Red Hat Security Advisory

RHSA-2026:84677

kernel security update

Released 2026-10-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS AUS (v.8.4) bpftool-4.18.0-305.214.1.el8_4, kernel-4.18.0-305.214.1.el8_4, kernel-abi-stablelists-4.18.0-305.214.1.el8_4 +14
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) bpftool-4.18.0-305.214.1.el8_4, kernel-4.18.0-305.214.1.el8_4, kernel-abi-stablelists-4.18.0-305.214.1.el8_4 +14

Fixes 5 records

TI-2026-45489 CVE-2026-63924 · GHSA-4j34-532j-f693

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

MEDIUM 50

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00714 Published 2026-07-19 Partial fix · 5.10.259, 5.15.210 +6 CWE-822

TI-2026-45487 CVE-2026-63922 · GHSA-5w2v-4j6c-44h8

ipv6: exthdrs: refresh nh after handling HAO option

MEDIUM 50

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00714 Published 2026-07-19 Partial fix · 5.10.259, 5.15.210 +6 CWE-416

TI-2026-45485 CVE-2026-63920 · GHSA-8539-cx26-hf58

ipv6: validate extension header length before copying to cmsg

LOW 30

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00172 Published 2026-07-19 Partial fix · 5.10.259, 5.15.210 +6 CWE-125

TI-2026-33873 CVE-2026-46149 · GHSA-vvx9-xfcg-g62v

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

LOW 30

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-b…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00142 Published 2026-05-28 Partial fix · 5.10.258, 5.15.209 +6 CWE-126

TI-2026-31627 CVE-2026-43450 · GHSA-4jv3-xpmj-f4vf

netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

LOW 30

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside t…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00132 Published 2026-05-08 Partial fix · 5.10.253, 5.15.203 +6 CWE-125