Skip to content
OpenAdvisories
Critical RHSA-2026:89082 14 CVEs

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.178.1.rt7.519.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.178.1.rt7.519.el8_10

Vulnerabilities 14

  • Critical 9.8
    CVE-2026-68136

    net: gro: fix double aggregation of flush-marked skbs

    In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68476

    ipvs: reload ip header after head reallocation

    In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-80586

    mptcp: options: reset DSS fields in case of unexpected size

    In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-99999 Public exploit

    ipv4: validate checksum_start before completing checksum

    In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-68140

    net/iucv: fix use-after-free of a severed iucv_path

    In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-81003

    net/iucv: filter frames in afiucv_hs_rcv() by ingress device

    In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53388

    fuse: re-lock request before replacing page cache folio

    In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64378

    writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

    In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ========================================…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68138 Public exploit

    net/sched: serialize qdisc_rtab_list against concurrent get/put

    In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68338

    net/packet: avoid fanout hook re-registration after unregister

    In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous runni…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-89638

    smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-72242

    selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

    In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-53236

    tcp: restrict SO_ATTACH_FILTER to priv users

    In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80824

    usb: usbfs: fix use-after-free of usb_device in usbdev_release()

    In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492709
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502255
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507296
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513163
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513264
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513293
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513343
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524438
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528642
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532122
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532515
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553429
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89082.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-53236
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53236
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53236
  • article
    https://lore.kernel.org/linux-cve-announce/2026062510-CVE-2026-53236-45bc@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53388
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53388
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53388
  • article
    https://kernelcve.org/list/?q=CVE-2026-53388
  • article
    https://lore.kernel.org/linux-cve-announce/2026071935-CVE-2026-53388-eeaf@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64378
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64378
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64378
  • article
    https://lore.kernel.org/linux-cve-announce/2026072524-CVE-2026-64378-78c8@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68136
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68136
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68136
  • article
    https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68136-f3b7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68138
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68138
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68138
  • article
    https://lore.kernel.org/linux-cve-announce/2026081059-CVE-2026-68138-ffa7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68140
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68140