Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
* kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-687.57.1.el9_8 |
Vulnerabilities 13
-
Critical 9.8
openvswitch: fix GSO userspace truncation underflow
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …
-
Critical 9.8
nvmet-auth: Synchronize timeout work during SQ teardown
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …
-
Critical 9.4
cifs: validate DFS referral string offsets
In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offse…
-
High 8.8
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this au…
-
High 8.1
macsec: fix replay protection at XPN lower-PN wrap
In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in…
-
High 7.8
drm/amd/display: set new_stream to NULL after release
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a l…
-
High 7.8
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_i…
-
High 7.8
media: cx231xx: reject geometry changes while the VBI queue is busy
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the…
-
High 7.0
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cache…
-
Unscored —CVE-2026-64507 Public exploit
x86/bugs: Enable IBPB flush on BPF JIT allocation
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…
-
Unscored —
bpf: Support for hardening against JIT spraying
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…
-
Unscored —
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length cur…
-
Unscored —
drm/vmwgfx: use check_add_overflow for shader size+offset bound
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486468
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502397
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507153
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513148
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513287
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513451
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516396
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528788
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2535265
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2535309
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2535338
-
advisory
https://access.redhat.com/errata/RHSA-2026:81552