Red Hat Security AdvisoryRHSA-2026:88687
kernel security update
Released 2026-10-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.113.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.113.1.el10_0, kernel-64k-devel-6.12.0-55.113.1.el10_0 +12
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.113.1.el10_0, kernel-64k-6.12.0-55.113.1.el10_0, kernel-64k-core-6.12.0-55.113.1.el10_0 +28
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.113.1.el10_0, libperf-6.12.0-55.113.1.el10_0
- Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.113.1.el10_0, kernel-rt-64k-6.12.0-55.113.1.el10_0, kernel-rt-64k-core-6.12.0-55.113.1.el10_0 +21
- Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.113.1.el10_0, kernel-rt-core-6.12.0-55.113.1.el10_0, kernel-rt-debug-6.12.0-55.113.1.el10_0 +11
Fixes 10 records
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two p…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00503 · Published 2025-12-24 · Partial fix · 4.10, 4.15 +6
Priority MEDIUM 46
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-co…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00563 · Published 2026-07-25 · Partial fix · 6.1.191, 6.6.145 +4 CWE-125
Priority MEDIUM 42
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00469 · Published 2026-07-19 · Partial fix · 6.12.92, 6.18.34 +2 CWE-416
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00714 · Published 2026-09-16 · Partial fix · 5.10.270, 5.15.221 +6
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_…
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00307 · Published 2026-07-19 · Partial fix · 5.10.260, 5.15.211 +6 CWE-416
Priority LOW 38
In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to en…
CVSS 3.1HIGH 8.4· Local · Low privileges · No interaction · EPSS 0.00166 · Published 2026-08-15 · Partial fix · 6.1.178, 6.6.145 +4
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00129 · Published 2026-08-22 · Partial fix · 5.10.266, 5.15.216 +6
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() dir…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00132 · Published 2026-08-10 · Fixed in 6.12.101, 6.18.42 +2 CWE-362
Priority LOW 24
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data len…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00144 · Published 2026-06-24 · Partial fix · 5.10.258, 5.15.209 +7
Priority LOW 24
In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VMA lock Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, which…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00103 · Published 2026-02-14 · Partial fix · 6.12.70, 6.18.10 +1 CWE-667
THREATIST.IORead the docs