Red Hat Security AdvisoryRHSA-2026:64808
kernel security update
Released 2026-09-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.45.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.45.1.el9_8, kernel-64k-devel-5.14.0-687.45.1.el9_8 +12
- Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.45.1.el9_8, kernel-64k-5.14.0-687.45.1.el9_8, kernel-64k-core-5.14.0-687.45.1.el9_8 +28
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.45.1.el9_8, libperf-5.14.0-687.45.1.el9_8
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.45.1.el9_8, kernel-rt-64k-5.14.0-687.45.1.el9_8, kernel-rt-64k-core-5.14.0-687.45.1.el9_8 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.45.1.el9_8, kernel-rt-core-5.14.0-687.45.1.el9_8, kernel-rt-debug-5.14.0-687.45.1.el9_8 +9
Fixes 8 records
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00457 · Published 2026-07-25 · Fixed in 6.6.145, 6.12.96 +3 CWE-415
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00407 · Published 2026-07-19 · Fixed in 6.6.142, 6.12.92 +4 CWE-362
Priority MEDIUM 47
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-s…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00803 · Published 2026-07-25 · Partial fix · 6.1.191, 6.6.160 +4 CWE-125
Priority MEDIUM 46
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-co…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00563 · Published 2026-07-25 · Partial fix · 6.1.191, 6.6.145 +4 CWE-125
Priority LOW 37
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run.
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00176 · Published 2026-07-25 · Partial fix · 6.6.145, 6.12.97 +3 CWE-125
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn'…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00183 · Published 2026-06-24 · Partial fix · 6.1.191, 6.6.160 +4 CWE-763
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00148 · Published 2026-06-24 · Fixed in 5.16, 6.1 +6 CWE-190
Priority LOW 32
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer.
CVSS 3.1HIGH 7.3· Local · Low privileges · No interaction · EPSS 0.00276 · Published 2025-06-08 · Partial fix · 5.4.294, 5.10.238 +6 CWE-125
THREATIST.IORead the docs