RHSA-2026:98047 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
• kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
• kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)
• kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
• kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x

Fixes

• BZ - 2492105 - CVE-2026-52912 kernel: netfilter: nf_queue: hold bridge skb->dev while queued
• BZ - 2492795 - CVE-2026-53254 kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers
• BZ - 2502230 - CVE-2026-63829 kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2502320 - CVE-2026-63889 kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
• BZ - 2502431 - CVE-2026-63992 kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
• BZ - 2502438 - CVE-2026-63913 kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
• BZ - 2502444 - CVE-2026-63994 kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
• BZ - 2507061 - CVE-2026-64320 kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
• BZ - 2507399 - CVE-2026-64534 kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
• BZ - 2513165 - CVE-2026-68159 kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap
• BZ - 2513212 - CVE-2026-68157 kernel: Linux kernel: libceph null pointer dereference leads to denial of service
• BZ - 2513232 - CVE-2026-68156 kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update
• BZ - 2513295 - CVE-2026-68155 kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps
• BZ - 2514441 - CVE-2026-68432 kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2516251 - CVE-2026-68476 kernel: ipvs: reload ip header after head reallocation
• BZ - 2516306 - CVE-2026-72052 kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2516717 - CVE-2026-72255 kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
• BZ - 2517052 - CVE-2026-74569 kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
• BZ - 2521375 - CVE-2026-74669 kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• BZ - 2525436 - CVE-2026-80714 kernel: ipvs: do not propagate one-packet flag to synced conns
• BZ - 2532184 - CVE-2026-89481 kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
• BZ - 2540479 - CVE-2026-97417 kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

CVEs

• CVE-2026-52912
• CVE-2026-53254
• CVE-2026-63829
• CVE-2026-63889
• CVE-2026-63913
• CVE-2026-63992
• CVE-2026-63994
• CVE-2026-64320
• CVE-2026-64534
• CVE-2026-68155
• CVE-2026-68156
• CVE-2026-68157
• CVE-2026-68159
• CVE-2026-68432
• CVE-2026-68476
• CVE-2026-72052
• CVE-2026-72255
• CVE-2026-74569
• CVE-2026-74669
• CVE-2026-80714
• CVE-2026-89481
• CVE-2026-97417

References

• https://access.redhat.com/security/updates/classification/#important