Skip to content
OpenAdvisories
Critical RHSA-2026:83707 16 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Oct 17, 2026 · Updated Nov 13, 2026

Fixed packages 91

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-devel-matched 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debug-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-devel-matched 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-64k-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-abi-stablelists 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-devel-matched 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debug-uki-virt 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-aarch64 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-ppc64le 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-s390x 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-debuginfo-common-x86_64 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-devel-matched 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-doc 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debug-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-64k-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-kvm 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debug-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-kvm 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-rt-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-tools-libs-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-uki-virt-addons 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-devel-matched 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-core 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 kernel-zfcpdump-modules-extra 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 libperf-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 perf-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 python3-perf-debuginfo 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rtla 0:6.12.0-55.111.1.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rv 0:6.12.0-55.111.1.el10_0

Vulnerabilities 16

  • Critical 9.8

    ipv6: exthdrs: refresh nh after handling HAO option

    In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…

  • Critical 9.8

    ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…

  • Critical 9.8

    ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…

  • Critical 9.8

    vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

    In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instea…

  • Critical 9.8

    ixgbevf: fix use-after-free in VEPA multicast source pruning

    In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb …

  • High 8.4

    ALSA: virtio: Validate control metadata from the device

    In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used …

  • High 7.8

    Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…

  • High 7.8
    CVE-2026-98260 Public exploit

    exec: Cleanup POSIX timers right after de_thread()

    In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…

  • High 7.1

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…

  • High 7.1

    ipv6: validate extension header length before copying to cmsg

    In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…

  • High 7.0

    RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

    In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before trigg…

  • Unscored —

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

  • Unscored —

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helpe…

  • Unscored —

    mm/khugepaged: write all dirty file folios when collapsing

    In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions…

  • Unscored —

    x86/bugs: Make Safe-RET robust against interrupt injection

    In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …

  • Unscored —

    ipv6: fix use-after-free in ip6_finish_output2()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464502
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482566
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482588
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502327
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502330
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502369
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502395
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502541
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507277
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513141
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528542
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2546491
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83707.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-31772
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31772
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31772
  • article
    https://lore.kernel.org/linux-cve-announce/2026050149-CVE-2026-31772-2024@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43020
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43020
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43020
  • article
    https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43020-3561@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43450
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43450
  • article
    https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43450-8919@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46149
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46149
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46149
  • article
    https://kernelcve.org/list/?q=CVE-2026-46149
  • article
    https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46149-ad2e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46189
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46189
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46189
  • article
    https://lore.kernel.org/linux-cve-announce/2026052831-CVE-2026-46189-c188@gregkh/T