RHSA-2026:99135 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
• kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
• kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)
• kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)
• kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)
• kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)
• kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385)
• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
• kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)
• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
• kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
• kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)
• kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)
• kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)
• kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
• kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)
• kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
• kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956)
• kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)
• kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)
• kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)
• kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
• kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)
• kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741)
• kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)
• kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)
• kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

Bug Fix(es) and Enhancement(s):

• [RHEL9.9z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255218)
• RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [rhel-9.9.z] (JIRA:RHEL-256280)
• MADVISE i/o size in RHEL 9 additionally limited by read_ahead_kb - Was addressed in RHEL8 via RHEL-22476 [rhel-9.9.z] (JIRA:RHEL-259532)
• try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.9.z] (JIRA:RHEL-269061)
• RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.9.z] (JIRA:RHEL-270893)
• Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.9.z] (JIRA:RHEL-274411)
• af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() [rhel-9.9] (JIRA:RHEL-275410)
• Kernel panic after stopping retis capture [rhel-9.9.z] (JIRA:RHEL-275457)
• Hard lockup experienced with repro from RHEL-282072 [rhel-9.9.z] (JIRA:RHEL-290031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

• BZ - 2492750 - CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()
• BZ - 2513293 - CVE-2026-68140 kernel: net/iucv: fix use-after-free of a severed iucv_path
• BZ - 2513314 - CVE-2026-68162 kernel: sctp: avoid auth_enable sysctl UAF during netns teardown
• BZ - 2515351 - CVE-2026-68452 kernel: s390/zcrypt: Validate length for CCA AES cipher key requests
• BZ - 2515353 - CVE-2026-68451 kernel: s390/zcrypt: Validate length for CCA ECC private key requests
• BZ - 2516278 - CVE-2026-72222 kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
• BZ - 2516412 - CVE-2026-72221 kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race
• BZ - 2516837 - CVE-2026-74385 kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
• BZ - 2521384 - CVE-2026-74588 kernel: sctp: keep chunk->transport in step with the list it is queued on
• BZ - 2521419 - CVE-2026-74586 kernel: sctp: clear new_transport when removing a peer
• BZ - 2524422 - CVE-2026-74752 kernel: sctp: validate cookie AUTH state before use
• BZ - 2524438 - CVE-2026-80586 kernel: mptcp: options: reset DSS fields in case of unexpected size
• BZ - 2524442 - CVE-2026-80553 kernel: s390/vfio_ccw: Cancel existing workqueues
• BZ - 2524458 - CVE-2026-80571 kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
• BZ - 2524475 - CVE-2026-80584 kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls
• BZ - 2528542 - CVE-2026-80792 kernel: ipv6: fix use-after-free in ip6_finish_output2()
• BZ - 2532104 - CVE-2026-80981 kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
• BZ - 2532230 - CVE-2026-89633 kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
• BZ - 2532290 - CVE-2026-89479 kernel: sctp: stop processing a packet once its association is deleted
• BZ - 2535200 - CVE-2026-89956 kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
• BZ - 2536701 - CVE-2026-90207 kernel: ALSA: seq: midi: Serialize input teardown with event_input
• BZ - 2541360 - CVE-2026-98116 kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
• BZ - 2546374 - CVE-2026-98318 kernel: smb: client: validate absolute native symlink targets before NT fixups
• BZ - 2553429 - CVE-2026-99999 kernel: ipv4: validate checksum_start before completing checksum
• BZ - 2554848 - CVE-2026-98442 kernel: net/sched: act_ct: fix helper UAF due to extensions realloc
• BZ - 2555081 - CVE-2026-98741 kernel: ALSA: ua101: reject mismatched capture/playback packet sizes
• BZ - 2559710 - CVE-2026-99032 kernel: net/smc: protect clcsock lifetime in smc_getname
• BZ - 2562697 - CVE-2026-99152 kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses
• BZ - 2562706 - CVE-2026-99153 kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU

CVEs

• CVE-2026-53196
• CVE-2026-68140
• CVE-2026-68162
• CVE-2026-68451
• CVE-2026-68452
• CVE-2026-72221
• CVE-2026-72222
• CVE-2026-74385
• CVE-2026-74586
• CVE-2026-74588
• CVE-2026-74752
• CVE-2026-80553
• CVE-2026-80571
• CVE-2026-80584
• CVE-2026-80586
• CVE-2026-80792
• CVE-2026-80981
• CVE-2026-89479
• CVE-2026-89633
• CVE-2026-89956
• CVE-2026-90207
• CVE-2026-98116
• CVE-2026-98318
• CVE-2026-98442
• CVE-2026-98741
• CVE-2026-99032
• CVE-2026-99152
• CVE-2026-99153
• CVE-2026-99999

References

• https://access.redhat.com/security/updates/classification/#moderate