RHSA-2026:97040 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg (CVE-2026-23066)
• kernel: Kernel: Race condition in espintcp can lead to denial of service (CVE-2026-23239)
• kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem (CVE-2026-23240)
• kernel: Linux kernel: xfrm single-frag length not properly limited ()
• kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
• kernel: Revert "wireguard: device: enable threaded NAPI" (CVE-2026-52945)
• kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset (CVE-2026-52952)
• kernel: nfsd: fix dead ACL conflict guard in nfsd4_create (CVE-2026-53395)
• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
• kernel: nvme-pci: fix dma_vecs leak on p2p memory (CVE-2026-64020)
• kernel: xfrm: route MIGRATE notifications to caller's netns (CVE-2026-63914)
• kernel: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (CVE-2026-64025)
• kernel: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CVE-2026-63987)
• kernel: net: hsr: fix potential OOB access in supervision frame handling (CVE-2026-64000)
• kernel: bpf: Reject fragmented frames in devmap (CVE-2026-64355)
• kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)
• kernel: i2c: core: fix adapter deregistration race (CVE-2026-64279)
• kernel: proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)
• kernel: iio: event: Fix event FIFO reset race (CVE-2026-64496)
• kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle ()
• kernel: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups (CVE-2026-68390)
• kernel: drm/amdgpu: reject mapping a reserved doorbell to a new queue (CVE-2026-68103)
• kernel: tcp: fix TIME_WAIT socket reference leak on PSP policy failure (CVE-2026-68379)

Bug Fix(es) and Enhancement(s):

• Backport ESWIN drivers from upstream 6.19 (JIRA:RHEL-129062)
• [IBM 10.3 FEAT] Expose die_id and die_cpumask (JIRA:RHEL-138728)
• [RHEL 10 CIFS]: return Permission denied when mount krb5 with multichannel and max_channels (JIRA:RHEL-151838)
• RHIVOS - Backport NXP OCOTP fuse driver (JIRA:RHEL-152643)
• [nfsv3/nfsv4] kernel crash while nfs_lookup_revalidate was triggered. (JIRA:RHEL-153335)
• Reorganize socket binary layout for data locality (UDP prerequisites) (JIRA:RHEL-145975)
• CIFS: mount with "remount,invalid" return success [rhel-10] (JIRA:RHEL-150776)
• xfstests generic/126 fails with pNFS SCSI (JIRA:RHEL-135095)
• [RHEL-10] BUG: kernel NULL pointer dereference, address: 0000000000000000 in pagemap_scan_pmd_entry (JIRA:RHEL-97168)
• Fix the Mac address issue during the vdpa enablement (JIRA:RHEL-127007)
• CCP PSP fails to reinitialize after hibernation causing TEE errors (JIRA:RHEL-130538)
• AMD PMF driver timing issue which causes the custom BIOS input event value could not be saved properly (JIRA:RHEL-130539)
• autofs: excessive log entries when listing contents of indirect mount from propagation private namespace [rhel-10] (JIRA:RHEL-134674)
• block layer: update with upstream v6.19 (JIRA:RHEL-144763)
• [centos-stream-10/main] Enable CONFIG_AQTION for aarch64 (JIRA:RHEL-150852)
• general protection fault during exportfs / nfsd4_revoke_states [rhel-10] (JIRA:RHEL-152916)
• RFE: Install proper modules when installing kernel-selftests-internal (JIRA:RHEL-102523)
• [Broadcom 10.2 feat] bnxt_re: Update driver to the latest upstream version (JIRA:RHEL-108694)
• [RHEL 10.3] Backport upstream cgroup commits up to v6.18 (JIRA:RHEL-113305)
• [Intel 10.3 FEAT] [NVL] IO: Add Intel Human Interface Device ID (JIRA:RHEL-117305)
• [RHEL 10.x] Rebase drivers/firmware/arm_scmi to upstream v6.17 (JIRA:RHEL-120360)
• block: fix ordering of recursive split IO (JIRA:RHEL-122816)
• Reorganize the TCP socket binary layout for data locality (JIRA:RHEL-123211)
• RHEL 10.3 updates for drivers/i2c/busses/i2c-i801.c (JIRA:RHEL-129782)
• [RHEL-10.2] selftests: memfd:memfd_test failed (JIRA:RHEL-132213)
• [rhel-10.2] RHEL6/buildcheck failed on x86_64 and s390x when use out-of-tree (JIRA:RHEL-132871)
• [RHEL-10] Kernel panic at kfree() to free kvm_task_sleep_node (JIRA:RHEL-141540)
• NVIDIA:PCI: Add PCI_BRIDGE_NO_ALIASES quirk for ASPEED AST1150 - RHEL 10.2 (JIRA:RHEL-143320)
• [RHEL-10.2 debug] kmemleak detected at blktests nvme/057 (JIRA:RHEL-143907)
• backport "geneve: introduce double tunnel GSO/GRO support" (JIRA:RHEL-145367)
• [rhel-10] Accessing /proc/sys/user/* may trigger spurious sys_resource SELinux denials (JIRA:RHEL-145590)
• [RHEL-10.3 FEAT] USB/TB code rebase of supported drivers to upstream v6.18 (JIRA:RHEL-147788)
• [HP Bug 10.3] [TI AMP] Speaker Right channel sound is siginificant small (JIRA:RHEL-148197)
• Backport core net locking changes (JIRA:RHEL-150155)
• ftrace: backports fixes from stable [rhel-10.3] (JIRA:RHEL-151695)
• [RHEL 10] Update the kernel/time codebase up to v6.18 with fixes (JIRA:RHEL-152433)
• [RHEL-10.3] trigger kernel panic with block/039 (JIRA:RHEL-153616)
• blktests block/038 failed with possible circular locking dependency detected at: __kernfs_remove+0x1d3/0x600 and del_gendisk+0xfd/0x190 (JIRA:RHEL-154184)
• [kernel panic]BUG: unable to handle page fault for address (JIRA:RHEL-155383)
• RHEL10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs (JIRA:RHEL-155896)
• System hang with tasks stuck in pnfs_update_layout [rhel-10] (JIRA:RHEL-157444)
• RHEL10.0 - s390/pci: Avoid deadlock between error recovery and mlx5 crdump (JIRA:RHEL-157932)
• [Fujitsu 10.3 FEAT]: AGDI driver update for interrupt-based signaling mode support (JIRA:RHEL-111893)
• Restore IP ID correctly for encapsulated packets at GSO segmentation time (JIRA:RHEL-123213)
• [RHEL-10][hv_netvsc][Backport] net: hv_netvsc: reject RSS hash key programming without RX indirection table (JIRA:RHEL-145154)
• OOB in SMB2_open_free crashing the system [rhel-10] (JIRA:RHEL-154397)
• Build Failure Due to Missing xxd Dependency (JIRA:RHEL-157473)
• RHEL10.0 - dasd: Fix PPRC copy pair swap state and format information. (JIRA:RHEL-161531)
• Update PCI subsystem with content from v6.18 (JIRA:RHEL-139968)
• WARNING in get_xsave_addr/ssp_get: ptrace PTRACE_GETREGSET with NT_X86_CET on non-CET thread triggers WARN_ON in x86 FPU/CET code (JIRA:RHEL-152371)
• mlxbf-bootctl: driver update to Linux v6.16 [Nvidia 10.3 FEAT] (JIRA:RHEL-103899)
• RHEL10.1 [P11] [6.12.0-103.el10.ppc64le] FS/EXT4: generic/388 fails with warning at fs/ext4/super.c:1339 ext4_put_super+0x47c/0x580 [ext4] (JIRA:RHEL-108931)
• kselftest: charge_reserved_hugetlb.sh: Waiting for hugetlb memory reservation to reach size 2684354560 (JIRA:RHEL-130552)
• [RHEL10] va_high_addr_switch HugeTLB failure and bugs (JIRA:RHEL-134020)
• [ice]WARNING: CPU: 1 PID: 168931 at net/ipv4/udp_tunnel_nic.c:646 __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel] (JIRA:RHEL-143670)
• Reorganize socket binary layout for data locality (UDP) (JIRA:RHEL-145977)
• ALSA (sound) driver - update all drivers to the upstream for RHEL rhel-10.3 (upstream kernel 6.19) (JIRA:RHEL-152846)
• fix krb5 mount with username option [rhel-10] (JIRA:RHEL-158991)
• [AMDSERVER 10.3 Feature] Support CpuidUserDis (CPUID User Disable() (JIRA:RHEL-140358)
• NVIDIA:Backport gpio: tegra186: Simplify GPIO line name prefix handling - RHEL 10.3 (JIRA:RHEL-151653)
• NVIDIA: Backport iommu: Report effective PCIe ATS support status - RHEL 10.3 (JIRA:RHEL-160188)
• DGX Spark spurious reboots (JIRA:RHEL-163405)
• CONFIG_INIT_STACK_ALL_ZERO is not enabled for cs10 automotive kernel (JIRA:RHEL-164033)
• [Intel 10.3 FEAT] [NVL] IO: PCH: Add I2C Device ID (JIRA:RHEL-117325)
• IIO: Backport bmp280/bme280 driver from upstream (JIRA:RHEL-120353)
• RHEL 10.3 cpupower - updates (JIRA:RHEL-133086)
• kernel module .ko ELF files with non-zero sh_addr section addresses (JIRA:RHEL-152959)
• CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10] (JIRA:RHEL-162141)
• [RHEL10] VLAN creation does not immediately disable LRO on real dev (JIRA:RHEL-80405)
• [DELL 10.3 FEAT] - Include support soundwire on Intel PTL-H - Cirrus Logic IC Solution (JIRA:RHEL-85741)
• rtla low-latency BPF-side actions feature [rhel-10] (JIRA:RHEL-112653)
• [IBM 10.3 FEAT] perf interface support for capturing DTL (Dispatch Trace Log) data (JIRA:RHEL-138521)
• [RHEL-10.3 FEAT] USB/TB code rebase of supported drivers to upstream v6.19 (JIRA:RHEL-147795)
• [RHEL10.3] Rebase IOMMU and DMA Mapping API to v7.0 (JIRA:RHEL-147902)
• fanotify_mark() on an anonymous pipe should not hit an LSM/SELinux check (JIRA:RHEL-53850)
• clk: renesas: cpg-mssr: Fix 'soc' node handling in cpg_mssr_reserved_init() (JIRA:RHEL-77269)
• RHEL 10.3 turbostat updates (JIRA:RHEL-129778)
• [AMDSERVER 10.3 Feature] Debug interface to walk/dump IOMMU data structures (JIRA:RHEL-140474)
• Enable LTO for kernel-tools binaries to resolve annocheck failures (JIRA:RHEL-145204)
• ?? rtla does not have debuginfo [rhel-10.3] (JIRA:RHEL-85865)
• ?? rv does not have debuginfo [rhel-10.3] (JIRA:RHEL-85868)
• Enable sched and RTapp RV monitors [rhel-10.3] (JIRA:RHEL-116706)
• ZF - Enable Multi Channel SPI driver for OMAP [rhel-10] (JIRA:RHEL-118418)
• RHEL 10.3 update intel_idle (JIRA:RHEL-129779)
• RHEL 10.3 intel_pstate updates (JIRA:RHEL-133082)
• Update PCI subsystem with content from v6.19 (JIRA:RHEL-139975)
• NVIDIA:CPPC: Enhanced autonomous selection and improvements- RHEL 10.2 (JIRA:RHEL-143330)
• NVIDIA:CPPC: Backport online CPU fixes - RHEL 10.3 (JIRA:RHEL-151651)
• Rebase Bluetooth stack to kernel v6.19 [rhel-10.3] (JIRA:RHEL-157827)
• [RHEL10.3] Rebase x86/resctrl up to v7.0 (JIRA:RHEL-163514)
• zl3073x: update the driver to upstream v7.0 (JIRA:RHEL-164429)
• [RFE][sfc] software tx timestamping needed for ptp4l [rhel-10] (JIRA:RHEL-165819)
• RHIVOS - QCOM_SCM (JIRA:RHEL-170163)
• NVIDIA:Backport VMM can handle guest SEA via KVM_EXIT_ARM_SEA - RHEL 10.3 (JIRA:RHEL-133965)
• [KASLR] Proactive backports RHEL-10.3 (JIRA:RHEL-144438)
• [Audit] Proactive backports RHEL-10.3 (JIRA:RHEL-145403)
• [rhel-10 wireless] Wireless core and drivers rebase to v6.19 (JIRA:RHEL-145612)
• [rhel-10] MHI bus update to v6.19 (JIRA:RHEL-151312)
• kselftests mm - vmalloc: OOM panic on Aarch64 64k kernel. (JIRA:RHEL-151432)
• xxhash64 should not be fips approved (JIRA:RHEL-154016)
• selftests: net: unify the Makefile formats (JIRA:RHEL-155384)
• [RHEL-10.3] BUG: kernel NULL dereference during kdump in intel gen14+ systems (JIRA:RHEL-161592)
• RHEL10.0 - s390/mm: Add missing secure storage access fixups (JIRA:RHEL-168792)
• RHEL10: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [rhel-10] (JIRA:RHEL-171460)
• oslat normal prio isolated high spike from kworker (JIRA:RHEL-68981)
• RHEL-10.3 kvm/arm: rebase up to v7.0 (JIRA:RHEL-157318)
• RHEL 10.3 update drivers/platform/x86/intel/pmc (JIRA:RHEL-129781)
• RHEL 10.3 update drivers/thermal/intel (JIRA:RHEL-130009)
• RHEL 10.3 Update Intel MCE (JIRA:RHEL-130026)
• RHEL 10.3 platform/x86/intel/tpmi and platform/x86: ISST updates (JIRA:RHEL-133093)
• mlx5: introduce CX9 PCI ID (JIRA:RHEL-142605)
• mlx5: introduce BF4 PCI ID (JIRA:RHEL-142608)
• [rhel-10] [aarch64] sched: DL de-boosted task PID 22725: REPLENISH flag missing - WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 (JIRA:RHEL-145610)
• Scheduler updates for 10.3 (JIRA:RHEL-147186)
• NVIDIA: Backport arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (JIRA:RHEL-154155)
• [RHEL-10.2] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t (JIRA:RHEL-161187)
• mlx5: Disable ConnectX-10 (JIRA:RHEL-166116)
• RHEL 10.2 tpm crb failing (JIRA:RHEL-167985)
• [RHEL10] Update SPD5118 and I3C drivers from upstream v7.0 (JIRA:RHEL-168906)
• CNB103: PCI/PTM: Drop pci_enable_ptm() granularity parameter (JIRA:RHEL-172222)
• NVIDIA:Grace-Hopper:Backport mm: Implement ECC handling for pfn with no struct page - RHEL 10.1 (JIRA:RHEL-73608)
• [RHEL-10.3] NVIDIA:Backport arm_mpam: Add basic mpam driver (JIRA:RHEL-100932)
• [RHEL-10] panic during suspend and hibernate on systems with Intel E810 NICs (JIRA:RHEL-147247)
• CNB103: BIG TCP without HBH in IPv6 (JIRA:RHEL-156515)
• [GNR-D DPLL] zl3073x: Implement ref-sync support (JIRA:RHEL-157828)
• [HPEMC BUG RHEL 10] x86/platform/uv: fix panic when deconfiguring socket. (JIRA:RHEL-158967)
• [RHEL-10.3] WARNING: CPU: 11 PID: 704 at crypto/crypto_engine.c:58 crypto_finalize_request (JIRA:RHEL-159000)
• NVIDIA: Backport iommu/tegra241-cmdqv: Fix initialization and uAPI related to HYP_OWN - RHEL 10.3 (JIRA:RHEL-160189)
• CNB103: Update RDMA core to Linux v7.0 (JIRA:RHEL-163515)
• [RHEL10.3] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:RHEL-164699)
• [GNR-D DPLL] zl3073x: Implement frequency monitoring (JIRA:RHEL-165161)
• RHEL10.0 - s390/pfault: Fix virtual vs physical address confusion (JIRA:RHEL-170908)
• CNB103: lib/vsprintf: Add specifier for printing struct timespec64 (JIRA:RHEL-172105)
• ice: backport changes to default number of RSS queues (JIRA:RHEL-172305)
• RHEL10.0 - s390: nospec hardening for entry code (JIRA:RHEL-174629)
• bpf: update to upstream v6.18 (JIRA:RHEL-78291)
• CNB103: lib/bitmap: update to v7.1 (JIRA:RHEL-174745)
• zl3073x: update the driver to upstream v7.1 (JIRA:RHEL-171979)
• [RHEL10.3] NVIDIA:Backport arm_mpam: Add KVM/arm64 and resctrl glue code (JIRA:RHEL-164228)
• i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" [rhel-10] (JIRA:RHEL-154387)
• [rhel10] ltp cpuset_hotplug failed: test task was still in general group, but its cpus is NULL (JIRA:RHEL-160958)
• [IBM 10.3 FEAT] Set Kernel Config Option CONFIG_SCLP_OFB=y (JIRA:RHEL-170705)
• Rebase Bluetooth stack to kernel v7.0 [rhel-10.3] (JIRA:RHEL-172460)
• CNB103: slab: Introduce kmalloc_obj() and family (JIRA:RHEL-174796)
• NVIDIA:Grace-Hopper:Backport iommu/arm-smmu-v3: Introduce an RCU-protected invalidation array - RHEL 10.2 (JIRA:RHEL-88961)
• [RHEL10] blktests block/037 failed at "tests/block/037: line 42: echo: write error: Cannot allocate memory" (JIRA:RHEL-93825)
• [Intel 10.3 FEAT] [NVL] power: Enable intel_rapl driver (JIRA:RHEL-117269)
• RHEL 10.3 AMD PMF driver updates (JIRA:RHEL-127641)
• RHEL 10.3 amd-pstate updates (JIRA:RHEL-127643)
• RHEL 10.3 Update drivers/hwmon/k10temp.c (JIRA:RHEL-127650)
• bpf: update to upstream v6.19 (JIRA:RHEL-139985)
• [RHEL 10.3] Backport EFI support up through linux v6.19 (JIRA:RHEL-164371)
• The kernel still panicked in cached_dir_offload_close despite applying commit 734e99623c5b [rhel-10] (JIRA:RHEL-171638)
• NVIDIA:Vera: Add support for FEAT_{LS64, LS64_V} and related tests (JIRA:RHEL-151899)
• ibmveth Adapter Freeze with Small MSS (JIRA:RHEL-175521)
• Update PCI subsystem with content from v7.0 (JIRA:RHEL-151449)
• ses enclosure devices attach to scsi devices on different scsi hosts from the enclosure (JIRA:RHEL-153020)
• kernel: fs/notify: call exportfs_encode_fid with s_umount (JIRA:RHEL-167108)
• [RHEL-10.3] crypto: authenc - Correctly pass EINPROGRESS back up to the caller (JIRA:RHEL-130557)
• [10.3] drivers/video rebase (fbcon/fbdev) (JIRA:RHEL-135265)
• [IBM 10.3 FEAT] Support 128 KB tape block sizes (JIRA:RHEL-136091)
• Core entry refactor: generic entry split required for arm64 v6.18 backports (JIRA:RHEL-150903)
• backport of upstream commit 2da20fd ("kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count") and aaf05e9 ("kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count") to RHEL 9 and RHEL 10. [rhel-10] (JIRA:RHEL-154147)
• update drivers/base subsystem to match upstream Linux v7.0 for RHEL-10.3 (JIRA:RHEL-156428)
• [RHEL10] WARNING: possible recursive locking detected at pqi_shutdown+0xd5/0x470 [smartpqi] (JIRA:RHEL-169577)
• DPLL: Add support for pin operational state (JIRA:RHEL-173188)
• DPLL: Add support for fractional frequency offset between pin and device (JIRA:RHEL-173193)
• cs10/main-ivos-qualcomm: [PDR team task] Validator Failure: config-io-uring-disabled (kernel-automotive-6.12.0-211.el10iv) (JIRA:RHEL-178183)
• ALSA (sound) driver - update all drivers to the upstream for RHEL 10.3 (upstream kernel 7.0) (JIRA:RHEL-168082)
• NVIDIA: Backport iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate - RHEL 10.3 (JIRA:RHEL-155346)
• [Intel 10.3 FEAT] [NVL] security: mei: Add platform to Management Engine Interface (mei) driver (JIRA:RHEL-117353)
• RHEL 10.3 pinctrl: updates for intel (JIRA:RHEL-129783)
• RHEL 10.3 Update platform/x86/intel-uncore-freq (JIRA:RHEL-133081)
• CLONE - [RHEL 10.2 Bug] qla2xxx flash image validation failure (JIRA:RHEL-157286)
• rbd: eliminate a race in lock_dwork draining on unmap (JIRA:RHEL-180187)
• NVIDIA:Kernel support for Vera PMU - RHEL 10.3 (JIRA:RHEL-110828)
• [10.3] MDRAID - Update to the latest upstream (JIRA:RHEL-129337)
• NVIDIA:i2c support for T410 (Vera) - RHEL 10.3 (JIRA:RHEL-143333)
• [RHEL 10.3] riscv core updates for rva23 (JIRA:RHEL-147291)
• Kernel panic while shutting down ice driver due to use-after-free (JIRA:RHEL-163186)
• CrowdStrike: Request to backport upstream ef378c3b8233 [rhel-10.3] (JIRA:RHEL-180193)
• RHEL10.2 : When fadump enabled seeing error message "Failed to init cma area for firmware-assisted dump" (JIRA:RHEL-174883)
• BPF test_progs fail due to missing configuration (JIRA:RHEL-76113)
• [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part (JIRA:RHEL-113464)
• [Lenovo 10.3 FEAT]Intel ice driver update (JIRA:RHEL-137412)
• CNB103: Add support for io_uring zero copy rx (JIRA:RHEL-141853)
• Objtool 10.3: backports from upstream linux 7.0 (JIRA:RHEL-152189)
• Livepatch 10.3: backports from upstream linux 7.0 (JIRA:RHEL-152193)
• tcp: stable backport for 10.3 phase 1 (JIRA:RHEL-152718)
• tunnels: stable backport for 10.3 phase 1 (JIRA:RHEL-152728)
• wireguard: stable backport for 10.3 phase 1 (JIRA:RHEL-152735)
• [Intel 10.3 FEAT] [DMR] Accel-DSA: dmaengine: idxd: Add support for DSA 3.0 devices (JIRA:RHEL-154485)
• Update ACPI support to match upstream v7.0 for RHEL 10.3 (JIRA:RHEL-156420)
• Backport S32G3 SAR ADC driver (JIRA:RHEL-156761)
• netfilter: rebase to 7.1-rc2 (JIRA:RHEL-168848)
• rtmutex: Fix potential UAF of a task's pi_blocked_on field (JIRA:RHEL-171746)
• [RHEL10.3] DMA Engine: backport recent fixes to RHEL10.3 for supported drivers (JIRA:RHEL-172442)
• RHIVOS - P&S: NXP S32G Optimization ? Build storage driver into kernel (JIRA:RHEL-181039)
• crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (JIRA:RHEL-182119)
• [RHEL 10.3] BUG: KASAN: slab-use-after-free in io_kbuf_recycle_legacy+0x463/0x5c0 (JIRA:RHEL-183200)
• RHEL 10: Backport b95e0e792822 (JIRA:RHEL-183464)
• RHEL 10.3 DRM backport - dependencies (JIRA:RHEL-176018)
• IOMMU/AMD: Mark IOMMUFD support as tech preview (JIRA:RHEL-168270)
• Core net locking changes follow-ups (JIRA:RHEL-161561)
• [IBM 10.3 FEAT] Upgrade the QETH driver to latest from upstream, e.g. kernel 6.20 (JIRA:RHEL-136140)
• [Intel 10.3 FEAT] [DMR][NVL] CPU: Add Advanced Performance Extensions (APX) instruction (JIRA:RHEL-115162)
• [AMDSERVER 10.3 Feature] Venice: Add support for new SMCA bank types (JIRA:RHEL-100951)
• RHEL 10.3 Updates for platform/x86/intel/pmt (JIRA:RHEL-133094)
• [RHEL10.2] Dlpar of memory is hung for more than 20 hrs, waiting to free one of the page frame but reference count showing 2 indicating still in use. (JIRA:RHEL-146153)
• Rebase vfio to v7.1-rc1 (JIRA:RHEL-149504)
• RHEL 10.3 turbostat fixes (JIRA:RHEL-172176)
• Adding missing commit for RHEL-174629 (JIRA:RHEL-183314)
• [rhel-10] Long not preemteble time in tpm_hwrng_read on RL300 (JIRA:RHEL-69440)
• [RHEL10.0] WARNING: CPU: 0 PID: 54877 at mm/page_alloc.c:694 __del_page_from_free_list+0x2b0/0x380 (JIRA:RHEL-74463)
• [Intel 10.2 FEAT] [WCL-U] x86: Add vsec device ID to support PMT features (Crash Log, Telemetry Aggregator) (JIRA:RHEL-95636)
• Move vdoformat functionality into the kernel module (JIRA:RHEL-113137)
• [RHEL10] device-mapper: verity-fec: 9:127: FEC: recursion too deep (JIRA:RHEL-127492)
• [Broadcom 10.3 feat] bnxt_re: Update driver to the latest upstream version (JIRA:RHEL-135357)
• [IBM 10.3 FEAT] Upgrade the SMC driver to latest from upstream, e.g. kernel 6.20 (JIRA:RHEL-136142)
• [IBM 10.3 FEAT] Update dm-crypt/dm-integrity Subsystem to 6.19+ Level (Secure Execution) (JIRA:RHEL-136802)
• dm-integrity returns I/O error after growing the device in bitmap mode. (JIRA:RHEL-144458)
• Hit Reservation conflict when unregister the key on failovering multipath [rhel-10] (JIRA:RHEL-148451)
• [RHEL-10.3] dm: sync with upstream v6.19 (JIRA:RHEL-154975)
• dm cache: Memory leak on metadata abort when dealing concurrent metadata io errors (JIRA:RHEL-155190)
• Add Gemini / Epoch code to kernel.spec file for rv and rv-debuginfo [rhel-10.3] (JIRA:RHEL-163488)
• dm thin: possible race during parallel activity leading to what looks like it could be discard/delete race leading to an error [rhel-10] (JIRA:RHEL-169623)
• CNB103: net: Introduce netif_xmit_timeout_ms() helper (JIRA:RHEL-180966)
• RHEL 10: s390: Revert support for DCACHE_WORD_ACCESS (JIRA:RHEL-184095)
• Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.3] (JIRA:RHEL-185115)
• Kernel NULL pointer dereference while writing to a dm-cache device in passthrough mode (JIRA:RHEL-92782)
• CNB103: net: Add 1600Gbps (1.6T) link mode support (JIRA:RHEL-165176)
• Update NFS/NFSD/LOCKD/SUNRPC RHEL10.3 to 7.1 (JIRA:RHEL-171581)
• Sched required late fixes for 10.3 (JIRA:RHEL-174703)
• [RHEL10] WARNING: possible circular locking dependency detected (rhashtable_bucket --> &rq->__lock --> &dsq->lock) (JIRA:RHEL-115002)
• [IBM 10.3 FEAT] in-kernel crypto: disable default use of clear keys by PAES and PHMAC (JIRA:RHEL-136440)
• [IBM 10.3 FEAT] KVM: Enhancement for IBM Test Accelerator for Z (TAZ) (JIRA:RHEL-136477)
• tegra-se fixes and updates [RHEL-10.3] (JIRA:RHEL-176465)
• Please sign CentOS Stream kernels with 800 series certificates (JIRA:RHEL-178260)
• [RHEL10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath (JIRA:RHEL-185104)
• RHEL10.0 - KVM: s390: Increase SE header size from 8 KiB to 1 MiB. (JIRA:RHEL-185661)
• RHEL10.3 - crash at device_del+61 when removing NVMe/FC controller (JIRA:RHEL-186079)
• evm=fix doesn't work when a file already has IMA signature stored in security.ima (JIRA:RHEL-104343)
• Integrate rtla code consolidation work into rhel-10.3 (JIRA:RHEL-115523)
• Improve RTLA auto-analysis stack print not to stop at unknown function [rhel-10] (JIRA:RHEL-136812)
• rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.3] (JIRA:RHEL-147742)
• Rebase RTLA to upstream 7.1 [rhel-10.3] (JIRA:RHEL-151369)
• RTLA segfaults on freed memory access on double SIGINT [rhel-10.3] (JIRA:RHEL-151475)
• RHEL 10.3 Update MEI to upstream 7.0 (JIRA:RHEL-177639)
• x86/microcode: Add platform mask to Intel microcode "old" list [RHEL-10] (JIRA:RHEL-184788)
• [RHEL10] scsi device removal may hang from race with error recovery (JIRA:RHEL-186142)
• irdma: update driver to v7.0 (JIRA:RHEL-186151)
• [Intel 10.4 FEAT] [NVL] GPIO: Add ACPI GPIO events support PCH GPEs (JIRA:RHEL-117349)
• RHEL 10.3 update intel_rapl (JIRA:RHEL-130025)
• NVIDIA:soc/tegra: Use Arm SMCCC to get chip ID, revision, and platform info - RHEL 10.3 (JIRA:RHEL-143339)
• [RHEL 10.3] SpacemiT SoC base driver backport (JIRA:RHEL-174301)
• [RHEL 10.3] Update StarFive JH7110 drivers and DT (JIRA:RHEL-174305)
• RHEL 10.3 platform/x86/amd: hfi updates (JIRA:RHEL-176387)
• rhel 10.3 Update drivers/platform/x86/intel to upstream 7.0 (JIRA:RHEL-176441)
• RHEL 10.3 fix for platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (JIRA:RHEL-182291)
• dma-debug triggers a possibly false positive kernel warning on x86_64 (JIRA:RHEL-182720)
• [RHEL 10.3] ACPI Fixes for RISC-V (JIRA:RHEL-187991)
• [RHEL 10.3] Fix RISC-V regression from kernel-6.12.0-234 (JIRA:RHEL-188766)
• Objtool 10.3: backports from upstream linux 7.1 (JIRA:RHEL-152190)
• [RHEL10.3] kernel \ Storage \ Kernel Target (LIO): Component Rebase (JIRA:RHEL-163760)
• CNB103: arm64/simd: Add scoped guard API for kernel mode SIMD (JIRA:RHEL-180976)
• [FEAT] CNB103: net: add basic PSP encryption for TCP connections (JIRA:RHEL-185448)
• prctl for PR_GET_NAME returns number of /dev/fd/ instead of program, when script executes under sudo + checksum verification (JIRA:RHEL-95059)
• [AMDSERVER 10.2 Feature] Venice: EDAC Updates (JIRA:RHEL-100950)
• CNB103: Ethtool: update (phase 1 ) ethtool to v7.0-rc7 (JIRA:RHEL-167299)
• [rhel-10] MHI bus update to v7.0 (JIRA:RHEL-171362)
• CNB103: bridge: update bridge/switchdev core to upstream v7 (JIRA:RHEL-171990)
• Update cpufreq to match Linux v7.0 for RHEL-10.3 (JIRA:RHEL-176381)
• Update cpuidle to match Linux v7.0 for RHEL-10.3 (JIRA:RHEL-176383)
• System crash observed during lpfc driver load/unload (JIRA:RHEL-178259)
• gve: backport large queue depth patches (JIRA:RHEL-178516)
• [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface (JIRA:RHEL-182561)
• Update crypto subsystem to upstream kernel 6.14 (JIRA:RHEL-186630)
• CNB103: net: sleepable ndo_set_rx_mode (JIRA:RHEL-186369)
• Post Rebase fixes for Bluetooth kernel v7.0 [rhel-10.3] (JIRA:RHEL-184635)
• proactively backport the fix for CVE-2026-52943 (10.3) (JIRA:RHEL-192922)
• rhel 10.3 fix for powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() (JIRA:RHEL-193546)
• Livepatch 10.3: backports from upstream linux 7.1 (JIRA:RHEL-152194)
• [RHEL-10.3] mounting NFS share over rdma causes kernel Oops (JIRA:RHEL-192306)
• MediaTek SoC enablement (JIRA:RHEL-191344)
• vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter (JIRA:RHEL-189045)
• kernel-headers: linux/vm_sockets.h fails to compile standalone ? missing sa_family_t definition breaks AC_CHECK_HEADERS auto-detection (JIRA:RHEL-185312)
• Revert commit 2a010c412853 that allows writing to running executable (JIRA:RHEL-159585)
• CNB103: PCI/TPH: Expose pcie_tph_get_st_table_loc/size() (JIRA:RHEL-186643)
• [RHEL 10.3] Futex bug fixes (JIRA:RHEL-183513)
• tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds (JIRA:RHEL-179033)
• [AMDSERVER 10.3 Bug] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19 (JIRA:RHEL-179516)
• [10.3] ynl update (JIRA:RHEL-156508)
• perf: update to upstream v6.19 (JIRA:RHEL-140195)
• [RHEL10] Hung Task Detector improvements (JIRA:RHEL-146067)
• [RHEL 10.3] Fix RISC-V build failure from kernel-6.12.0-249 (JIRA:RHEL-212287)
• RHIVOS - S32G: update devicetree and drivers to v7.2-rc3 (JIRA:RHEL-212089)
• RHIVOS - S32G: backport and enable pwm driver (JIRA:RHEL-210979)
• RHIVOS - S32G: backport and enable ina2xx (JIRA:RHEL-193670)
• Rhel10-2[6.12.0-191.el10.ppc64le]-dmesg-nvram-1 file under /sys/fs/pstore is not getting updated after fadump (JIRA:RHEL-191988)
• RHIVOS - S32G: backport upstream rtc-pcf85063 changes (JIRA:RHEL-190843)
• RHIVOS - S32G: backport upstream gpio-pca953x changes (JIRA:RHEL-190842)
• RHEL10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (JIRA:RHEL-190428)
• RHEL10.0 - s390/pkey: Check length in pkey_pckmo handler implementation (JIRA:RHEL-190427)
• Proper upstream fix for CVE-2026-46054 execmem regression [rhel-10] (JIRA:RHEL-189741)
• [IBM 10.3 FEAT] Support new PCI adapter notification actions for Spyre and NVMe (JIRA:RHEL-188089)
• [Intel 10.3 FEAT] [BTL-S] cpufreq: intel_pstate: Fix scaling factor on Raptor Lake-E (JIRA:RHEL-185959)
• WARNING: inconsistent lock state with scx_dump_state (JIRA:RHEL-184683)
• backport make module and modules-core provides use variant (JIRA:RHEL-183433)
• rxrpc: Address CVE-2026-43500 (JIRA:RHEL-178253)
• [RHEL-10.3] Revert RHEL commit 6eeda30acfff8 Disable CET in shutdown (rhel-109479) (JIRA:RHEL-177961)
• Backport upstream solution to isolate EFI Runtime Services to a CPU [RHEL-10.x] (JIRA:RHEL-175660)
• mlxbf-pmc: driver update to Linux v6.19 [Nvidia 10.3 FEAT] (JIRA:RHEL-167064)
• Change child_ns_mode mode fail after module reload (JIRA:RHEL-155388)
• core: stable backport for 10.3 phase 1 (JIRA:RHEL-152734)
• tipc: stable backport for 10.3 phase 1 (JIRA:RHEL-152740)
• Revert 5 commits to allow mm kselftests to build (JIRA:RHEL-214159)
• MediaTek MT6577 UART enablement (JIRA:RHEL-191347)
• MediaTek MT7925 Bluetooth enablement (JIRA:RHEL-191262)
• [IBM 10.3 FEAT] KVM: Add capability that forwards operation exceptions (KVM_CAP_S390_USER_OPEREXEC) (JIRA:RHEL-158929)
• RHEL 10.3 DRM backport to 7.0 (JIRA:RHEL-170737)
• NVIDIA: Backport i2c: tegra: Update Tegra410 I2C timing parameters - RHEL 10.3 (JIRA:RHEL-174252)
• rhel 10.3 fix platform/x86/intel/tpmi/plr: Prevent fault during unbind (JIRA:RHEL-182358)
• KVM: s390: Limit adapter indicator access to mapped page [rhel-10.3 ] (JIRA:RHEL-183882)
• RHEL 10.3 fixes for tools/power/x86/intel-speed-select from 7.1 (JIRA:RHEL-184884)
• RHEL 10.3 intel_idle: Add Panther Lake C-states table (JIRA:RHEL-185572)
• Prepare for enabling of CONFIG_PINCTRL_MTK_PARIS (JIRA:RHEL-191293)
• RHEL 10.3 fix platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1) (JIRA:RHEL-208745)
• RHEL 10.3 fix cpufreq: intel_pstate: Sync policy->cur during CPU offline (JIRA:RHEL-210859)
• RHEL 10.3 fix x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() (JIRA:RHEL-211103)
• RHEL 10.3 fix iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (JIRA:RHEL-212108)
• RHEL 10.3 fix i2c: i801: fix hardware state machine corruption in error path (JIRA:RHEL-212367)
• RHEL 10.3 fix platform/x86: intel-hid: Protect ACPI notify handler against recursion (JIRA:RHEL-213294)
• RHEL 10.3 fix x86/fpu: Ensure XFD state on signal delivery (JIRA:RHEL-213537)
• Update kernel to use new certificate paths (JIRA:RHEL-169468)
• [Intel 10.3 FEAT] QAT: kernel changes (JIRA:RHEL-115836)
• tls: stable backport for 10.3 phase 1 (JIRA:RHEL-152729)
• Possible regression with FM350GL (JIRA:RHEL-155042)
• RHEL 10.3 ahci driver fixes (JIRA:RHEL-157217)
• [rhel-10] scatterwalk_map_and_copy - Unable to handle kernel NULL pointer dereference at virtual address (JIRA:RHEL-169756)
• [RHEL-10.3] Update drivers/input and related directories to upstream kernel V7.1+ (JIRA:RHEL-176366)
• kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-10] (JIRA:RHEL-186335)
• [10.3 FEAT] e1000, e1000e: drivers update (JIRA:RHEL-186602)
• CIFS/ksmbd/netfs/smbdirect: update to v7.2-rc (JIRA:RHEL-190706)
• RHEL10.4 - NVMe: Fix reported "attempt to access beyond end of device" with error returned to usespace when good path available (JIRA:RHEL-194153)
• [SCSI]QEMU CD-ROM apparent failure to wake up error handler leaving shost in SHOST_RECOVERY [rhel-10] (JIRA:RHEL-208594)
• [IBM 10.4 FEAT] Ability to display Resource group (kernel part) (JIRA:RHEL-217019)
• [10.4] RFE: NVME timeouts need to be separately tune-able for direct connect and fabric devices. (JIRA:RHEL-54175)
• [Broadcom RHEL10.3] mpi3mr driver fixes (JIRA:RHEL-141215)
• [Broadcom RHEL10.3] mpt3sas driver fixes (JIRA:RHEL-141216)
• [RHEL 10.3] Arm core updates from upstream v6.19 (JIRA:RHEL-158921)
• [Intel 10.3 FEAT] igb: Driver Update (JIRA:RHEL-177449)
• [10.3 FEAT] igc: driver update (JIRA:RHEL-186597)
• Kernel oops after increasing max number of mac addresses of a mlx5 VF (JIRA:RHEL-193996)
• Update PCI's subsystem resource management with content from v7.1 (JIRA:RHEL-178011)
• CNB103: tcp: Don't pass hashinfo to socket lookup helpers (JIRA:RHEL-179873)
• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic (JIRA:RHEL-190430)
• dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (JIRA:RHEL-198358)
• rtla-timerlat-top triggers threshold actions without threshold being hit [rhel-10] (JIRA:RHEL-207634)
• WiFi7 Qualcomm cards are not working again from VMs [rhel-10] (JIRA:RHEL-213608)
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:RHEL-219079)
• RHIVOS - S32G: debug builds fail to mount sysroot (JIRA:RHEL-222562)
• [RHEL 10.3] Konflux: sign UKI's inner vmlinuz with modules signing key (JIRA:RHEL-223625)
• [AMDCLIENT 10.3 FEATURE] Strix Halo Include amdgpu ISP interface (JIRA:RHEL-26184)
• kernel: WARNING in alg_test/cryptomgr_test: cryptd shash transform allocation race returns -EEXIST during concurrent crypto module loading (JIRA:RHEL-153093)
• [Rhel 10.2] OVS IPv4/IPv6 fails from 6.10-rc1 onwords (JIRA:RHEL-128835)
• [RHEL-10] Update MM-core codebase and its dependencies to upstream v6.17 (JIRA:RHEL-145695)
• udp: stable backport for 10.3 phase 1 (JIRA:RHEL-152739)
• [Intel 10.4 FEAT] [NVL-H] IO: PCH: Add I2C Device ID (JIRA:RHEL-154489)
• [RHEL 10.3] Rebase kernel media against upstream version 7.1+ (JIRA:RHEL-162129)
• [AMDSERVER 10.3 Bug] x86/mm: Disable broadcast TLB flush when PCID is disabled (JIRA:RHEL-179500)
• [rhel-10] MHI bus update to v7.1 (JIRA:RHEL-184811)
• [rhel-10 wireless] Wireless core and drivers rebase to v7.1 (JIRA:RHEL-184812)
• [10.3] ice: driver update 2026-06 (JIRA:RHEL-187013)
• [RHEL-10.3] Update IPMI drivers to upstream v7.1 (JIRA:RHEL-187338)
• [RHEL-10.3] Update IPMI documentation to upstream v7.1 (JIRA:RHEL-187342)
• Tegra ABP MISC not yet available WARNING: CPU: 2 PID: 1 at drivers/soc/tegra/fuse/tegra-apbmisc.c:120 tegra_read_straps+0x48/0x70 (JIRA:RHEL-191743)
• RHEL10.2 futex hash performance regression with Dell PowerEdge R650 - RHEL 9 on same HW has better perf (JIRA:RHEL-193649)
• Cloned - RHEL10 - Wake on Lan broken on AMD (JIRA:RHEL-212012)
• RHEL 10.3 fix platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug (JIRA:RHEL-212368)
• RHEL 10.3 fix thermal: intel: Fix dangling resources on thermal_throttle_online() failure (JIRA:RHEL-212369)
• RHEL 10.3 fix cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (JIRA:RHEL-212894)
• RHEL 10.3 fix platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (JIRA:RHEL-213934)
• [Intel 10.4 BUG] tools: power: ISST: Fix intel-speed-select daemon pid file handling (JIRA:RHEL-214504)
• RHEL 10.3 fixes for platform/x86/intel/tpmi (JIRA:RHEL-215232)
• There is a deadlock during gve device initialization on CentOS Stream 10 kernels >= 6.12.0-247. (JIRA:RHEL-218195)
• RHEL 10.3 fixes for PM: EM: (JIRA:RHEL-220528)
• RHEL 10.3 fix mei: bus: access mei_device under device_lock on cleanup (JIRA:RHEL-222295)
• SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-10] (JIRA:RHEL-222799)
• [HP FEAT 10.1] [AMD Strix Halo] Enable MIPI Camera (JIRA:RHEL-23291)
• stmmac rebase for RHEL 10.1 (JIRA:RHEL-100501)
• stmmac driver rebase up to v6.17 [rhel-10] (JIRA:RHEL-128151)
• DPLL: Add support for NCO (numerically controlled oscillator) (JIRA:RHEL-176048)
• CNB103: devlink: update devlink to the v7.1 (JIRA:RHEL-179081)
• arm64/mm: Enable batched TLB flush in unmap_hotplug_range() (RHEL 10) (JIRA:RHEL-184786)
• netfilter: rebase to 7.1 (JIRA:RHEL-185609)
• Fix bugs and performance of kstack offset randomisation (RHEL 10.3) (JIRA:RHEL-215975)
• vhost: reset the vring metadata cache on vring reconfiguration [10.3] (JIRA:RHEL-224534)
• [Fujitsu 10.3 FEAT]: MONAKA ACPI HID support in synopsis GPIO driver (JIRA:RHEL-23123)
• [Fujitsu 10.2 FEAT]: MONAKA ACPI HID support in synopsis SMBus driver (JIRA:RHEL-23132)
• cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10] (JIRA:RHEL-235810)
• UKI cmdline addons are signed by 801 cert instead of 504 (JIRA:RHEL-238666)
• [10.3] Input/HID rebase (JIRA:RHEL-170872)
• NVIDIA: Backport perf/arm_pmu: Skip PMCCNTR_EL0 on NVIDIA Olympus - RHEL 10.3 (JIRA:RHEL-176084)
• [RHEL10] perf built with clang-22 contains incompatible BPF code that is then refused by the kernel (JIRA:RHEL-183355)
• [RHEL-10.3] Update Intel Sensor Hub ISH to upstream V7.0+ (JIRA:RHEL-183865)
• ALSA (sound) driver - update all drivers to the upstream for RHEL rhel-10.3 (upstream kernel 7.1-stable) (JIRA:RHEL-193253)
• SYNCIO and Schbench regression on RHEL9 and ELN backported to RHEL10 (JIRA:RHEL-222582)
• ARM AGI Silicon support, CMN errors during boot. (JIRA:RHEL-234652)
• Backport : Introduce module parameter to disable CET) + actually disable (i.e. flip the default, in a separate commit) to centos stream 10 (JIRA:RHEL-235002)
• RHEL 10.3 fix x86/mce: Set up the polling timer before CMCI discovery (JIRA:RHEL-239086)
• [RHEL10] [v6.17] perf_buildid :: test_buildid-list "buildids check" and "kernel buildid" FAIL (JIRA:RHEL-122642)
• [RHEL-10] selftests: net-tls: 12_aes_gcm* and13_aes_gcm* failed (JIRA:RHEL-153139)
• [RHEL 10.3] Arm64 DTS updates from upstream v6.19 (JIRA:RHEL-213310)
• [RHEL-10.3] Recent upstream fixes for DMA Engine drivers (JIRA:RHEL-213821)
• [RHEL10.3] Possible oops during memory hotremove (JIRA:RHEL-214116)
• ARM AGI Silicon support, MPAM updates (JIRA:RHEL-218644)
• [Perf.regression] 30% performance drop on 4k write IOs (JIRA:RHEL-159116)
• RHEL 10.3 stable drm backport (JIRA:RHEL-180328)
• [RHEL 10.3] Export Linux Symbol to read perf_event_paranoid level (JIRA:RHEL-212122)
• smartpqi - add latest patches from kernel.org to RHEL 10.3 (JIRA:RHEL-224341)
• Backport "mm/gup: fix GUP-fast fallback for NULL-mapping order-0 folios" - RHEL 10.3 (JIRA:RHEL-231964)
• cifs: periodic IO errors when rename races with lease break [rhel-10] (JIRA:RHEL-235460)
• RHIVOS - Disable CONFIG_MD and CONFIG_MD_BITMAP_FILE in RHIVOS kernel (JIRA:RHEL-237678)
• [Intel 10.3 FEAT] [DMR] perf: Add Core Event Counters (JIRA:RHEL-115120)
• [Intel 10.3 FEAT] [DMR] perf: Add Cstate Event Counters (JIRA:RHEL-115122)
• [Intel 10.3 FEAT] [DMR] perf: Add Uncore Event Counters (JIRA:RHEL-115124)
• [Intel 10.3 FEAT] [NVL] perf: Add PMU Support for Core Events Counter (JIRA:RHEL-117335)
• [Intel 10.3 FEAT] [NVL] perf: Add PMU Support for Uncore Events Counter (JIRA:RHEL-117337)
• [Intel 10.3 FEAT] [NVL] perf: Add core cstate and package cstate events support in perf tool (JIRA:RHEL-120357)
• ipv6: stable backport for 10.3 phase 1 (JIRA:RHEL-152712)
• kselftest/cgroup/test_zswap: some fails (JIRA:RHEL-154157)
• kselftest/cgroup:test_kmem: fails in test_percpu_basic() (JIRA:RHEL-154159)
• RHEL-10.3 kvm/arm: backport important fixes up to v7.1 (JIRA:RHEL-180320)
• Several cgroup kselftests failing in 10.3 CTC1 testing (JIRA:RHEL-184801)
• [RHEL-10.3] Recent upstream fixes for IOMMU subsystem (JIRA:RHEL-213791)
• [aarch64 64k] hotplug_mem_stress_ng: memory unplug fails under stress-ng load on 64k page-size guest (JIRA:RHEL-224504)
• [Intel 10.2 FEAT] [WCL-U] perf: Add cstate events for core and package (JIRA:RHEL-95668)
• Refactor skb deferral free (JIRA:RHEL-123212)
• ss core dumped when there is an SCTP session [rhel-10.3] (JIRA:RHEL-137943)
• Deadlock on netns change (JIRA:RHEL-144808)
• mpls: stable backport for 10.3 phase 1 (JIRA:RHEL-152709)
• ppp: stable backport for 10.3 phase 1 (JIRA:RHEL-152724)
• l2tp: stable backport for 10.3 phase 1 (JIRA:RHEL-152732)
• srv6: stable backport for 10.3 phase 1 (JIRA:RHEL-152736)
• Backport firmware:arm_ffa Honor partition info descriptor size (RHEL 10.3) (JIRA:RHEL-179031)
• Backport firmware: arm_ffa: Handle maximum RX/TX buffer size (RHEL 10.3) (JIRA:RHEL-183180)
• [RFE][RHEL 10.3] mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED) (re-enable) (JIRA:RHEL-186753)
• sctp: prevent peer transport count overflow [10.3] (JIRA:RHEL-214458)
• Proactively backport 7.0 amdxdna KMD into the RHEL 10.3 kernel (without enabling it) (JIRA:RHEL-222546)
• RHIVOS - Enable TI DSP remoteprocs in CS10 (JIRA:RHEL-95437)
• [IBM 10.3 FEAT] KVM: Revisit kvm_arch_set_irq_inatomic optimization (JIRA:RHEL-136456)
• [RHEL 10] bnxt_en: RX queue restart failed: err=-95 (JIRA:RHEL-235458)
• Backport arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - RHEL 10.3 (JIRA:RHEL-239373)
• Direct I/O alignment fixes for RHEL10 (JIRA:RHEL-246814)
• Enable amdxdna driver as Tech Preview in RHEL 10.3 (JIRA:RHEL-259222)
• Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.3] (JIRA:RHEL-179065)
• [RHEL10][debug][x86_64] kernel BUG at include/linux/mm.h:1098! (JIRA:RHEL-257371)
• [RHEL10] Disallow loading of microcode revision 0x1000423 on Intel CPUs with family/model/stepping = 6/173/1 (Granite Rapids) (JIRA:RHEL-261015)
• [FUJITSU 10.3 FEAT]: Special Purpose memory mode and cxl region control is necessary. (JIRA:RHEL-85050)
• [RHEL 10.3] Populate kABI stablelist and enable check-kabi (JIRA:RHEL-245490)
• RHEL 10.3 aarch64+64k: host hard-freeze during viommu test - requires power-cycle/reboot (JIRA:RHEL-179725)
• I/O errors in host ( NVMe controller) (JIRA:RHEL-191742)
• qemu-img rebase erases guest file contents from intermediate qcow2 overlays on virtio-scsi (JIRA:RHEL-213968)
• [RHEL 10.3] block layer fixes (JIRA:RHEL-211072)
• tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin (JIRA:RHEL-188812)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors (JIRA:RHEL-54449)
• Backport s390x KVM patches up to kernel 6.19 [RHEL 10.3] (JIRA:RHEL-143729)
• [RHEL 10] net: aquantia: Add missing descriptor cache invalidation on ATL2 (JIRA:RHEL-172178)
• [AMDSERVER 10.3 Feature] Implement Trace Event Support to CXL CPER Protocol Errors (JIRA:RHEL-140832)
• RHEL 10.3 - Backport MSHV patches for hypervisor OOM handling (JIRA:RHEL-245033)
• [RHEL 10.3] Fix arm_ffa initialization order conflict with IMA (JIRA:RHEL-248828)
• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [rhel-10] (JIRA:RHEL-254167)
• xfs: allow symlink creation to wait for or initiate release of preallocated file space when receiving ENOSPC trying to allocate a new directory block (JIRA:RHEL-116652)
• [Intel 10.3 FEAT] [NVL] power: thermal: Add support for reading current memory speed (DDR) in real time (JIRA:RHEL-117276)
• [Intel 10.3 FEAT] iavf: Driver Update (JIRA:RHEL-118530)
• [Intel 10.3 FEAT] i40e: Driver Update (JIRA:RHEL-118536)
• [kselftest] net:rtnetlink.py: not support yet (JIRA:RHEL-123730)
• Interface device can not be recognized when attaching to pcie-switch-downstream-port (JIRA:RHEL-135229)
• [Broadcom RHEL10.3] megaraid_sas driver fixes (JIRA:RHEL-141214)
• lan743x: driver update to Linux v6.19 [Nvidia 10.3 FEAT] (JIRA:RHEL-141981)
• [RHEL-10] Update MM-core codebase and its dependencies to upstream v6.16 (JIRA:RHEL-145694)
• [RHEL-10.3 FEAT] USB/TB code rebase of supported drivers to upstream v7.0 (JIRA:RHEL-147800)
• RHEL 10.3 DRM backport to 6.19 (JIRA:RHEL-151744)
• KVM x86 rebase up to upstream kernel 7.0 and/or 7.1 (JIRA:RHEL-151869)
• ipv4: stable backport for 10.3 phase 1 (JIRA:RHEL-152711)
• sctp: stable backport for 10.3 phase 1 (JIRA:RHEL-152730)
• Backport NXP Periodic Interrupt Timer (PIT) (JIRA:RHEL-152816)
• CNB103: Single MSS length in UDP GSO_PARTIAL (JIRA:RHEL-156516)
• [RHEL-10.3] - IPMI update to kernel v7.0 (JIRA:RHEL-169911)
• [rhel-10 wireless] Wireless core and drivers rebase to v7.0 (JIRA:RHEL-171410)
• [RHEL 10.3 media] Include the following ACPI patches to enable AMD ISP4 (JIRA:RHEL-173575)
• [RHEL 10.3] RISC-V IOMMU driver backport (JIRA:RHEL-174808)
• [RHEL 10.3] SpacemiT SoC driver backports, part 2 (JIRA:RHEL-180378)
• [DELL 10.3 FEAT] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution (JIRA:RHEL-180892)
• rhel 10.3 fix x86/mce: Restore MCA polling interval halving (JIRA:RHEL-182292)
• ALSA (sound) driver - update all drivers to the upstream for RHEL 10.3 (upstream kernel 7.1) (JIRA:RHEL-183295)
• RHEL 10.3 [DMR] Add support for intel-uncore-freq minor version 3 (JIRA:RHEL-185138)
• RHEL 10.3 [DMR] Add support for platform/x86: ISST minor version 3 (JIRA:RHEL-185954)
• [10.3 FEAT] CNB103: dpll: sync with upstream (JIRA:RHEL-186631)
• Investigate bz432626-lockd-ref failure on RHEL10.3 backport (JIRA:RHEL-186673)
• mlx5: Disable ConnectX-10 NVLink-C2C device (JIRA:RHEL-211847)
• [Fujitsu 10.3 FEAT]: MPAM support in resctrl (JIRA:RHEL-23165)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for x86_64 10 x86_64
• Red Hat Enterprise Linux for IBM z Systems 10 s390x
• Red Hat Enterprise Linux for Power, little endian 10 ppc64le
• Red Hat Enterprise Linux for ARM 64 10 aarch64
• Red Hat CodeReady Linux Builder for x86_64 10 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 10 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x

Fixes

• BZ - 2436805 - CVE-2026-23066 kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg
• BZ - 2446109 - CVE-2026-23239 kernel: Kernel: Race condition in espintcp can lead to denial of service
• BZ - 2446139 - CVE-2026-23240 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
• BZ - 2482104 - CVE-2026-45942 kernel: ext4: fix e4b bitmap inconsistency reports
• BZ - 2492373 - CVE-2026-52945 kernel: Revert "wireguard: device: enable threaded NAPI"
• BZ - 2492422 - CVE-2026-52952 kernel: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
• BZ - 2502209 - CVE-2026-53395 kernel: nfsd: fix dead ACL conflict guard in nfsd4_create
• BZ - 2502219 - CVE-2026-63800 kernel: pNFS: Fix use-after-free in pnfs_update_layout()
• BZ - 2502337 - CVE-2026-64020 kernel: nvme-pci: fix dma_vecs leak on p2p memory
• BZ - 2502344 - CVE-2026-63914 kernel: xfrm: route MIGRATE notifications to caller's netns
• BZ - 2502375 - CVE-2026-64025 kernel: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
• BZ - 2502409 - CVE-2026-63987 kernel: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
• BZ - 2502433 - CVE-2026-64000 kernel: net: hsr: fix potential OOB access in supervision frame handling
• BZ - 2507031 - CVE-2026-64355 kernel: bpf: Reject fragmented frames in devmap
• BZ - 2507122 - CVE-2026-64523 kernel: net/handshake: Take a long-lived file reference at submit
• BZ - 2507156 - CVE-2026-64279 kernel: i2c: core: fix adapter deregistration race
• BZ - 2507184 - CVE-2026-64375 kernel: proc: protect ptrace_may_access() with exec_update_lock (FD links)
• BZ - 2507193 - CVE-2026-64496 kernel: iio: event: Fix event FIFO reset race
• BZ - 2507345 - kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
• BZ - 2513158 - CVE-2026-68390 kernel: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
• BZ - 2513448 - CVE-2026-68103 kernel: drm/amdgpu: reject mapping a reserved doorbell to a new queue
• BZ - 2513458 - CVE-2026-68379 kernel: tcp: fix TIME_WAIT socket reference leak on PSP policy failure
• RHEL-145367 - backport "geneve: introduce double tunnel GSO/GRO support"
• RHEL-145204 - Enable LTO for kernel-tools binaries to resolve annocheck failures
• RHEL-157318 - RHEL-10.3 kvm/arm: rebase up to v7.0
• RHEL-174745 - CNB103: lib/bitmap: update to v7.1
• RHEL-167108 - kernel: fs/notify: call exportfs_encode_fid with s_umount
• RHEL-180187 - rbd: eliminate a race in lock_dwork draining on unmap
• RHEL-163488 - Add Gemini / Epoch code to kernel.spec file for rv and rv-debuginfo [rhel-10.3]
• RHEL-178260 - Please sign CentOS Stream kernels with 800 series certificates
• RHEL-185104 - [RHEL10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath
• RHEL-163760 - [RHEL10.3] kernel \ Storage \ Kernel Target (LIO): Component Rebase
• RHEL-171362 - [rhel-10] MHI bus update to v7.0
• RHEL-189045 - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
• RHEL-169468 - Update kernel to use new certificate paths
• RHEL-198358 - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
• RHEL-170872 - [10.3] Input/HID rebase
• RHEL-171410 - [rhel-10 wireless] Wireless core and drivers rebase to v7.0

CVEs

• CVE-2026-23066
• CVE-2026-23239
• CVE-2026-23240
• CVE-2026-52945
• CVE-2026-52952
• CVE-2026-53395
• CVE-2026-63914
• CVE-2026-63987
• CVE-2026-64000
• CVE-2026-64020
• CVE-2026-64025
• CVE-2026-64279
• CVE-2026-64355
• CVE-2026-64375
• CVE-2026-64496
• CVE-2026-68103
• CVE-2026-68379
• CVE-2026-68390
• CVE-2026-72319

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.3_release_notes/index