Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
* kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
* kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
* kernel:
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
* kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
* kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
* kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
* kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
* kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-202
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
* kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
* kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
* kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
* kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
* kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: drm/amdgpu: fix lifetime is
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
* kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)
* kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
* kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)
* kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
* kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035)
* kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-202
Moderate: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
* kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
Bug Fix(es) and Enhancement(s):
* Backport of protocol attribute to IP addresses (IFA_PROTO) [rhel-9.8.z] (JIRA:Rocky Linux-169936)
* try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.8.
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)
* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
* kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)
* kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)
* kernel: perf/core: Deta
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)
* kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
* kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)
* kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)
* kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)
* kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)
* kernel: netfilter: nf_queu
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
* kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)
* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_unini
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: net: ena: PHC: Fix p
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
* kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
* kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
* kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-202
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
* kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
* kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-6431
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
* kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
* kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
* kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
* kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
* kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
* kernel: nfsd: fix posix_acl leak on SE
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
*
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202)
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
Bug Fix(es) and Enhancement(s):
* [Rocky Linux9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [rhel-9.8.z] (JIRA:Rocky Linux-214434)
* Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [rhel-9.8.z] (JIRA:Rocky Linux-220787)
For more details about the security issue(s), includin
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)
* kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
* kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)
Bug Fix(es) and Enhancement(s):
* Kernel oops after increasing max number of mac addresses of a mlx5 VF [rhel-9.8.z] (JIRA:Rocky Linux-213036)
* Rocky Linux