Issued at: 2026-09-05
Updated at: 2026-09-07
Advisory content derived from Red Hat RHSA-2026:63129, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: kernel security, bug fix, and enhancement update
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
* kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
* kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
* kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
* kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
* kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
* kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
* kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)
* kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
* kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
* kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
* kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
* kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
* kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)
* kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
* kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
* kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
* kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
* kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
* kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)
* kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)
* kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
* kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
Bug Fix(es) and Enhancement(s):
* [Rocky Linux 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z] (JIRA:Rocky Linux-213940)
* RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:Rocky Linux-240634)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.