RHSA-2026:81406HighCVSS 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
October 12, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (11)

CVE-2026-63925 →CVE-2026-64385 →CVE-2026-64508 →CVE-2026-68123 →CVE-2026-72289 →CVE-2026-80521 →CVE-2026-89970 →CVE-2026-43332 →CVE-2026-64191 →CVE-2026-64507 →CVE-2026-72318 →

📋 Description

CVE-2026-43332 — kernel: thermal: core: Fix thermal zone device registration error path CVE-2026-63925 — kernel: macsec: fix replay protection at XPN lower-PN wrap CVE-2026-64191 — kernel: i2c: stub: Reject I2C block transfers with invalid length CVE-2026-64385 — kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation CVE-2026-64507 — kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation CVE-2026-64508 — kernel: bpf: Support for hardening against JIT spraying CVE-2026-68123 — kernel: openvswitch: fix GSO userspace truncation underflow CVE-2026-72289 — kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it CVE-2026-72318 — kernel: cifs: validate DFS referral string offsets CVE-2026-80521 — kernel: af_unix: Unlink scc_entry in unix_del_edge() CVE-2026-89970 — kernel: nvmet-auth: Synchronize timeout work during SQ teardown

🎯 Affected products200

  • 10Base-SMTV
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux Hidden (v. 10)
  • Red Hat Enterprise Linux Real Time (v. 10)
  • Red Hat Enterprise Linux Real Time for NFV (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-0:6.12.0-211.65.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debug-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-debug-devel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-devel-matched-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debug-modules-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-core-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debug-modules-extra-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • kernel-64k-debuginfo-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10)
  • kernel-64k-devel-0:6.12.0-211.65.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This flaw is triggered when the kernel SMB client processes crafted responses from a malicious or compromised SMB server. As a workaround, avoid mounting or accessing SMB/CIFS shares from untrusted servers, and disconnect existing mounts from servers that are not fully trusted. A complete fix requires updating to a kernel that contains the fix once it is available for the affected stream. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue on systems where unprivileged BPF is enabled, configure the kernel to disallow unprivileged users from loading BPF programs. 1. Temporarily apply the configuration at runtime: # sysctl -w kernel.unprivileged_bpf_disabled=1 2. To make this setting persistent across system reboots, write the parameter to a sysctl configuration file: # echo "kernel.unprivileged_bpf_disabled = 1" > /etc/sysctl.d/99-disable-unprivileged-bpf.conf # sysctl --system Caveats: Disabling unprivileged BPF prevents unprivileged user processes and unprivileged containers from loading BPF programs, which may impact non-root monitoring or tracing tools. Privileged accounts and processes retaining CAP_SYS_ADMIN or CAP_BPF are unaffected and can still load programs. Modifying this sysctl setting takes effect immediately and does not require a system restart or service reload. Workaround: Prevent the CIFS kernel module from loading if SMB/CIFS network file shares are not required: 1. Blacklist the `cifs` kernel module by creating a modprobe configuration file: ``` echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf ``` 2. If the module is currently loaded, unmount all active CIFS mounts and unload the module: ``` modprobe -r cifs ``` Caveats: Disabling the `cifs` module prevents the system from mounting SMB and CIFS network file systems. If active shares cannot be unmounted or the module cannot be unloaded immediately, a system reboot will be required to apply the change. Workaround: Prevent the NVMe target kernel module from loading if the host is not intended to operate as an NVMe over Fabrics target server. 1. Create a modprobe configuration file to disable the module: # echo "install nvmet /bin/true" > /etc/modprobe.d/disable-nvmet.conf 2. If the module is already loaded, remove it: # modprobe -r nvmet Caveats: This configuration prevents the host from functioning as an NVMe-oF target. It does not disrupt normal NVMe host/initiator storage capabilities. Warning: If the nvmet module is currently in use, removing it or restarting the host will terminate existing NVMe target storage connections and disrupt attached clients.

🔗 References (14)