RHSA-2026:91492 — Security Advisory

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (CVE-2024-36286)

• kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797)

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

• kernel: Linux kernel: xfrm single-frag length not properly limited ()

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

• kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

• kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

• kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

• kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

• kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)

• kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

• kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

Bug Fix(es) and Enhancement(s):

• kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-9.6.z] (JIRA:RHEL-186330)

• Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [rhel-9.6.z] (JIRA:RHEL-224488)

• Kernel panic reboot node with kernal version 5.14.0-427.68.1.el9_4 (JIRA:RHEL-260120)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.