Red Hat Security AdvisoryRHSA-2026:81406
kernel security, bug fix, and enhancement update
Released 2026-10-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- 10Base-SMTV kernel-modules-internal-6.12.0-211.65.1.el10_2
- Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.65.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.65.1.el10_2, kernel-64k-devel-6.12.0-211.65.1.el10_2 +12
- Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.65.1.el10_2, kernel-64k-6.12.0-211.65.1.el10_2, kernel-64k-core-6.12.0-211.65.1.el10_2 +29
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.65.1.el10_2, libperf-6.12.0-211.65.1.el10_2
- Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal-6.12.0-211.65.1.el10_2
- Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.65.1.el10_2, kernel-rt-64k-6.12.0-211.65.1.el10_2, kernel-rt-64k-core-6.12.0-211.65.1.el10_2 +21
- Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.65.1.el10_2, kernel-rt-core-6.12.0-211.65.1.el10_2, kernel-rt-debug-6.12.0-211.65.1.el10_2 +9
Fixes 11 records
Priority MEDIUM 50
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00552 · Published 2026-08-10 · Partial fix · 5.10.265, 5.15.216 +6 CWE-191
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00457 · Published 2026-07-25 · Fixed in 6.6.145, 6.12.96 +3 CWE-415
Priority MEDIUM 47
In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but e…
CVSS 3.1CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.00586 · Published 2026-08-15 · Partial fix · 6.1.178, 6.6.145 +4
Priority MEDIUM 44
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00803 · Published 2026-09-16 · Partial fix · 6.1.188, 6.6.157 +4
Priority MEDIUM 41
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an int…
CVSS 3.1CRITICAL 9.3· Local · No auth · No interaction · EPSS 0.00185 · Published 2026-08-15 · Partial fix · 5.10.261, 5.15.212 +6
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00165 · Published 2026-07-20 · Partial fix · 5.10.260, 5.15.211 +6 CWE-787
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fi…
CVSS 3.1HIGH 8.1· Adjacent network · No auth · No interaction · EPSS 0.00347 · Published 2026-07-19 · Partial fix · 5.10.259, 5.15.210 +6 CWE-190
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone devic…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00163 · Published 2026-05-08 · Fixed in 6.6.134, 6.8 +4 CWE-416
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge().
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00178 · Published 2026-08-26 · Fixed in 6.1.189, 6.6.158 +4
Priority LOW 22
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space with…
CVSS — · EPSS 0.00189 · Published 2026-07-25 · Partial fix · 6.1.183, 6.6.145 +4
Priority LOW 22
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use.
CVSS — · EPSS 0.00231 · Published 2026-07-25 · Partial fix · 6.1.183, 6.6.145 +4
THREATIST.IORead the docs