RHSA-2026:93437HighCVSS 8.8

Red Hat Security Advisory: kernel-rt security update

Published
November 2, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (6)

CVE-2026-63922 →CVE-2026-63924 →CVE-2026-64109 →CVE-2026-72083 →CVE-2026-74283 →CVE-2026-93787 →

📋 Description

CVE-2026-63922 — kernel: ipv6: exthdrs: refresh nh after handling HAO option CVE-2026-63924 — kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() CVE-2026-64109 — kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() CVE-2026-72083 — kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE CVE-2026-74283 — kernel: tipc: require net admin for TIPCv2 netlink mutators CVE-2026-93787 — kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

🎯 Affected products32

  • Red Hat Enterprise Linux NFV (v. 8)
  • Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.181.1.rt7.522.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.181.1.rt7.522.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-core-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-core-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-kvm-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-devel-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-devel-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-kvm-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.181.1.rt7.522.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw on hosts that do not operate as storage target servers, prevent the LIO target kernel modules from loading: 1. Create a configuration file to prevent loading the target modules: # echo "install iscsi_target_mod /bin/true" > /etc/modprobe.d/disable-iscsi_target.conf # echo "install target_core_mod /bin/true" > /etc/modprobe.d/disable-target_core.conf 2. Stop the SCSI target daemon if active: # systemctl stop target.service Warning: Modifying kernel module loading or stopping target.service requires a service restart or system reboot, and will immediately interrupt active storage connections on systems acting as storage targets. If the machine must function as an iSCSI target, use network firewall rules to restrict access to the iSCSI target port (TCP port 3260) strictly to authorized initiator hosts. Workaround: Prevent the TIPC kernel module from loading if Transparent Inter-Process Communication is not explicitly required: 1. Create a configuration file to disable the module: # echo "install tipc /bin/true" > /etc/modprobe.d/disable-tipc.conf # echo "blacklist tipc" >> /etc/modprobe.d/disable-tipc.conf 2. Unload the module if it is currently loaded: # modprobe -r tipc Caveats: Disabling the tipc module will break applications and services that rely on TIPC for clustering or inter-process communication. Warning: If the tipc module is actively in use, running `modprobe -r` will fail and a system reboot is required for the configuration changes to take full effect.

🔗 References (10)