RHSA-2026:90365 — Security Advisory

An update for kernel is now available for Red Hat Enterprise Linux 9.8 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974)

• kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

• kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)

• kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)

• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

• kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)

• kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)

• kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

• kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)

• kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

• kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)

• kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

• kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

• kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

• kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

Bug Fix(es) and Enhancement(s):

• kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:RHEL-257205)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.