Red Hat Product Errata RHSA-2026:30848 - Security Advisory Issued: 2026-06-29 Updated: 2026-06-29 RHSA-2026:30848 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): [RHEL-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:RHEL-169057) iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.8.z] (JIRA:RHEL-172993) nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [rhel-9.8.z] (JIRA:RHEL-178273) sched/fair: Skip sched_balance_running cmpxchg when balance is not due [rhel-9.8.z] (JIRA:RHEL-182776) [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [rhel-9.8.z] (JIRA:RHEL-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2460619 - CVE-2026-31488 kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation BZ - 2464397 - CVE-2026-43038 kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() BZ - 2468124 - CVE-2026-43329 kernel: netfilter: flowtable: strictly check for maximum number of actions BZ - 2481980 - CVE-2026-46090 kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop BZ - 2482025 - CVE-2026-46054 kernel: selinux: fix overlayfs mmap() and mprotect() access checks BZ - 2482031 - CVE-2026-45898 kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list BZ - 2482588 - CVE-2026-46189 kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path BZ - 2482594 - CVE-2026-46176 kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() CVEs CVE-2026-31488 CVE-2026-43038 CVE-2026-43329 CVE-2026-45898 CVE-2026-46054 CVE-2026-46090 CVE-2026-46176 CVE-2026-46189 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM kernel-5.14.0-687.19.1.el9_8.src.rpm SHA-256: 8a7756170571dc0d948da3123aa6e08ac3e0211847ee536692982e475b06bb95 x86_64 kernel-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 846af00269e3dacaaf750e2d59cb88cf6857f5ffee0036bd6ff63bad29da9515 kernel-abi-stablelists-5.14.0-687.19.1.el9_8.noarch.rpm SHA-256: fb8679490bcfa6e567ac58367e4b24943f55a5892b4b7e3452e3b82181229cb7 kernel-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 559a5cd4855856006392a7f7ae4afdc371e2bed285417a37f3d9c30b2a7fe1da kernel-debug-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 78af68f92da54d14d8016c68fd096f4ef7bf08715740a2bfd6b7c87dce1e6e8c kernel-debug-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 3605c83dd21c0e63eb5d2bcbf6cbacbdb810e7c85dd28f229ceda71cd3ab9f7d kernel-debug-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 8c987e61d974468f03b73a7e31eec50e7ab6d86d6debfd001519082d58a1e402 kernel-debug-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 8c987e61d974468f03b73a7e31eec50e7ab6d86d6debfd001519082d58a1e402 kernel-debug-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 8c987e61d974468f03b73a7e31eec50e7ab6d86d6debfd001519082d58a1e402 kernel-debug-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 8c987e61d974468f03b73a7e31eec50e7ab6d86d6debfd001519082d58a1e402 kernel-debug-devel-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: e5133e10a927d50bb99e147093e1b4da337e32c4a520877b073a748e131f9bff kernel-debug-devel-matched-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 795d71357c761e48cefbba6ae01453daeeb988f289439e17a3cedf2774fc4c16 kernel-debug-modules-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 2d5ee0fc702e43ece9030d80b8a740b7d5bd50cd0745e0542f968dde2710da5e kernel-debug-modules-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 677d480b8e249e7de5f9683d859062cb3454a2b23c3cbae5fec1ae8592e40cba kernel-debug-modules-extra-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 4b6f461a1a65b0eb865310f49f87066f45067b9a60e04c9acbbab5e82a2ade7e kernel-debug-uki-virt-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 44c7164321c9390e0b74ef05a7f11c509dc25b4e5c57535668e71478f6305759 kernel-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: e14149af7b2ac1a10f0e0b133bd366c9042fac2d33533ad6229b854c6ea74438 kernel-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: e14149af7b2ac1a10f0e0b133bd366c9042fac2d33533ad6229b854c6ea74438 kernel-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: e14149af7b2ac1a10f0e0b133bd366c9042fac2d33533ad6229b854c6ea74438 kernel-debuginfo-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: e14149af7b2ac1a10f0e0b133bd366c9042fac2d33533ad6229b854c6ea74438 kernel-debuginfo-common-x86_64-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0df98535c43104ca4a9be86f67b937f7f85e9e8d1c46ed6db9968f8500ffa26a kernel-debuginfo-common-x86_64-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0df98535c43104ca4a9be86f67b937f7f85e9e8d1c46ed6db9968f8500ffa26a kernel-debuginfo-common-x86_64-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0df98535c43104ca4a9be86f67b937f7f85e9e8d1c46ed6db9968f8500ffa26a kernel-debuginfo-common-x86_64-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0df98535c43104ca4a9be86f67b937f7f85e9e8d1c46ed6db9968f8500ffa26a kernel-devel-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 602b53f3c35b20ff0ba9576f3f0a5c9f47b192cf9d7a534c2d22cfb5f970fe12 kernel-devel-matched-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 88ae5fa91e398337e84e206db84f9b878c11006a15c33ca9b66fd2bb2524ed03 kernel-doc-5.14.0-687.19.1.el9_8.noarch.rpm SHA-256: 0ddfc5a24394fdfc7ffd23375772ca2b09fe925aa51fecbad206fde3ddcc76df kernel-headers-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: abf1c02de3fd7edded172548c889899a05ed712b842dfb719dd25768466339de kernel-modules-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 12f3050d4e1c807556c6c167d94ce41aae5e6a3ec3028368ca3e884b4ab530ac kernel-modules-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: c2119626c69bb4cc9744034641cf708e148f25cbea5ad6a34c860544a07bc52c kernel-modules-extra-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 2ffff40341f08ffda7d5afcc03092fba239fc566c43db468f5e5dda288802d5a kernel-rt-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 627b43b1d79aaf974d00afe36eb3f541b2b052acc44e7638b35e6209353b16ed kernel-rt-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 627b43b1d79aaf974d00afe36eb3f541b2b052acc44e7638b35e6209353b16ed kernel-rt-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0aba73c672c7b75837ef18d4fbc5ec3d0b3958e7e241c723f116d13572620574 kernel-rt-core-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 0aba73c672c7b75837ef18d4fbc5ec3d0b3958e7e241c723f116d13572620574 kernel-rt-debug-5.14.0-687.19.1.el9_8.x86_64.rpm SHA-256: 6a3c092e567605b941403a4cf55aa9daf7e910f69