Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)
* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
* kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)
Bug Fix(es) and Enhancement(s):
* KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:Rocky Linux-188661)
* crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:Rocky Linux-254943)
* kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:Rocky Linux-260402)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.61.1.el10_2 |
Vulnerabilities 10
-
Critical 9.3
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappin…
-
High 8.8
KVM: arm64: Reassign nested_mmus array behind mmu_lock
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unma…
-
High 7.9
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabl…
-
High 7.8
ext4: fix e4b bitmap inconsistency reports
In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like…
-
High 7.8
fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that means the mount can concurrently be unmounted, and the…
-
High 7.8
perf/core: Detach event groups during remove_on_exec
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the conte…
-
High 7.8
perf: Reject exited events as group leaders
In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can re…
-
High 7.8
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The cu…
-
High 7.5
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…
-
High 7.5
nvme-tcp: reject a read that transferred too few bytes
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received again…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2481992
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482104
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486976
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2495938
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508319
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2524423
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2524434
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532095
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2535049
-
advisory
https://access.redhat.com/errata/RHSA-2026:72624