Skip to content
OpenAdvisories
Critical RHSA-2026:94996 13 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 14, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos bpftool 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos bpftool-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-abi-stablelists 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-core 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-core 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-devel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-modules 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debug-modules-extra 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-debuginfo-common-x86_64 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-devel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-doc 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-modules 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-modules-extra 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos kernel-tools-libs 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos perf 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos perf-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos python3-perf 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::baseos python3-perf-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos bpftool 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos bpftool-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-abi-stablelists 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-core 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-core 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-devel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-modules 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debug-modules-extra 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-debuginfo-common-x86_64 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-devel 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-doc 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-modules 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-modules-extra 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos kernel-tools-libs 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos perf 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos perf-debuginfo 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos python3-perf 0:4.18.0-372.227.1.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::baseos python3-perf-debuginfo 0:4.18.0-372.227.1.el8_6

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-64534

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-68156

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

    In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-68159

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68476

    ipvs: reload ip header after head reallocation

    In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74669

    ipvs: clear IPv4 options after rebasing tunnel ICMP errors

    In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-80714

    ipvs: do not propagate one-packet flag to synced conns

    In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-98432 Public exploit

    ipv4: free inet_opt and ireq_opt after an RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-71066

    net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

    In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46259

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()

    In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74641

    ALSA: usx2y: bound the hwdep mmap fault offset

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vadd…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68155

    libceph: Reject monmaps advertising zero monitors

    In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-89481

    nvme-tcp: fix host memory disclosure on R2T for a read command

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-99284

    net: skbuff: propagate shared-frag marker in skb_zerocopy()

    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429036
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513165
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513295
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521375
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521436
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2525436
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532184
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553390
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559835
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94996.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-71066
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71066
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71066
  • article
    https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71066-f1fa@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46259
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46259
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46259
  • article
    https://lore.kernel.org/linux-cve-announce/2026060336-CVE-2026-46259-6c94@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64534
  • article
    https://lore.kernel.org/linux-cve-announce/2026072734-CVE-2026-64534-434b@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68155
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68155
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68155
  • article
    https://lore.kernel.org/linux-cve-announce/2026081002-CVE-2026-68155-b80d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68156
  • article
    https://lore.kernel.org/linux-cve-announce/2026081003-CVE-2026-68156-72bf@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68159
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68159
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68159
  • article
    https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717