RHSA-2026:89083 — Security Advisory

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)

• kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

• kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

• kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

• kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

• kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138)

• kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)

• kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

• kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

• kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)

• kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

• kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

Bug Fix(es) and Enhancement(s):

• Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-8.10.z] (JIRA:RHEL-280584)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.