Skip to content
OpenAdvisories
Critical RHSA-2026:99133 17 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 92

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.3 kernel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-devel-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debug-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-devel-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-64k-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-abi-stablelists 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-devel-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debug-uki-virt 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-aarch64 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-ppc64le 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-s390x 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-debuginfo-common-x86_64 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-devel-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-doc 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-modules-extra-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debug-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-64k-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debug-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-rt-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-libs 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-tools-libs-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-uki-virt 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-uki-virt-addons 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-devel 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-devel-matched 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules-core 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 kernel-zfcpdump-modules-extra 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 libperf 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 libperf-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 perf 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 perf-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 python3-perf 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 python3-perf-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rtla 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rtla-debuginfo 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rv 0:6.12.0-264.16.1.el10_3
Red Hat · RHEL 10 enterprise_linux:10.3 rv-debuginfo 0:6.12.0-264.16.1.el10_3

Vulnerabilities 17

  • Critical 9.8
    CVE-2026-74586 Public exploit

    sctp: clear new_transport when removing a peer

    In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been proce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74588

    sctp: keep chunk->transport in step with the list it is queued on

    In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74752

    sctp: validate cookie AUTH state before use

    In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-80586

    mptcp: options: reset DSS fields in case of unexpected size

    In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-80981

    net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ...…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-89479

    sctp: stop processing a packet once its association is deleted

    In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89633 Public exploit

    smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against bu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-99153

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-80553

    s390/vfio_ccw: Cancel existing workqueues

    In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-80584

    s390/qeth: validate user buffer length in SNMP and ARP query ioctls

    In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68162

    sctp: avoid auth_enable sysctl UAF during netns teardown

    In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-90207

    ALSA: seq: midi: Serialize input teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98318

    smb: client: validate absolute native symlink targets before NT fixups

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-99152

    scsi: libiscsi: Validate the task named by a management response

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80571

    powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

    In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer over…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80951

    i3c: master: svc: bound IBI payload to the requested max_payload_len

    In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89956

    s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

    In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513314
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521384
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2521419
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524438
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524442
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524458
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524475
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532230
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532290
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532522
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2536701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2546374
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562706
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99133.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-68162
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68162
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68162
  • article
    https://lore.kernel.org/linux-cve-announce/2026081004-CVE-2026-68162-086a@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-74586
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-74586
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-74586
  • article
    https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74586-9beb@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-74588
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-74588
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-74588
  • article
    https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74588-29ed@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-74752
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-74752
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-74752
  • article
    https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-80553
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-80553
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-80553
  • article
    https://kernelcve.org/list/?q=CVE-2026-80553