Issued at: 2026-11-13
Updated at: 2026-11-14
Advisory content derived from Red Hat RHSA-2026:99133, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: kernel security, bug fix, and enhancement update
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
* kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
* kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)
* kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
* kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
* kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)
* kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)
* kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)
* kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)
* kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
* kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
* kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951)
* kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956)
* kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)
* kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)
* kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)
* kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)
Bug Fix(es) and Enhancement(s):
* mpls test multi_path fails on 10.3 CTC2 compose (JIRA:Rocky Linux-222766)
* Rocky Linux10.0 - kernel: CPU hotplug unsupported by CPUMF [rhel-10.3.z] (JIRA:Rocky Linux-270889)
* Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-10.3.z] (JIRA:Rocky Linux-280591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.