RHSA-2026:97435 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg (CVE-2026-23066)
• kernel: Kernel: Race condition in espintcp can lead to denial of service (CVE-2026-23239)
• kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem (CVE-2026-23240)
• kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
• kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
• kernel: Revert "wireguard: device: enable threaded NAPI" (CVE-2026-52945)
• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
• kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)
• kernel: xfrm: route MIGRATE notifications to caller's netns (CVE-2026-63914)
• kernel: net: hsr: fix potential OOB access in supervision frame handling (CVE-2026-64000)
• kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)
• kernel: bpf: Reject fragmented frames in devmap (CVE-2026-64355)
• kernel: i2c: core: fix adapter deregistration race (CVE-2026-64279)
• kernel: proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)
• kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)
• kernel: drm/amdgpu: reject mapping a reserved doorbell to a new queue (CVE-2026-68103)
• kernel: mei: bus: access mei_device under device_lock on cleanup (CVE-2026-68181)
• kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
• kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

Bug Fix(es) and Enhancement(s):

• [Broadcom 9.8 feat] bnxt_re: Update driver to the latest upstream version (JIRA:RHEL-108696)
• general protection fault during exportfs / nfsd4_revoke_states (JIRA:RHEL-117260)
• [rhel-9.9] Kernel panic at kfree() to free kvm_task_sleep_node (JIRA:RHEL-125085)
• [RHEL 9.9] Update intel_pstate to upstream 6.20 (JIRA:RHEL-128576)
• [RHEL 9.9] Update cpupower to upstream 6.20 (JIRA:RHEL-128578)
• [RHEL 9.9] Update intel_idle to upstream 6.20 (JIRA:RHEL-128587)
• GNR-D: kdump and manual kexec result in hard system freeze with no console output (JIRA:RHEL-130927)
• CNB99: support for SCM_TS_OPT_ID (was: net: Replace sendpage with sendmsg(MSG_SPLICE_PAGES)) (JIRA:RHEL-132649)
• [RHEL9] kernel BUG at fs/file.c:598! (JIRA:RHEL-133537)
• [rhel-9] Accessing /proc/sys/user/* may trigger spurious sys_resource SELinux denials (JIRA:RHEL-135610)
• PCI sysfs data incorrect on latest kernel (JIRA:RHEL-137250)
• [RHEL 9 CIFS]: return Permission denied when mount krb5 with multichannel and max_channels (JIRA:RHEL-143362)
• [RHEL-9.9 FEAT] USB/TB code rebase of supported drivers to upstream v6.18 (JIRA:RHEL-147786)
• autofs: use wake_up() instead of wake_up_interruptible() in autofs_catatonic_mode() [rhel-9] (JIRA:RHEL-148438)
• nfs: backport patch which checks delegation validity in nfs_start_delegation_return_locked to RHEL 9 (JIRA:RHEL-148690)
• Bond network interface is not coming up with MTU 9000 while vPMEM is enabled (JIRA:RHEL-149742)
• [RHEL-9.8] buildcheck test fails with Error: file not found: kernel.sbat (JIRA:RHEL-150459)
• [NFS-with-TLS] refcount underflow when mounting with xprtsec=tls fails [rhel-9] (JIRA:RHEL-150978)
• xfstests generic/126 fails with pNFS SCSI [rhel-9] (JIRA:RHEL-150983)
• System hang with tasks stuck in pnfs_update_layout [rhel-9] (JIRA:RHEL-151429)
• List corruption in nfsd_file_lru_remove (JIRA:RHEL-152061)
• [ice driver] Memory Leak OCP 4.16.56 (JIRA:RHEL-152865)
• i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (JIRA:RHEL-153431)
• OOB in SMB2_open_free crashing the system (JIRA:RHEL-153749)
• RHEL9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs (JIRA:RHEL-155897)
• RHEL9.4 - s390/pci: Avoid deadlock between error recovery and mlx5 crdump (JIRA:RHEL-157931)
• [Lenovo 9.8 FEAT] Broadcom bnxt_re driver update (JIRA:RHEL-96539)
• RHEL9.7 - Decompressor image vmlinux.decompressor is missing from kernel-debuginfo rpm on s390x (JIRA:RHEL-141416)
• drm/mgag200: 300 ms busy loop (JIRA:RHEL-148287)
• block layer: cherry pick from v6.19 (JIRA:RHEL-154215)
• gfs2: Various xfstests fixes (Was: xfstest generic/211 failure) (JIRA:RHEL-127164)
• [RHEL 9.9] Update x86/mce to upstream 6.20 (JIRA:RHEL-128579)
• [AMDSERVER 9.9 Feature] Support CpuidUserDis (CPUID User Disable() (JIRA:RHEL-140357)
• dlm: WARN: pending deadlock 1e node 0 2 1bf21 (JIRA:RHEL-142778)
• [RHEL9] PowerPC: Watchpoint triggers "sleeping function called from invalid context" warnings due to missing upstream fix (JIRA:RHEL-145581)
• [RHEL-9][hv_netvsc][Backport] net: hv_netvsc: reject RSS hash key programming without RX indirection table (JIRA:RHEL-150569)
• ALSA (sound) driver - update all drivers to the upstream for RHEL rhel-9.9 (upstream kernel 6.19) (JIRA:RHEL-152847)
• [RHEL9.9] Update drivers/i2c/busses/i2c-i801.c (JIRA:RHEL-152917)
• fix krb5 mount with username option (JIRA:RHEL-156455)
• gfs2: bufdata leaks (JIRA:RHEL-159333)
• RHEL9.4 - dasd: Fix PPRC copy pair swap state and format information. (JIRA:RHEL-161530)
• Enable sched and RTapp RV monitors [rhel-9.9] (JIRA:RHEL-116707)
• [RHEL 9.9] Update drivers/platform/x86/intel to upstream 7.0 (JIRA:RHEL-128565)
• perf: test "kernel-lock-contention-analysis-test" fails consistently [rhel-9.9] (JIRA:RHEL-141682)
• NVIDIA:Backport gpio: tegra186: Simplify GPIO line name prefix handling - RHEL 9.9 (JIRA:RHEL-151652)
• l2tp: stable backport for 9.9 phase 2 (JIRA:RHEL-152697)
• RHEL 9.9 DRM Dependency backport to 6.19 (JIRA:RHEL-158926)
• [RHEL9] perftool-testsuite perf_sched :: test_timehist :: --state (output regexp parsing) (JIRA:RHEL-33442)
• gfs2 filesystem withdrawal rework [RHEL-9] (JIRA:RHEL-65700)
• [RHEL 9.9] Update turbostat to upstream 7.0 (JIRA:RHEL-128571)
• rtla low-latency BPF-side actions feature [rhel-9] (JIRA:RHEL-153391)
• missing builtin module hid_bpf.ko on ppc64le (JIRA:RHEL-165107)
• Backport of protocol attribute to IP addresses (IFA_PROTO) (JIRA:RHEL-146140)
• [RHEL9.9] Update IOMMU and DMA mapping subsystems with important fixes through v7.0 (JIRA:RHEL-147906)
• Possible THP Stalls on Multi-NUMA Systems for HANA on RHEL (JIRA:RHEL-148561)
• ppp: stable backport for 9.9 phase 2 (JIRA:RHEL-152688)
• RHEL-9.9 KVM/arm: Backport important fixes up to v7.0 (JIRA:RHEL-154746)
• [RHEL9.9] Rebase x86/resctrl up to v7.0 (JIRA:RHEL-163713)
• ?? rv does not have debuginfo [rhel-9.9] (JIRA:RHEL-85867)
• ?? rtla does not have debuginfo [rhel-9.9] (JIRA:RHEL-96913)
• [RHEL 9.9] Update the amd-pstate driver to upstream 7.0 (JIRA:RHEL-128563)
• [RHEL 9.9] update drivers/thermal/intel to upstream 7.0 (JIRA:RHEL-128567)
• [IBM 9.9 FEAT] Avoid the need to reload kdump service (fadump) on Memory DLPAR operations (kernel) (JIRA:RHEL-138954)
• [rhel-9] MHI bus update to v6.19 (JIRA:RHEL-163621)
• [rhel-9 wireless] Wireless core and drivers rebase to v6.19 (JIRA:RHEL-163622)
• [RFE][sfc] software tx timestamping needed for ptp4l (JIRA:RHEL-74331)
• [RHEL9.9] NVIDIA:Backport arm_mpam: Add basic mpam driver (JIRA:RHEL-100931)
• [RHEL 9.9] Update the AMD PMF driver to upstream 7.0 (JIRA:RHEL-128575)
• [AMDSERVER 9.9 Feature] Debug interface to walk/dump IOMMU data structures (JIRA:RHEL-140473)
• tunnels: stable backport for 9.9 phase 2 (JIRA:RHEL-152693)
• [rhel-9][aarch64] sched: DL de-boosted task PID 22725: REPLENISH flag missing - WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 (JIRA:RHEL-157267)
• [RHEL9.9]: NVIDIA:Backport arm_mpam: Add KVM/arm64 and resctrl glue code (JIRA:RHEL-164227)
• zl3073x: update the driver to upstream v7.0 [rhel-9] (JIRA:RHEL-164439)
• [RHEL 9.9] Update Intel Speed Select to upstream 7.0 (JIRA:RHEL-128562)
• [KASLR] Proactive backports RHEL-9.9 (JIRA:RHEL-144439)
• Higher than expected CPU utilization in TCP perf test on kernel-5.14.0-647.el9 (JIRA:RHEL-144961)
• [Audit] Proactive backports RHEL-9.9 (JIRA:RHEL-145408)
• RHEL9: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN (JIRA:RHEL-159283)
• RHEL9.4 - s390/mm: Add missing secure storage access fixups (JIRA:RHEL-168793)
• [IBM 9.9 FEAT] Set Kernel Config Option CONFIG_SCLP_OFB=y (JIRA:RHEL-169810)
• Scheduler fixes for rhel 9.9 (JIRA:RHEL-147187)
• [xfstests generic/650] XFS: Assertion failed: percpu_counter_sum(&btp->bt_io_count) == 0, file: fs/xfs/xfs_buf.c, line: 2021 (JIRA:RHEL-154600)
• [RHEL-9.9] rtnl_getlink() and returns EMSGSIZE (Message too long) (JIRA:RHEL-167866)
• crypto: xxhash64 should not be fips approved [rhel-9.9] (JIRA:RHEL-170673)
• Kernels 5.14.0-434+ may lose page table dirty bit (and page data) (JIRA:RHEL-151306)
• update drivers/base subsystem to match upstream Linux v7.0 for RHEL-9.9 (JIRA:RHEL-156429)
• ibmveth Adapter Freeze with Small MSS (JIRA:RHEL-164873)
• RHEL 9: Enable CONFIG_ARCH_TEGRA_241_SOC (JIRA:RHEL-166729)
• RHEL 9.8: tpm crb failing (JIRA:RHEL-168115)
• [RHEL-9.9]: Update the mlx5 drivers to v6.19 (JIRA:RHEL-169055)
• [RHEL 9.9] update drivers/powercap to upstream 7.0 (JIRA:RHEL-128568)
• [9.9] MDRAID - Update to the latest upstream (JIRA:RHEL-129338)
• RHEL9.7/9.8 [P11] [5.14.0-611.el9.ppc64le] FS/EXT4: generic/388 fails with warning at fs/ext4/super.c:1282 ext4_put_super+0x54c/0x680 [ext4] (JIRA:RHEL-145583)
• [RHEL-9.9] RDMA: Include RDMA core bug fixes (JIRA:RHEL-163491)
• [RHEL 9] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs (JIRA:RHEL-99101)
• netfilter: stable backport for 9.9 phase 2 (JIRA:RHEL-152685)
• [HPEMC RHEL 9 BUG] x86/platform/uv: fix panic when deconfiguring socket. (JIRA:RHEL-158968)
• dm thin: possible race during parallel activity leading to what looks like it could be discard/delete race leading to an error [rhel-9] (JIRA:RHEL-169624)
• dm cache: Memory leak on metadata abort when dealing concurrent metadata io errors [rhel-9] (JIRA:RHEL-169975)
• Kernel NULL pointer dereference while writing to a dm-cache device in passthrough mode [rhel-9] (JIRA:RHEL-169976)
• [RHEL-9.9] WARNING: CPU: 11 PID: 704 at crypto/crypto_engine.c:58 crypto_finalize_request (JIRA:RHEL-170915)
• [ice] 3 of 4 ports "Failed to set LAN Tx queue context, error: -22" (JIRA:RHEL-142433)
• [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t (JIRA:RHEL-161185)
• nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones (JIRA:RHEL-158357)
• [RHEL9.7] blktests block/037 failed at "tests/block/037: line 42: echo: write error: Cannot allocate memory" (JIRA:RHEL-105810)
• [GNR-D DPLL] zl3073x: Implement ref-sync support [rhel-9] (JIRA:RHEL-167274)
• [GNR-D DPLL] zl3073x: Implement frequency monitoring [rhel-9] (JIRA:RHEL-167834)
• zl3073x: update the driver to upstream v7.1 [rhel-9] (JIRA:RHEL-172939)
• ses enclosure devices attach to scsi devices on different scsi hosts from the enclosure (JIRA:RHEL-68372)
• The kernel still panicked in cached_dir_offload_close despite applying commit 734e99623c5b (JIRA:RHEL-159632)
• [RHEL-9.9] crypto: authenc - Correctly pass EINPROGRESS back up to the caller (JIRA:RHEL-172166)
• [Intel 9.9 FEAT] [NVL] security: mei: Add platform to Management Engine Interface (mei) driver (JIRA:RHEL-117354)
• [9.9] drivers/video rebase (fbcon/fbdev) (JIRA:RHEL-135262)
• [IBM 9.9 FEAT] Support 128 KB tape block sizes (JIRA:RHEL-136092)
• [RHEL9] WARNING: possible recursive locking detected at pqi_shutdown+0xd5/0x470 [smartpqi] (JIRA:RHEL-141518)
• [RHEL-9.9] - IPMI update to kernel v7.0 (JIRA:RHEL-158957)
• [RHEL 9.9] Backport important EFI fixes from linux 6.19 (JIRA:RHEL-168822)
• NVMe-FC: Panic during NVMe Controller Reset tests [rhel-9] (JIRA:RHEL-171725)
• [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part (JIRA:RHEL-113460)
• [Intel 9.9 FEAT] [DMR][NVL] CPU: Add Advanced Performance Extensions (APX) instruction (JIRA:RHEL-115163)
• [IBM 9.9 FEAT] Upgrade the QETH driver to latest from upstream, e.g. kernel 6.20 (JIRA:RHEL-136141)
• [RHEL 9.8 Bug] qla2xxx flash image validation failure (JIRA:RHEL-157284)
• ALSA (sound) driver - update all drivers to the upstream for RHEL 9.9 (upstream kernel 7.0) (JIRA:RHEL-168091)
• [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. (JIRA:RHEL-166727)
• rbd: eliminate a race in lock_dwork draining on unmap (JIRA:RHEL-180190)
• [AMDSERVER 9.9 Feature] Venice: Add support for new SMCA bank types (JIRA:RHEL-100952)
• NVIDIA:i2c support for T410 (Vera) - RHEL 9.9 (JIRA:RHEL-143332)
• iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets (JIRA:RHEL-144630)
• Kernel panic while shutting down ice driver due to use-after-free [rhel-9] (JIRA:RHEL-177522)
• Backport tracing fixes for bpftrace support (JIRA:RHEL-180602)
• After migrating to RHEL 9, multiple queue driver with 16 path Pure storage is causing path failures and I/O errors (JIRA:RHEL-174571)
• CNB99: net: set default rss queues num to physical cores / 2 (JIRA:RHEL-175788)
• [Intel 9.9 FEAT] [NVL] IO: PCH: Add I2C Device ID (JIRA:RHEL-117326)
• turbostat refuses -P option (JIRA:RHEL-140922)
• [RHEL-9.9 FEAT] USB/TB code rebase of supported drivers to upstream v6.19 (JIRA:RHEL-147793)
• RHEL 9.9 DRM Main backport to 6.19 (JIRA:RHEL-151751)
• [ice dpll]synce4l can't lock to SMA; no SMA pin notifications from DPLL (JIRA:RHEL-151897)
• [ice dpll]The default SMA pin frequency incorrect (JIRA:RHEL-151898)
• Objtool 9.9: backports from upstream linux 7.0 (JIRA:RHEL-152187)
• Livepatch 9.9: backports from upstream linux 7.0 (JIRA:RHEL-152191)
• Crash when E825-C firmware is updated (JIRA:RHEL-152411)
• [Intel 9.9 FEAT] [DMR] Accel-DSA: dmaengine: idxd: Add support for DSA 3.0 devices (JIRA:RHEL-154486)
• Update ACPI support to match upstream v7.0 for RHEL 9.9 (JIRA:RHEL-156421)
• [ice/DPLL]disconnect U.FL will automatically disconnect SMA1 (JIRA:RHEL-159916)
• [Intel 9.9 FEAT] [DMR] acpi: Add support for EINJv2 per ACPI 6.6 spec (JIRA:RHEL-169029)
• Update NFS/NFSD/LOCKD/SUNRPC RHEL9.9 to 7.1 (JIRA:RHEL-171546)
• rtmutex: Fix potential UAF of a task's pi_blocked_on field [rhel-9] (JIRA:RHEL-171802)
• [RHEL9.9] DMA Engine: backport recent upstream fixes for supported drivers (JIRA:RHEL-172444)
• ice: backport changes to default number of RSS queues [rhel-9] (JIRA:RHEL-174333)
• DPLL: Add support for pin operational state [rhel-9] (JIRA:RHEL-175819)
• DPLL: Add support for fractional frequency offset between pin and device [rhel-9] (JIRA:RHEL-175822)
• crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (JIRA:RHEL-182254)
• RHEL 9: Backport b95e0e792822 (JIRA:RHEL-183463)
• [HPE-PL 9.9 Bug] Kernel call trace observed when access Intel Granite Rapids-D UART (JIRA:RHEL-111649)
• [IBM 9.9 FEAT] Update dm-crypt/dm-integrity Subsystem to 6.19+ Level (Secure Execution) (JIRA:RHEL-136803)
• Hit Reservation conflict when unregister the key on failovering multipath (JIRA:RHEL-138608)
• dm-integrity returns I/O error after growing the device in bitmap mode. (JIRA:RHEL-144459)
• crash at device_del+61 when removing NVMe/FC controller (JIRA:RHEL-154109)
• [RHEL 9.9] Proactive cgroup bug fixes and update cpuset to v6.18 (JIRA:RHEL-154974)
• [RHEL-9.9] dm: sync with upstream v6.19 (JIRA:RHEL-154976)
• [RHEL 9.9] Rebase kernel media against upstream version (JIRA:RHEL-162130)
• RHEL9.6 - s390: nospec hardening for entry code (JIRA:RHEL-174818)
• [RHEL9.9] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:RHEL-182246)
• RHEL 9: s390: Revert support for DCACHE_WORD_ACCESS (JIRA:RHEL-184094)
• [RHEL 9.9] [DMR] Add support for intel-uncore-freq minor version 3 (JIRA:RHEL-184964)
• Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-9] (JIRA:RHEL-185118)
• [rhel-9] Long not preemteble time in tpm_hwrng_read on RL300 (JIRA:RHEL-66934)
• [ice]the packets number always are show "0" for rep after packets received and sent (JIRA:RHEL-73628)
• [ice] ptp4l looping due to delay request send failures (JIRA:RHEL-152500)
• tcp: stable backport for 9.9 phase 2 (JIRA:RHEL-152683)
• ice: ptp4l lost SYNC and never restored back again on intel E825-C (JIRA:RHEL-161661)
• ice: E825C missing PHY timestamp interrupt fixes (JIRA:RHEL-170635)
• RHEL9.4 - KVM: s390: Increase SE header size from 8 KiB to 1 MiB. (JIRA:RHEL-185660)
• Integrate rtla code consolidation work into rhel-9.9 (JIRA:RHEL-116574)
• Rebase RTLA to upstream 7.1 [rhel-9.9] (JIRA:RHEL-151361)
• rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.9] (JIRA:RHEL-155124)
• Improve RTLA auto-analysis stack print not to stop at unknown function [rhel-9] (JIRA:RHEL-155232)
• [Intel 9.9 FEAT] [DMR] iommu: Remove LPIG from page group response descriptor (JIRA:RHEL-169025)
• RTLA segfaults on freed memory access on double SIGINT [rhel-9.9] (JIRA:RHEL-169238)
• [9.9] MD kernel Fix Tier 2 on Testing Farm (JIRA:RHEL-179131)
• tegra-se fixes and updates [RHEL-9.9] (JIRA:RHEL-182565)
• Please sign CentOS Stream kernels with 800 series certificates [rhel-9] (JIRA:RHEL-186905)
• [IBM 9.9 FEAT] KVM: Enhancements for IBM Test Accelerator for Z (TAZ) (JIRA:RHEL-136478)
• Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer (JIRA:RHEL-164306)
• scsi device removal may hang from race with error recovery (JIRA:RHEL-118669)
• NVIDIA:perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores - RHEL 9.9 (JIRA:RHEL-143322)
• backport of upstream commit 2da20fd ("kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count") and aaf05e9 ("kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count") to RHEL 9 and RHEL 10. (JIRA:RHEL-143910)
• [RHEL-9.9 debug] WARNING: possible circular locking dependency detected at __kernfs_remove +0x1e8/0x570 and del_gendisk+0x11c/0x1e8 with blktests block/001 (JIRA:RHEL-165529)
• rhel-9.9: NULL pointer dereference in hrtimer_active when unloading softdog module (JIRA:RHEL-189449)
• [Intel 9.9 FEAT] [NVL] power: thermal: Add support for reading current memory speed (DDR) in real time (JIRA:RHEL-117278)
• [Intel 9.9 FEAT] [NVL] GPIO: Add ACPI GPIO events support PCH GPEs (JIRA:RHEL-117350)
• [rhel-9] MHI bus update to v7.0 (JIRA:RHEL-171418)
• Update cpufreq to match Linux v7.0 for RHEL-9.9 (JIRA:RHEL-176382)
• Update cpuidle to match Linux v7.0 for RHEL-9/9 (JIRA:RHEL-176384)
• platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (JIRA:RHEL-184322)
• [RHEL 9.9] Bring in turbostat fixes (JIRA:RHEL-171741)
• Update Bluetooth stack for stable kernel v6.18.y [rhel-9.9] (JIRA:RHEL-176415)
• [RHEL 9] Bonding reports unknown speed/duplex for tg3 interface (JIRA:RHEL-182531)
• [RHEL-9.9] Update Intel Sensor Hub ISH to upstream V7.0+ (JIRA:RHEL-183866)
• RHEL-9.9 KVM/arm: Backport important fixes up to v7.1 (JIRA:RHEL-180319)
• [Intel 9.9 FEAT] QAT: kernel changes (JIRA:RHEL-115837)
• [AMDSERVER 9.9 Bug] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19 (JIRA:RHEL-179518)
• [RHEL 9.9] Futex bug fixes [rhel-9] (JIRA:RHEL-183589)
• [RHEL9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds (JIRA:RHEL-183960)
• CLONE - Mount of XFS triggers warning on mounting more than 512 XFS at the same time (JIRA:RHEL-162190)
• NVMe: Fix reported "attempt to access beyond end of device" with error returned to usespace when good path available (JIRA:RHEL-177561)
• ALSA (sound) driver - update all drivers to the upstream for RHEL 9.9 (upstream kernel 7.1) (JIRA:RHEL-183296)
• KSM to deduplicate only zero pages (JIRA:RHEL-185517)
• [RHEL 9.9 Bug] x86/mce: Restore MCA polling interval halving (JIRA:RHEL-208634)
• [RHEL 9.9 Bug] powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() (JIRA:RHEL-192478)
• RHEL9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (JIRA:RHEL-190426)
• RHEL9.4 - s390/pkey: Check length in pkey_pckmo handler implementation (JIRA:RHEL-190425)
• ipv4: stable backport for 9.9 phase 2 (JIRA:RHEL-152680)
• RHEL9: Fix downstream-only regression from 532af53c (JIRA:RHEL-185518)
• Proper upstream fix for CVE-2026-46054 execmem regression [rhel-9] (JIRA:RHEL-210856)
• Rhel-9.8[5.14.0-665.el9.ppc64le]-dmesg-nvram-1 file under /sys/fs/pstore is not getting updated after fadump (JIRA:RHEL-211104)
• Per-cpu drbg and jitter RNG (JIRA:RHEL-92680)
• stmmac driver backports for RHEL 9.7 (JIRA:RHEL-100498)
• stmmac driver rebase up to v6.17 [rhel-9] (JIRA:RHEL-128158)
• [Broadcom RHEL9.9] megaraid_sas driver fixes (JIRA:RHEL-141219)
• [RHEL 9.9 Bug] iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (JIRA:RHEL-208620)
• [RHEL 9.9]: i2c: i801: fix hardware state machine corruption in error path (JIRA:RHEL-212646)
• [RHEL 9.9]: platform/x86: intel-hid: Protect ACPI notify handler against recursion (JIRA:RHEL-212712)
• [AMDSERVER 9.8 Feature] Venice: EDAC Updates (JIRA:RHEL-100948)
• RHEL9.6: System crashed while running driver parameter tests with parameter "lpfc_hdw_queue" value as "100"(Fuji/P11/Nool/lpfc) (JIRA:RHEL-102922)
• [Intel 9.9 FEAT] [NVL] networking: wireless: Update bluetooth drivers for platform (JIRA:RHEL-117330)
• RHEL 9.8 AMD venice msgs amd_atl: Failed to determine DF Revision on boot (JIRA:RHEL-122804)
• [IBM 9.9 FEAT] Upgrade the SMC driver to latest from upstream, e.g. kernel 6.20 (JIRA:RHEL-136143)
• core: stable backport for 9.9 phase 2 (JIRA:RHEL-152699)
• [RHEL9] Change child_ns_mode mode fail after module reload (JIRA:RHEL-155389)
• dlm: fix ordering of midcomms sendqueue (JIRA:RHEL-169808)
• RHEL 9.9 DRM backport to 7.0 (JIRA:RHEL-170739)
• [rhel-9 wireless] Wireless core and drivers rebase to v7.0 (JIRA:RHEL-171417)
• Backport upstream solution to isolate EFI Runtime Services to a CPU [RHEL-9.x] (JIRA:RHEL-175657)
• Backport CephFS kclient MDS-auth-caps access checks to RHEL 9 / CentOS Stream 9 kernel (JIRA:RHEL-180666)
• x86/microcode: Add platform mask to Intel microcode "old" list [RHEL-9] (JIRA:RHEL-184789)
• [Intel 9.9 FEAT] [BTL-S] cpufreq: intel_pstate: Fix scaling factor on Raptor Lake-E (JIRA:RHEL-185961)
• [IBM 9.9 FEAT] Support new PCI adapter notification actions for Spyre and NVMe (JIRA:RHEL-188090)
• RHEL 9.9 include iommu patch for commit: 328335a79487 (JIRA:RHEL-190412)
• [IBM 9.9 FEAT] perf interface support for capturing DTL (Dispatch Trace Log) data (JIRA:RHEL-53366)
• [RHEL 9.4] Kernel memory reclaim bug (JIRA:RHEL-100912)
• [IBM 9.9 FEAT] KVM: Add capability that forwards operation exceptions (KVM_CAP_S390_USER_OPEREXEC) (JIRA:RHEL-158930)
• [RHEL 9.9 Bug] intel-speed-select: driver and tool fixes (JIRA:RHEL-192479)
• [RHEL 9.9 Bug] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() (JIRA:RHEL-208627)
• [RHEL 9.9]: platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug (JIRA:RHEL-212713)
• [RHEL 9][SCSI]QEMU CD-ROM apparent failure to wake up error handler leaving shost in SHOST_RECOVERY (JIRA:RHEL-113832)
• [Broadcom RHEL9.9] mpt3sas driver fixes (JIRA:RHEL-141217)
• [Broadcom RHEL9.9] mpi3mr driver fixes (JIRA:RHEL-141218)
• [RHEL-9.9 FEAT] USB/TB code rebase of supported drivers to upstream v7.0 (JIRA:RHEL-147798)
• tls: stable backport for 9.9 phase 2 (JIRA:RHEL-152694)
• sctp: stable backport for 9.9 phase 2 (JIRA:RHEL-152695)
• tipc: stable backport for 9.9 phase 2 (JIRA:RHEL-152706)
• [rhel-9] scatterwalk_map_and_copy - Unable to handle kernel NULL pointer dereference at virtual address (JIRA:RHEL-168738)
• NVIDIA: Backport i2c: tegra: Update Tegra410 I2C timing parameters - RHEL 9.9 (JIRA:RHEL-174251)
• [Intel 9.9 FEAT] ice: Driver Update (JIRA:RHEL-177450)
• kernel panics caused by NULL pointer dereferences within octeon_ep_vf (JIRA:RHEL-182043)
• KVM: s390: Limit adapter indicator access to mapped page [rhel-9.9] (JIRA:RHEL-183881)
• Possible regression with FM350GL [rhel-9] (JIRA:RHEL-184267)
• netfilter: cve backports for 9.9 (JIRA:RHEL-186601)
• [RHEL-9] The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems (JIRA:RHEL-190801)
• [RHEL 9.9]: select watchdog fixes (JIRA:RHEL-192487)
• proactively backport the fix for CVE-2026-52943 (9.9) (JIRA:RHEL-192925)
• CNB99: dpll: sync with upstream (JIRA:RHEL-193749)
• Update Bluetooth stack for latest stable kernel v6.18.y (6.18.38) [rhel-9.9] (JIRA:RHEL-194201)
• [9.9] RFE: NVME timeouts need to be separately tune-able for direct connect and fabric devices. (JIRA:RHEL-210643)
• [RHEL 9.9]: cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (JIRA:RHEL-212691)
• BPF test_progs fail due to missing configuration [rhel-9] (JIRA:RHEL-213547)
• gfs2: xfstests generic/363 failure (JIRA:RHEL-213745)
• RHEL 9.9 stable drm backport (JIRA:RHEL-180329)
• Kernel oops after increasing max number of mac addresses of a mlx5 VF [rhel-9] (JIRA:RHEL-212990)
• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9] (JIRA:RHEL-193044)
• [RHEL9.9] ice: Tx ref clock (JIRA:RHEL-193816)
• rtla-timerlat-top triggers threshold actions without threshold being hit [rhel-9] (JIRA:RHEL-207773)
• dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-9] (JIRA:RHEL-212062)
• Sync CIFS/smbdirect with upstream [rhel-9.9] (JIRA:RHEL-216926)
• [RHEL 9.9] Konflux: sign UKI's inner vmlinuz with modules signing key (JIRA:RHEL-223629)
• [RHEL9] Hung Task Detector improvements (JIRA:RHEL-146503)
• [rhel-9] MHI bus update to v7.1 (JIRA:RHEL-186474)
• [rhel-9 wireless] Wireless core and drivers rebase to v7.1 (JIRA:RHEL-186475)
• futex hash performance regression with Dell PowerEdge R650 - RHEL 9 on same HW has better perf [rhel-9] (JIRA:RHEL-212733)
• NVIDIA:Backport perf/arm_cspmu: Preparatory patches for NVIDIA T410 PMU - RHEL 9.9 (JIRA:RHEL-121676)
• Add Epson RX8111 support to RHEL9.9 (JIRA:RHEL-184760)
• RHEL9.6 - (fixup) s390: nospec hardening for entry code (JIRA:RHEL-191803)
• [RHEL-9.9] Wake on Lan broken on AMD (JIRA:RHEL-211144)
• [RHEL 9.9]: select fs/resctrl fixes (JIRA:RHEL-216442)
• [RHEL 9.9]: platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1) (JIRA:RHEL-217011)
• SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-9] (JIRA:RHEL-222801)
• [HPEMC RHEL 9.8 BUG] bnxt_en: Fix NULL pointer dereference (JIRA:RHEL-185084)
• [RHEL 9.9]: select thermal/intel fixes (JIRA:RHEL-212721)
• cifs: smb1 directory listings from xp server returning EINVAL and EIO (JIRA:RHEL-222675)
• vhost: reset the vring metadata cache on vring reconfiguration [9.9] (JIRA:RHEL-224537)
• [IBM 9.9 FEAT] KVM: Revisit kvm_arch_set_irq_inatomic optimization (JIRA:RHEL-136457)
• Add CONFIG_TCP_AO in RHEL 9 (JIRA:RHEL-142637)
• Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [rhel-9] (JIRA:RHEL-150728)
• "iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors" broke rx-vlan-offload on rhel-9.7 (JIRA:RHEL-155154)
• ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT [RHEL-9.x] (JIRA:RHEL-186591)
• ALSA (sound) driver - update all drivers to the upstream for RHEL rhel-9.9 (upstream kernel 7.1-stable) (JIRA:RHEL-193254)
• [RHEL 9.9]: x86/fpu: Ensure XFD state on signal delivery (JIRA:RHEL-212652)
• [RHEL 9.9]: select intel tpmi/plr unbind fixes (JIRA:RHEL-212707)
• [RHEL 9.9]: platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (JIRA:RHEL-212719)
• smartpqi - add latest patches from kernel.org to rhel 9.9 (JIRA:RHEL-224339)
• [Intel 9.9 FEAT] [LNL][PTL][NVL] NPU - accel/ivpu: Fix: Disallow re-exporting imported GEM objects (JIRA:RHEL-214521)
• Hard lockup in sort_folio() (JIRA:RHEL-153668)
• [RHEL-9.9] Recent upstream fixes for DMA Engine drivers (JIRA:RHEL-213921)
• [RHEL-9.9] Recent upstream fixes for IOMMU subsystem (JIRA:RHEL-213932)
• [Intel 9.9 FEAT] [DMR] perf: Add Core Event Counters (JIRA:RHEL-115121)
• [Intel 9.9 FEAT] [DMR] perf: Add Cstate Event Counters (JIRA:RHEL-115123)
• [Intel 9.9 FEAT] [DMR] perf: Add Uncore Event Counters (JIRA:RHEL-115125)
• [Intel 9.9 FEAT] [NVL] perf: Add PMU Support for Core Events Counter (JIRA:RHEL-117336)
• [Intel 9.9 FEAT] [NVL] perf: Add PMU Support for Uncore Events Counter (JIRA:RHEL-117338)
• [Intel 9.9 FEAT] [NVL] perf: Add core cstate and package cstate events support in perf tool (JIRA:RHEL-120358)
• [Intel 9.9 FEAT] [CWF][DMR][PTL] tools: perf: Add architectural Processor Events Based Sampling (PEBS) support (JIRA:RHEL-45125)
• [Intel 9.9 FEAT] [WCL-U] perf: Add cstate events for core and package (JIRA:RHEL-95669)
• srv6: stable backport for 9.9 phase 2 (JIRA:RHEL-152701)
• ss core dumped when there is an SCTP session [rhel-9.9] (JIRA:RHEL-212388)
• sctp: prevent peer transport count overflow [9.9] (JIRA:RHEL-214461)
• Unable to terminate process (livelock) (JIRA:RHEL-136084)
• [AMDSERVER 9.9 Feature] Implement Trace Event Support to CXL CPER Protocol Errors (JIRA:RHEL-140831)
• Backport s390x KVM patches up to kernel 6.19 [RHEL-9.9] (JIRA:RHEL-143730)
• ipv6: stable backport for 9.9 phase 2 (JIRA:RHEL-152681)
• [RHEL 9] Enable Aquantia driver (JIRA:RHEL-172177)
• [RHEL-9.9]: mlx5: include bug fixes (JIRA:RHEL-185462)
• Slower performance from RHEL 9.5 to RHEL 9.7 (JIRA:RHEL-188481)
• [B&E] [RHEL 9.9] Export Linux Symbol to read perf_event_paranoid level (JIRA:RHEL-212123)
• [RHEL9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin (JIRA:RHEL-214433)
• [RHEL-9.9] kernel-5.14.0-730.el9 stmmac patch set breaks networking on nvidia-jetson-agx-orin (JIRA:RHEL-235461)
• [RHEL 9.9] Populate kABI stablelist and enable check-kabi (JIRA:RHEL-245491)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9] (JIRA:RHEL-249753)
• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [rhel-9] (JIRA:RHEL-254168)
• [RHEL9] Disallow loading of microcode revision 0x1000423 on Intel CPUs with family/model/stepping = 6/173/1 (Granite Rapids) (JIRA:RHEL-261016)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

• BZ - 2436805 - CVE-2026-23066 kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg
• BZ - 2446109 - CVE-2026-23239 kernel: Kernel: Race condition in espintcp can lead to denial of service
• BZ - 2446139 - CVE-2026-23240 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
• BZ - 2481972 - CVE-2026-46099 kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
• BZ - 2482104 - CVE-2026-45942 kernel: ext4: fix e4b bitmap inconsistency reports
• BZ - 2492295 - CVE-2026-53075 kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
• BZ - 2492373 - CVE-2026-52945 kernel: Revert "wireguard: device: enable threaded NAPI"
• BZ - 2502219 - CVE-2026-63800 kernel: pNFS: Fix use-after-free in pnfs_update_layout()
• BZ - 2502341 - CVE-2026-64027 kernel: net: shaper: rework the VALID marking (again)
• BZ - 2502344 - CVE-2026-63914 kernel: xfrm: route MIGRATE notifications to caller's netns
• BZ - 2502433 - CVE-2026-64000 kernel: net: hsr: fix potential OOB access in supervision frame handling
• BZ - 2502615 - CVE-2026-64109 kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
• BZ - 2507031 - CVE-2026-64355 kernel: bpf: Reject fragmented frames in devmap
• BZ - 2507156 - CVE-2026-64279 kernel: i2c: core: fix adapter deregistration race
• BZ - 2507184 - CVE-2026-64375 kernel: proc: protect ptrace_may_access() with exec_update_lock (FD links)
• BZ - 2513188 - CVE-2026-68398 kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability
• BZ - 2513448 - CVE-2026-68103 kernel: drm/amdgpu: reject mapping a reserved doorbell to a new queue
• BZ - 2513469 - CVE-2026-68181 kernel: mei: bus: access mei_device under device_lock on cleanup
• BZ - 2528646 - CVE-2026-80864 kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
• BZ - 2528665 - CVE-2026-80863 kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RHEL-153431 - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
• RHEL-163621 - [rhel-9] MHI bus update to v6.19
• RHEL-163622 - [rhel-9 wireless] Wireless core and drivers rebase to v6.19
• RHEL-158968 - [HPEMC RHEL 9 BUG] x86/platform/uv: fix panic when deconfiguring socket.
• RHEL-180602 - Backport tracing fixes for bpftrace support

CVEs

• CVE-2026-23066
• CVE-2026-23239
• CVE-2026-23240
• CVE-2026-46099
• CVE-2026-52945
• CVE-2026-53075
• CVE-2026-63914
• CVE-2026-64000
• CVE-2026-64027
• CVE-2026-64109
• CVE-2026-64279
• CVE-2026-64355
• CVE-2026-64375
• CVE-2026-68103
• CVE-2026-68181
• CVE-2026-68398
• CVE-2026-80863
• CVE-2026-80864

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.9_release_notes/index