silvaco I3C master hardware controllers and attached I3C peripherals. If the module is currently loaded, a system reboot is required to ensure it is completely unloaded from memory. Workaround: To mitigate this vulnerability, prevent the SCTP kernel module from loading on systems where the protocol is not needed: 1. Disable loading of the sctp module: ``` # echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf ``` 2. If the module is currently loaded, unload it or reboot the system: ``` # modprobe -r sctp ``` Warning: If the module is in use, unloading it will fail, and a full system restart is required to eliminate the loaded module from kernel memory. Caveat: Disabling the SCTP module will prevent services or applications that require SCTP network communications from operating. Workaround: Prevent the `cifs` kernel module from loading if mounting SMB network file shares is not required. 1. Create a configuration file to blacklist the module: ```text echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf ``` 2. If the module is currently loaded into memory, unload it: ```text modprobe -r cifs ``` Caveats: Disabling this module prevents the system from mounting remote CIFS and SMB file systems. If active SMB shares are in use, all shares must be unmounted before unloading the module, or a system restart is required to apply the changes. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (20)