Skip to content
OpenAdvisories
Critical RHSA-2026:97040 19 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 92

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.3 kernel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-devel-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-devel-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-abi-stablelists 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-devel-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-uki-virt 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-aarch64 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-ppc64le 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-s390x 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-x86_64 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-devel-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-doc 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-extra-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-libs 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-libs-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-uki-virt 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-uki-virt-addons 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-devel 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-devel-matched 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules-core 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules-extra 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 libperf 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 libperf-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 perf 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 perf-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 python3-perf 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 python3-perf-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rtla 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rtla-debuginfo 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rv 0:6.12.0-264.9.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rv-debuginfo 0:6.12.0-264.9.1.el10_3

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-23240

    tls: Fix race condition in tls_sw_cancel_work_tx()

    In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-64000

    net: hsr: fix potential OOB access in supervision frame handling

    In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Wi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64025

    bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

    In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64355

    bpf: Reject fragmented frames in devmap

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, wh…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-72319

    ipvs: ensure inner headers in ICMP errors are in headroom

    In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb_pull() we should ensure the inner IP headers in ICMP errors from …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-52952

    iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset

    In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recover…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68390

    Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe. Hold hdev->lock …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23066

    rxrpc: Fix recvmsg() unconditional requeue

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23239

    espintcp: Fix race condition in espintcp_close()

    In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be sched…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63987

    ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

    In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++]…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64279

    i2c: core: fix adapter deregistration race

    In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64375

    proc: protect ptrace_may_access() with exec_update_lock (FD links)

    In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() and proc_pid_readlink() currently look up the task from the pid once, then do the ptrace access check on…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-52945

    Revert "wireguard: device: enable threaded NAPI"

    In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-53395

    nfsd: fix dead ACL conflict guard in nfsd4_create

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source poi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-64020

    nvme-pci: fix dma_vecs leak on p2p memory

    In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68379

    tcp: fix TIME_WAIT socket reference leak on PSP policy failure

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIME_WAIT socket reference leak on PSP policy failure Release the TIME_WAIT socket reference and jump to discard_it upon PSP policy failure in both IPv4 and IPv6 receive paths. This …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.3
    CVE-2026-63914

    xfrm: route MIGRATE notifications to caller's netns

    In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that ann…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-64496

    iio: event: Fix event FIFO reset race

    In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-68103

    drm/amdgpu: reject mapping a reserved doorbell to a new queue

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.3_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436805
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2446109
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2446139
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492373
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502209
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502219
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502337
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502344
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502375
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502433
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507031
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507122
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507156
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507184
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507345
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513458
  • article
    https://issues.redhat.com/browse/RHEL-145204
  • article
    https://issues.redhat.com/browse/RHEL-145367
  • article
    https://issues.redhat.com/browse/RHEL-157318
  • article
    https://issues.redhat.com/browse/RHEL-163488
  • article
    https://issues.redhat.com/browse/RHEL-163760
  • article
    https://issues.redhat.com/browse/RHEL-167108
  • article
    https://issues.redhat.com/browse/RHEL-169468
  • article
    https://issues.redhat.com/browse/RHEL-170872
  • article
    https://issues.redhat.com/browse/RHEL-171362
  • article
    https://issues.redhat.com/browse/RHEL-171410
  • article
    https://issues.redhat.com/browse/RHEL-174745
  • article
    https://issues.redhat.com/browse/RHEL-178260
  • article
    https://issues.redhat.com/browse/RHEL-180187
  • article
    https://issues.redhat.com/browse/RHEL-185104
  • article
    https://issues.redhat.com/browse/RHEL-189045