Red Hat Security Advisory

RHSA-2026:77634

kernel security, bug fix, and enhancement update

Released 2026-10-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.109.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.109.1.el10_0, kernel-64k-devel-6.12.0-55.109.1.el10_0 +12
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.109.1.el10_0, kernel-64k-6.12.0-55.109.1.el10_0, kernel-64k-core-6.12.0-55.109.1.el10_0 +28
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.109.1.el10_0, libperf-6.12.0-55.109.1.el10_0
Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.109.1.el10_0, kernel-rt-64k-6.12.0-55.109.1.el10_0, kernel-rt-64k-core-6.12.0-55.109.1.el10_0 +21
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.109.1.el10_0, kernel-rt-core-6.12.0-55.109.1.el10_0, kernel-rt-debug-6.12.0-55.109.1.el10_0 +11

Fixes 10 records

TI-2026-38011 CVE-2026-52924 · GHSA-v4hw-q98x-8jmm

sctp: purge outqueue on stale COOKIE-ECHO handling

MEDIUM 50

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during associatio…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2026-06-24 Partial fix · 5.10.259, 5.15.210 +6 CWE-416

TI-2026-31365 CVE-2026-43186 · GHSA-8x8h-4g2v-qpf2

ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

MEDIUM 50

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00642 Published 2026-05-06 Partial fix · 5.15.202, 6.1.165 +5 CWE-122

TI-2026-52488 CVE-2026-74705 · GHSA-rcm8-q4cm-988v

udp: fix potential use-after-free in tunnel segmentation

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.005 Published 2026-08-22 Fixed in 5.10.265, 5.15.216 +6

TI-2026-45950 CVE-2026-64386 · GHSA-5v7v-hhr9-43wj

smb: client: fix query_info() replay double-free

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00457 Published 2026-07-25 Fixed in 6.6.145, 6.12.96 +3 CWE-415

TI-2026-45949 CVE-2026-64385 · GHSA-w5jf-frgq-phfp

smb: client: fix double-free in SMB2_ioctl() replay

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00457 Published 2026-07-25 Fixed in 6.6.145, 6.12.96 +3 CWE-415

TI-2026-45947 CVE-2026-64383 · GHSA-j3g4-c7cw-5ch7

smb: client: fix double-free in SMB2_flush() replay

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00457 Published 2026-07-25 Fixed in 6.6.145, 6.12.96 +3 CWE-415

TI-2026-45572 CVE-2026-64007 · GHSA-rf6c-225m-p2p4

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

MEDIUM 49

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the T…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00514 Published 2026-07-19 Partial fix · 5.10.259, 5.15.210 +6 CWE-416

TI-2026-33716 CVE-2026-45991 · GHSA-x889-prf3-g3vg

udf: fix partition descriptor append bookkeeping

LOW 35

In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00177 Published 2026-05-27 Partial fix · 4.19, 5.10.259 +7 CWE-787

TI-2026-55534 CVE-2026-80521 · GHSA-g8mr-r59r-2xmq

af_unix: Unlink scc_entry in unix_del_edge().

LOW 33

In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge().

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00178 Published 2026-08-26 Fixed in 6.1.189, 6.6.158 +4

TI-2025-26907 CVE-2025-40237 · GHSA-rg97-jhp7-4449

fs/notify: call exportfs_encode_fid with s_umount

LOW 22

In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmount…

CVSS — EPSS 0.00216 Published 2025-12-04 Partial fix · 6.6.73, 6.6.115 +3