This Red Hat kernel security update addresses three vulnerabilities, including a use-after-free flaw in KVM's shadow paging (CVE-2026-46113, CVSS 8.8 HIGH) that could be exploited via unexpected guest frame numbers. The affected Linux kernel versions are 2.6.20 through 6.1.174, 6.2 through 6.6.139, 6.7 through 6.12.87, 6.13 through 6.18.29, and 6.19 through 7.0.6, with fixes provided in kernel versions 6.1.175, 6.6.140, 6.12.88, 6.18.30, and 7.0.7 respectively. A system reboot is required after applying the update.
Red Hat Product Errata RHSA-2026:36957 - Security Advisory Issued: 2026-07-09 Updated: 2026-07-09 RHSA-2026:36957 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2429036 - CVE-2025-71066 kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change BZ - 2482587 - CVE-2026-46113 kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN BZ - 2497033 - CVE-2026-53359 kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role CVEs CVE-2025-71066 CVE-2026-46113 CVE-2026-53359 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM kernel-5.14.0-687.24.1.el9_8.src.rpm SHA-256: 816e44d51409cf94a92cfed53b41731a4acd77b13a0c61ca400ce4026759f2bd x86_64 kernel-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b5f20c21350fa7c13372a0d33539ce27e31c786ec7db146ac22cb68dc74331ff kernel-abi-stablelists-5.14.0-687.24.1.el9_8.noarch.rpm SHA-256: b7d4ab53f459c3816b61635add3f92840adc60f49f37bb5dceda2557b823f6fe kernel-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: ec36692d8f1af47b318fc35095cee52082d6887c4e7bcd8a9813f0abb1cc2f21 kernel-debug-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5e01dbff7843113dc715be4878e58416770f30ba7ffdea60f51ce75b3bbeb561 kernel-debug-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 6aed5cd6dd476ce959f1e84c66c7835dea8c6687dc23bc9c94bcdbaa318b6bbe kernel-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: f64ba5d10b87e00720440af552f9e12dbef5b6a46054dc89eaa70e50fc7d67f3 kernel-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: f64ba5d10b87e00720440af552f9e12dbef5b6a46054dc89eaa70e50fc7d67f3 kernel-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: f64ba5d10b87e00720440af552f9e12dbef5b6a46054dc89eaa70e50fc7d67f3 kernel-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: f64ba5d10b87e00720440af552f9e12dbef5b6a46054dc89eaa70e50fc7d67f3 kernel-debug-devel-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 1e72dffdfe5b34d73e5ab8bbb086804fbc7867ea2c03aa899f5365100daaeb26 kernel-debug-devel-matched-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 7133fc4b726ac488403fc5b887f8483b0223f41716f9cb11fd0ad96414256769 kernel-debug-modules-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: c2f07ec0cbc818fb4b807dbe2fb277b3eb07d2496918f7719bd34782d71a2413 kernel-debug-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b2204de937fc96c01759c9bbde3cc1803fcf248592a2342cf96c435828bb2749 kernel-debug-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 31b493d2cd6882751b7b0b69a65e99986f9d9860bdd465fc727c5de14c5a9f78 kernel-debug-uki-virt-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5aeb53de1114667ff9e9aa3ad84dac8170509f2ae10d30b58ebaf3593de4b45f kernel-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 0a7f8d4e426528d1bfda762ddf358680011d6a9949d40f0949ba8d0277a3f744 kernel-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 0a7f8d4e426528d1bfda762ddf358680011d6a9949d40f0949ba8d0277a3f744 kernel-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 0a7f8d4e426528d1bfda762ddf358680011d6a9949d40f0949ba8d0277a3f744 kernel-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 0a7f8d4e426528d1bfda762ddf358680011d6a9949d40f0949ba8d0277a3f744 kernel-debuginfo-common-x86_64-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5d8b10b7adf7a468f4416c02839ba3807cb9c5d49b06987ba982bf404b8aee8b kernel-debuginfo-common-x86_64-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5d8b10b7adf7a468f4416c02839ba3807cb9c5d49b06987ba982bf404b8aee8b kernel-debuginfo-common-x86_64-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5d8b10b7adf7a468f4416c02839ba3807cb9c5d49b06987ba982bf404b8aee8b kernel-debuginfo-common-x86_64-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5d8b10b7adf7a468f4416c02839ba3807cb9c5d49b06987ba982bf404b8aee8b kernel-devel-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5dce2ca75aedd1d169869e80b310541fff026eaa9b35f84736fe8f056f9408ec kernel-devel-matched-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: f4031344a46f5a55fd9d788b603db81319b2d27aaf987416102836020af44074 kernel-doc-5.14.0-687.24.1.el9_8.noarch.rpm SHA-256: 8be5a6cb3d936389ad978292cba2a581eab585af6a7b25b00bc943580c100d6d kernel-headers-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 03ce3113ff3db2fa3f64a29dd5523bb754957eb3c8d0242578cb3cba27e3bc16 kernel-modules-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 671de1334fcd88092623e3cff263cd1b06e0c1b5c1449309e94bd6fef1d4ddbd kernel-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 95b99949b9df7e04fb8b01aecc3d4644fb1fcc30a7df5389388e4464d4e3a146 kernel-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 46bb6b99fb3305da864dd202e79049c2bf11abb2e348c31b6b18a4b3dcaf318c kernel-rt-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 97d5a457839789b3219e88c9d2b665b0cd7cd646ce7725d06cc0f15c6952ad3d kernel-rt-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 97d5a457839789b3219e88c9d2b665b0cd7cd646ce7725d06cc0f15c6952ad3d kernel-rt-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5034eb5b6fa2432977b773974fbca9f08fc07623f82661e7d59baf58ace325f3 kernel-rt-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 5034eb5b6fa2432977b773974fbca9f08fc07623f82661e7d59baf58ace325f3 kernel-rt-debug-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: e7d544f665c4686be818a43e924231ab1337a0030edfdcd4c17dcbc8d0388109 kernel-rt-debug-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: e7d544f665c4686be818a43e924231ab1337a0030edfdcd4c17dcbc8d0388109 kernel-rt-debug-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: bbde7638d48457bc2e3d3d498a19d99c6c70351e366c1268058937ab2bf8fe2f kernel-rt-debug-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: bbde7638d48457bc2e3d3d498a19d99c6c70351e366c1268058937ab2bf8fe2f kernel-rt-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b7ac6e25abdc0930489a274a569c1a8f23d0772dadacf3e4866e7fb5999308d6 kernel-rt-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b7ac6e25abdc0930489a274a569c1a8f23d0772dadacf3e4866e7fb5999308d6 kernel-rt-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b7ac6e25abdc0930489a274a569c1a8f23d0772dadacf3e4866e7fb5999308d6 kernel-rt-debug-debuginfo-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b7ac6e25abdc0930489a274a569c1a8f23d0772dadacf3e4866e7fb5999308d6 kernel-rt-debug-devel-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b75a07ab9cb3cc09b947dbde925f64f8db24ea6e2b0432e88466302f7c650ef2 kernel-rt-debug-devel-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: b75a07ab9cb3cc09b947dbde925f64f8db24ea6e2b0432e88466302f7c650ef2 kernel-rt-debug-modules-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: e0fc49fa9a2bd0c5caa2262e4cb88ba4ec55c5021627b6ad77b8af9b48951b6d kernel-rt-debug-modules-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: e0fc49fa9a2bd0c5caa2262e4cb88ba4ec55c5021627b6ad77b8af9b48951b6d kernel-rt-debug-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm SHA-256: 713700d31045c7148d64488afa01f8004c4dadf0466953e4955993c149e9983d kernel-rt-debug-modules-core-