Red Hat Security AdvisoryRHSA-2026:69089
kernel security, bug fix, and enhancement update
Released 2026-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.105.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.105.1.el10_0, kernel-64k-devel-6.12.0-55.105.1.el10_0 +12
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.105.1.el10_0, kernel-64k-6.12.0-55.105.1.el10_0, kernel-64k-core-6.12.0-55.105.1.el10_0 +28
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.105.1.el10_0, libperf-6.12.0-55.105.1.el10_0
- Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.105.1.el10_0, kernel-rt-64k-6.12.0-55.105.1.el10_0, kernel-rt-64k-core-6.12.0-55.105.1.el10_0 +21
- Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.105.1.el10_0, kernel-rt-core-6.12.0-55.105.1.el10_0, kernel-rt-debug-6.12.0-55.105.1.el10_0 +11
Fixes 10 records
Priority MEDIUM 52
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asc…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01432 · Published 2026-08-04 · Partial fix · 5.10.265, 5.15.216 +6 CWE-416
Priority MEDIUM 50
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the orig…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00778 · Published 2026-07-19 · Partial fix · 5.10.259, 5.15.210 +6 CWE-415
Priority MEDIUM 50
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_b…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00778 · Published 2026-07-19 · Partial fix · 5.10.259, 5.15.210 +6 CWE-122
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for s…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00368 · Published 2026-06-24 · Partial fix · 5.10.258, 5.15.209 +6 CWE-787
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00354 · Published 2026-07-25 · Fixed in 6.6.145, 6.12.96 +3 CWE-415
Priority LOW 37
In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.
CVSS 3.1HIGH 8.4· Local · Low privileges · No interaction · EPSS 0.00127 · Published 2026-07-19 · Fixed in 6.6.143, 6.12.93 +3 CWE-362
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00107 · Published 2026-06-25 · Partial fix · 6.6.143, 6.12.94 +3 CWE-364
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf sti…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00182 · Published 2026-06-24 · Partial fix · 6.1.191, 6.6.160 +4 CWE-416
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part o…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00138 · Published 2026-05-28 · Fixed in 6.12.91, 6.18.30 +2 CWE-20
Priority LOW 22
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs.
CVSS — · EPSS 0.00206 · Published 2026-08-10 · Fixed in 6.6.153, 6.12.105 +3
THREATIST.IORead the docs