RLSA-2026:93412: Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
kernel: mptcp: pm: userspace: fix use-after-free in getlocalid (CVE-2026-68169)
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
kernel: packet: use consistent hardheaderlen in non-ring send paths (CVE-2026-74582)
kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
kernel: smb: client: bound dirent name against end of SMB response in cifsfilldir (CVE-2026-93787)
kernel: xfrm: hold netdevice reference under RCU in bundle creation (CVE-2026-98364)
kernel: ipv4: free inetopt and ireqopt after an RCU grace period (CVE-2026-98432)
kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
kernel: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge() (CVE-2026-98725)
kernel: ZDI-CAN-33367: Linux Kernel skbuff skbzerocopy Improper Ownership Management Local Privilege Escalation Vulnerability ()
Bug Fix(es) and Enhancement(s):
kernel panic in percpucounteraddbatch() via submitbionoacct() due to NULL pointer (JIRA:Rocky Linux-250378)
ipv4: ipgre: make ipgreheader() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)
ip6gre: make ip6greheader() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)
Backport "sched: The newidle balance regression" series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky Linux-288067)
Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z] (JIRA:Rocky Linux-291352)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-687.64.1.el9_8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize systems running the Rocky Linux kernel packages identified by the advisory. The update addresses multiple kernel issues, including use-after-free flaws in components such as MPTCP, iSCSI, Bluetooth, virtio-fs, and SCTP.
Does the supplied severity information indicate that authentication or user interaction is required?
The provided CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating network attackability, low attack complexity, no required privileges, and no required user interaction for the vulnerability rating. It also indicates high potential impact to confidentiality, integrity, and availability.
Can I determine from this advisory whether a host is vulnerable or which kernel version fixes it?
No. The supplied data does not include affected or fixed kernel version numbers, package release details, default-configuration conditions, or compromise detection indicators.