Skip to content
OpenAdvisories
Critical RHSA-2026:69837 9 CVEs

Red Hat Security Advisory: kernel security update

Published Sep 22, 2026 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 49

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bpftool-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-core 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-core 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-devel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-devel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-doc 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-modules-extra 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos kernel-tools-libs 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos perf-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-core 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-core 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-devel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-devel 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-doc 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-modules-extra 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos kernel-tools-libs 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos perf-debuginfo 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf 0:4.18.0-477.168.1.el8_8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.168.1.el8_8

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-52993 Public exploit

    tipc: fix double-free in tipc_buf_append()

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-53002

    netfilter: conntrack: remove sprintf usage

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63887

    scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63888

    scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64268

    RDMA/siw: bound Read Response placement to the RREAD length

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->proce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-64564 Public exploit

    sctp: don't free the ASCONF's own transport in DEL-IP processing

    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53185

    zram: fix use-after-free in zram_bvec_write_partial()

    In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46150

    fanotify: fix false positive on permission events

    In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31692

    rtnetlink: add missing netlink_ns_capable() check for peer netns

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464093
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482612
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492437
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492735
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502443
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510890
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69837.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-31692
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31692
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31692
  • article
    https://lore.kernel.org/linux-cve-announce/2026043054-CVE-2026-31692-5f89@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46150
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46150
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46150
  • article
    https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46150-c96d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-52993
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-52993
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-52993
  • article
    https://lore.kernel.org/linux-cve-announce/2026062445-CVE-2026-52993-34a2@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53002
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53002
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53002
  • article
    https://lore.kernel.org/linux-cve-announce/2026062447-CVE-2026-53002-8577@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53185
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53185
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53185
  • article
    https://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53185-0922@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63887
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63887
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63887
  • article
    https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63887-cf4b@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63888
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63888
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63888
  • article
    https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63888-a5d6@gregkh/T