Red Hat Security Advisory

RHSA-2026:71599

kernel security update

Released 2026-09-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.107.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.107.1.el10_0, kernel-64k-devel-6.12.0-55.107.1.el10_0 +12
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.107.1.el10_0, kernel-64k-6.12.0-55.107.1.el10_0, kernel-64k-core-6.12.0-55.107.1.el10_0 +28
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.107.1.el10_0, libperf-6.12.0-55.107.1.el10_0
Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.107.1.el10_0, kernel-rt-64k-6.12.0-55.107.1.el10_0, kernel-rt-64k-core-6.12.0-55.107.1.el10_0 +21
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.107.1.el10_0, kernel-rt-core-6.12.0-55.107.1.el10_0, kernel-rt-debug-6.12.0-55.107.1.el10_0 +11

Fixes 4 records

TI-2026-52253 CVE-2026-74469 · GHSA-772m-42gr-vc4c

sctp: prevent peer transport count overflow

MEDIUM 43

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01467 Published 2026-08-15 Partial fix · 5.10.265, 5.15.216 +6

TI-2026-56013 CVE-2026-81000 · GHSA-32hf-vhcc-85c2

net: tun: bound receive headroom

LOW 36

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00357 Published 2026-09-11 Partial fix · 5.10.270, 5.15.221 +6

TI-2026-47901 CVE-2026-68121 · GHSA-7hvc-v975-w6v4

pppoe: reload header pointer after dev_hard_header()

LOW 36

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header().

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00367 Published 2026-08-10 Partial fix · 5.10.265, 5.15.216 +6 CWE-416

TI-2026-55857 CVE-2026-80844 · GHSA-jv4j-682x-84w7

xfrm: ah6: validate routing header segments_left

LOW 23

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV.

CVSS — EPSS 0.00434 Published 2026-09-04 Partial fix · 5.10.269, 5.15.220 +7