RHSA-2026:76739 — Security Advisory

An update for kernel is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

• kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

• kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

• kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)

• kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

• kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

• kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

• kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

• kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

• kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

• kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 ↗ (CVE-2026-63994)

• kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)

• kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

• kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

Bug Fix(es) and Enhancement(s):

• [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z] (JIRA:RHEL-254192)

• hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z] (JIRA:RHEL-262029)

• RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892)

• Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.