RHSA-2026:99135MediumCVSS 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (29)

CVE-2026-80584 →CVE-2026-53196 →CVE-2026-74586 →CVE-2026-99153 →CVE-2026-89956 →CVE-2026-98318 →CVE-2026-98442 →CVE-2026-99152 →CVE-2026-80553 →CVE-2026-72222 →CVE-2026-74385 →CVE-2026-99999 →CVE-2026-89633 →CVE-2026-90207 →CVE-2026-99032 →CVE-2026-68451 →CVE-2026-80981 →CVE-2026-98741 →CVE-2026-68452 →CVE-2026-80571 →CVE-2026-80586 →CVE-2026-72221 →CVE-2026-74588 →CVE-2026-74752 →CVE-2026-89479 →CVE-2026-98116 →CVE-2026-68140 →CVE-2026-68162 →CVE-2026-80792 →

📋 Description

CVE-2026-53196 — kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() CVE-2026-68140 — kernel: net/iucv: fix use-after-free of a severed iucv_path CVE-2026-68162 — kernel: sctp: avoid auth_enable sysctl UAF during netns teardown CVE-2026-68451 — kernel: s390/zcrypt: Validate length for CCA ECC private key requests CVE-2026-68452 — kernel: s390/zcrypt: Validate length for CCA AES cipher key requests CVE-2026-72221 — kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race CVE-2026-72222 — kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback CVE-2026-74385 — kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock CVE-2026-74586 — kernel: sctp: clear new_transport when removing a peer CVE-2026-74588 — kernel: sctp: keep chunk->transport in step with the list it is queued on CVE-2026-74752 — kernel: sctp: validate cookie AUTH state before use CVE-2026-80553 — kernel: s390/vfio_ccw: Cancel existing workqueues CVE-2026-80571 — kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak CVE-2026-80584 — kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls CVE-2026-80586 — kernel: mptcp: options: reset DSS fields in case of unexpected size CVE-2026-80792 — kernel: ipv6: fix use-after-free in ip6_finish_output2() CVE-2026-80981 — kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() CVE-2026-89479 — kernel: sctp: stop processing a packet once its association is deleted CVE-2026-89633 — kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() CVE-2026-89956 — kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects CVE-2026-90207 — kernel: ALSA: seq: midi: Serialize input teardown with event_input CVE-2026-98116 — kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF CVE-2026-98318 — kernel: smb: client: validate absolute native symlink targets before NT fixups CVE-2026-98442 — kernel: net/sched: act_ct: fix helper UAF due to extensions realloc CVE-2026-98741 — kernel: ALSA: ua101: reject mismatched capture/playback packet sizes CVE-2026-99032 — kernel: net/smc: protect clcsock lifetime in smc_getname CVE-2026-99152 — kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses CVE-2026-99153 — kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU CVE-2026-99999 — kernel: ipv4: validate checksum_start before completing checksum

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux Real Time (v. 9)
  • Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-741.22.1.el9_9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-741.22.1.el9_9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-741.22.1.el9_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-741.22.1.el9_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-core-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-64k-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-devel-matched-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 9)
  • kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 9)
  • kernel-64k-devel-0:5.14.0-741.22.1.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Linux kernel community recommends updating to a stable kernel release containing the fix (6.6.148, 6.12.101, 6.18.42, or 7.1.6 depending on the stable series); for Red Hat products, apply the kernel updates provided for the affected product streams. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, disable the TLS handshake daemon if RPC-over-TLS is not required, or restrict NFS network access to trusted clients: 1. Stop and mask the TLS handshake service to prevent kernel TLS sessions: # systemctl stop tlshd.service # systemctl mask tlshd.service 2. Alternatively, restrict access to the NFS daemon (TCP port 2049) to trusted networks using firewalld: # firewall-cmd --permanent --zone=public --remove-service=nfs # firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet> # firewall-cmd --reload Caveats: Disabling tlshd prevents clients from establishing RPC connections secured by TLS, which may cause connection attempts requiring TLS transport security to fail. Restricting network access via firewalld blocks connections from non-allowlisted hosts. Warning: Reloading firewall configurations with 'firewall-cmd --reload' or stopping system services may momentarily disrupt existing network sessions and drop in-flight NFS requests. Workaround: To mitigate this issue on systems where the SCTP protocol is not needed, prevent the sctp kernel module from loading: 1. Add the module configuration to prevent loading: # echo "install sctp /bin/true" > /etc/modprobe.d/sctp-disable.conf 2. Unload the module from the active system if loaded: # modprobe -r sctp Warning: If the sctp module is currently in use, unloading will fail and a system reboot will be required to apply the changes. Disabling this module will cause any applications requiring SCTP networking functionality to fail. Workaround: To prevent exploitation of this kernel vulnerability, the `sctp` module can be blacklisted. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the content `install sctp /bin/true` and `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` for older systems) and reboot the system. This action will disable SCTP functionality; verify no critical services depend on it before implementation. A system reboot is required for the changes to take effect. Workaround: To mitigate this vulnerability, prevent the `sctp` kernel module from loading by creating a blacklist configuration as detailed below. [How do I prevent a kernel module from loading automatically?](https://access.redhat.com/solutions/41278) Note: Disabling the `sctp` module may impact services that rely on SCTP for communication. A system reboot is required for the mitigation to be fully applied. Workaround: The vulnerability affects the Multipath TCP (MPTCP) feature in the Linux kernel. To mitigate this issue, MPTCP can be disabled by preventing the `mptcp` kernel module from loading. To disable the `mptcp` module: 1. Create a new file `/etc/modprobe.d/disable-mptcp.conf` with the following content: `install mptcp /bin/true blacklist mptcp` 2. Regenerate the initramfs to ensure the change takes effect on boot: `sudo dracut -f -v` 3. Reboot the system for the changes to take effect. Disabling MPTCP may impact network performance or functionality for applications that rely on Multipath TCP. Workaround: To mitigate this vulnerability, prevent the SCTP kernel module from loading on systems where the protocol is not needed: 1. Disable loading of the sctp module: ``` # echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf ``` 2. If the module is currently loaded, unload it or reboot the system: ``` # modprobe -r sctp ``` Warning: If the module is in use, unloading it will fail, and a full system restart is required to eliminate the loaded module from kernel memory. Caveat: Disabling the SCTP module will prevent services or applications that require SCTP network communications from operating. Workaround: Prevent the `cifs` kernel module from loading if mounting SMB network file shares is not required. 1. Create a configuration file to blacklist the module: ```text echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf ``` 2. If the module is currently loaded into memory, unload it: ```text modprobe -r cifs ``` Caveats: Disabling this module prevents the system from mounting remote CIFS and SMB file systems. If active SMB shares are in use, all shares must be unmounted before unloading the module, or a system restart is required to apply the changes. Workaround: To mitigate this vulnerability on systems where audio capabilities are not required, disable the ALSA PCM kernel module (`snd-pcm`). 1. Prevent the module from loading by creating a modprobe configuration file: # echo "install snd-pcm /bin/true" > /etc/modprobe.d/disable-snd-pcm.conf 2. If the module is currently loaded, unload it: # modprobe -r snd-pcm Caveats: Disabling this module prevents audio hardware, playback, and recording from operating. Warning: Unloading the module will interrupt active audio processes. If the module is currently in use and cannot be unloaded, a system restart is required for the configuration to take effect. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to ensure conntrack helper functions run only after all connection tracking extensions have been finalized in traffic control act_ct processing: upgrade to the fixed Kernel/Kernel Ivos Qualcomm/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds, which reorder act_ct operations to invoke conntrack helpers after all connection extensions are allocated and added, closing all 2 injection vectors (crafted network packets pr…

🔗 References (32)