RLSA-2026:98099: Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)
kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
kernel: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)
kernel: ALSA: seq: midi: Serialize input teardown with eventinput (CVE-2026-90207)
kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)
kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)
kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)
kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.185.1.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What attacker access is reflected by the advisory's severity vector?
The supplied CVSS vector indicates local access with low privileges is required and no user interaction is needed. It also indicates high potential impact to confidentiality, integrity, and availability, with scope unchanged.
Which systems can be identified as in scope from this advisory?
The advisory identifies Rocky Linux kernel packages as the affected software. It does not provide affected or fixed package versions, release-specific applicability, or configuration prerequisites.
Are temporary mitigations documented if the kernel update cannot be applied immediately?
No alternative mitigations, service-disablement guidance, or configuration workarounds are provided in the supplied advisory data. The advisory identifies the kernel security update as containing fixes for the listed issues.