Red Hat Security AdvisoryRHSA-2026:94438
kernel security, bug fix, and enhancement update
Released 2026-11-03 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.154.1.el9_6, libperf-5.14.0-570.154.1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.154.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.154.1.el9_6, kernel-64k-devel-5.14.0-570.154.1.el9_6 +12
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.154.1.el9_6, kernel-64k-5.14.0-570.154.1.el9_6, kernel-64k-core-5.14.0-570.154.1.el9_6 +28
- Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.154.1.el9_6, kernel-rt-64k-5.14.0-570.154.1.el9_6, kernel-rt-64k-core-5.14.0-570.154.1.el9_6 +21
- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.154.1.el9_6, kernel-rt-core-5.14.0-570.154.1.el9_6, kernel-rt-debug-5.14.0-570.154.1.el9_6 +11
Fixes 8 records
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00442 · Published 2026-06-25 · Partial fix · 6.18.36, 7.0.13 +1 CWE-125
Priority MEDIUM 46
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exce…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-06-25 · Partial fix · 6.1.191, 6.6.160 +4 CWE-125
Priority MEDIUM 43
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->in…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0076 · Published 2026-10-15 · Partial fix · 5.10.272, 5.15.223 +6
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds c…
CVSS 3.1HIGH 8.1· Adjacent network · No auth · No interaction · EPSS 0.00256 · Published 2026-05-01 · Partial fix · 5.10.253, 5.15.203 +6 CWE-125
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change [email protected] says: The vulnerability is a rac…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00174 · Published 2026-01-13 · Partial fix · 5.10.248, 5.15.198 +5 CWE-362
Priority LOW 34
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00283 · Published 2025-02-18 · Partial fix · 5.4.291, 5.10.235 +6
Priority LOW 24
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared bef…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00114 · Published 2026-06-24 · Partial fix · 5.10.258, 5.15.209 +9 CWE-476
Priority LOW 24
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00129 · Published 2026-05-27 · Partial fix · 5.10.259, 5.15.210 +6 CWE-476
THREATIST.IORead the docs