Skip to content
OpenAdvisories
Critical RHSA-2026:99139 18 CVEs

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Fixed packages 90

ReleasePackageFixed in
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-devel-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debug-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-devel-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-64k-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-abi-stablelists 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-devel-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debug-uki-virt 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debuginfo-common-aarch64 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debuginfo-common-ppc64le 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debuginfo-common-s390x 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-debuginfo-common-x86_64 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-devel-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-doc 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-modules-extra-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debug-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-64k-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debug-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-rt-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-tools 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-tools-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-tools-libs 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-tools-libs-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-uki-virt 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-uki-virt-addons 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-devel 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-devel-matched 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-modules 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-modules-core 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 kernel-zfcpdump-modules-extra 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 libperf 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 libperf-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 perf 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 perf-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 python3-perf 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 python3-perf-debuginfo 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 rtla 0:6.12.0-211.75.1.el10_2
Red Hat · RHEL 10.2 EUS enterprise_linux_eus:10.2 rv 0:6.12.0-211.75.1.el10_2

Vulnerabilities 18

  • Critical 9.8

    netfs: Fix early put of sink folio in netfs_read_gaps()

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that…

  • Critical 9.8

    netfs: Fix potential for tearing in ->remote_i_size and ->zero_point

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the …

  • Critical 9.8

    net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences c…

  • Critical 9.8

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

  • High 8.8

    s390/vfio_ccw: Cancel existing workqueues

    In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup t…

  • High 8.4

    s390/qeth: validate user buffer length in SNMP and ARP query ioctls

    In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking …

  • High 7.8

    ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

    In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++]…

  • High 7.8

    s390/zcrypt: Validate length for CCA ECC private key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject th…

  • High 7.8

    s390/zcrypt: Validate length for CCA AES cipher key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject …

  • High 7.8

    ALSA: seq: midi: Serialize input teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

  • High 7.8

    ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

    In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

  • High 7.8

    smb: client: validate absolute native symlink targets before NT fixups

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…

  • High 7.5

    Revert "wireguard: device: enable threaded NAPI"

    In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had th…

  • High 7.5

    scsi: libiscsi: Validate the task named by a management response

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

  • Unscored —

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…

  • Unscored —

    i3c: master: svc: bound IBI payload to the requested max_payload_len

    In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max_payload_len svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware …

  • Unscored —

    s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

    In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects In order to traverse or add/remove ap_matrix_mdev objects in the matrix_dev->mdev_list, the matrix_dev->guests…

  • Unscored —

    s390/boot: Avoid IPL parameter append past command line

    In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492373
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502584
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507721
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515351
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524442
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524475
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528639
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532522
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535200
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2536701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2540872
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2541360
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2546374
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552209
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562706
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99139.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-52945
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-52945
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-52945
  • article
    https://lore.kernel.org/linux-cve-announce/2026062400-CVE-2026-52945-5ce8@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-63987
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63987
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63987
  • article
    https://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63987-bda5@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64061
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64061
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64061
  • article
    https://lore.kernel.org/linux-cve-announce/2026071910-CVE-2026-64061-8b7f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64160
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64160
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64160
  • article
    https://kernelcve.org/list/?q=CVE-2026-64160
  • article
    https://lore.kernel.org/linux-cve-announce/2026071933-CVE-2026-64160-8bee@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64541