RHSA-2026:98047: Important: kernel security update
Important: kernel security update
Other sources
The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es): kernel: netfilter: nfqueue: hold bridge skb->dev while queued (CVE-2026-52912) kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) kernel: net: ipgre: require CAPNETADMIN in the device netns for changelink (CVE-2026-63829) kernel: scsi: scsitransportfc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) kernel: tunnels: do not assume transport header in iptunnelpmtudcheckicmp() (CVE-2026-63992) kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) kernel: tunnels: load network headers after skbcow() in iptunnelpmtudbuildicmpv6 (CVE-2026-63994) kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) kernel: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path (CVE-2026-64534) kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) kernel: libceph: refresh auth->authorizerbuf{,len} after authorizer update (CVE-2026-68156) kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) kernel: vxlan: require CAPNETADMIN in the device netns for changelink (CVE-2026-68432) kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) kernel: net: ip6gre: require CAPNETADMIN in the device netns for changelink (CVE-2026-72052) kernel: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) kernel: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp() (CVE-2026-74569) kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) kernel: ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714) kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) kernel: netfilter: nfconntrack: use getunalignedbe32() in tcpsack() (CVE-2026-97417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/bpftoolto a version that resolves this vulnerability.Fixed in 7.3.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/bpftool-debuginfoto a version that resolves this vulnerability.Fixed in 7.3.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debugto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-devel-matchedto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debug-uki-virtto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-devel-matchedto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-docto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-headersto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-toolsto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-tools-libsto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-uki-virtto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/libperf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/perfto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/perf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/python3-perfto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/python3-perf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/rtlato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/rvto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-debuginfo-common-ppc64leto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debugto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-kvmto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-debug-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-kvmto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-rt-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/bpftoolto a version that resolves this vulnerability.Fixed in 7.3.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/bpftool-debuginfoto a version that resolves this vulnerability.Fixed in 7.3.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-debug-debuginfo-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-debug-devel-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-debug-devel-matched-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-debuginfo-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-devel-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 64k-devel-matched-5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debugto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-devel-matchedto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debug-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debuginfo-common-aarch64to a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-devel-matchedto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-headersto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-rt-debug-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-rt-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-toolsto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-tools-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-tools-libsto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/libperf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/perfto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/perf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/python3-perfto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/python3-perf-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/rtlato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/rvto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4.aa - Upgrade
Upgrade
redhat/kernel-debuginfo-common-s390xto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdumpto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-debuginfoto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-develto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-devel-matchedto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-modulesto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-modules-coreto a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Upgrade
Upgrade
redhat/kernel-zfcpdump-modules-extrato a version that resolves this vulnerability.Fixed in 5.14.0-427.162.1.el9_4 - Operational
Reboot the system after applying the kernel security update for the changes to take effect.