This Red Hat kernel security update addresses three vulnerabilities, including a critical double-free flaw in tipc_buf_append() (CVE-2026-52993, CVSS 9.8) and a high-severity issue in IPC ID allocation (CVE-2026-52923, CVSS 7.8). Affected Linux kernel versions span multiple major branches, specifically versions 3.8.1 through 5.10.258, 5.11 through 5.15.209, 5.16 through 6.1.175, 6.2 through 6.6.141, and 6.7 through 6.12.91 for the critical CVE. The fixes are included in kernel updates for RHEL 9, and a full system reboot is required after applying the patch.
Red Hat Product Errata RHSA-2026:49212 - Security Advisory Issued: 2026-07-31 Updated: 2026-07-31 RHSA-2026:49212 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2492094 - CVE-2026-52923 kernel: ipc: limit next_id allocation to the valid ID range BZ - 2492437 - CVE-2026-52993 kernel: tipc: fix double-free in tipc_buf_append() BZ - 2504052 - CVE-2026-64530 kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle BZ - 2507345 - kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle CVEs CVE-2026-52923 CVE-2026-52993 CVE-2026-64530 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM kernel-5.14.0-687.33.1.el9_8.src.rpm SHA-256: c70092c927b9e0fb6415c6e23bb24da2eac9e9a3b95d9621e405a9728fb47fa3 x86_64 kernel-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 9b4222021c412e2811347fbd5c713f04065cd2c87e69c4c666c9b9aed62a4b4f kernel-abi-stablelists-5.14.0-687.33.1.el9_8.noarch.rpm SHA-256: 741e1f1aa9691dd8d2466c0a9e8d25216e2b81dad6ee37dcc528aa3955153195 kernel-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 8b1be1d038e74b5018f2338617f4a897b3430cb4d3caf0489c3f20dbd57423a8 kernel-debug-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 50877ba07f6e1f77c87e0098319ebe6c2774fe2d2f1a489cc159aa87d90b4321 kernel-debug-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 4743f608ff0affcaa12fdba4355937de3b6bd756c4c3dfd97bbcf5034399e35c kernel-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7bb13c5c8d5fe06fe5991ce6d72b396d70284db7620747d20b38a3a4eac418a8 kernel-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7bb13c5c8d5fe06fe5991ce6d72b396d70284db7620747d20b38a3a4eac418a8 kernel-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7bb13c5c8d5fe06fe5991ce6d72b396d70284db7620747d20b38a3a4eac418a8 kernel-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7bb13c5c8d5fe06fe5991ce6d72b396d70284db7620747d20b38a3a4eac418a8 kernel-debug-devel-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: f1dc48fd65149804e676d3d7010887f38f33bbb71a622b5419118dc3492de317 kernel-debug-devel-matched-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 959509e2d08534abbfff2bb66ef330edc8550ec5a0af1c34c457ef6f379377ae kernel-debug-modules-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: b4082bba01c0da3ff9d76685c15951adbc87ebc77bb0f80e477346af7d11910f kernel-debug-modules-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 59901c753ad31c3656256eec1a7f1324936f5f607e7b090caf4b24c61d651a1f kernel-debug-modules-extra-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 0e56fc75e89ac5b89cda4f6e1f4eddfd21ca1442514da78c9ce9ac2ad432d9c2 kernel-debug-uki-virt-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: b47848c7070de05eecc30e6e656ec47a45509781fce81637aa9f2cb130379ab8 kernel-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: c8203ef798a0deb9e1c8e6b43dae029030530ae501316f0d5fbabbdb3be892ba kernel-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: c8203ef798a0deb9e1c8e6b43dae029030530ae501316f0d5fbabbdb3be892ba kernel-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: c8203ef798a0deb9e1c8e6b43dae029030530ae501316f0d5fbabbdb3be892ba kernel-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: c8203ef798a0deb9e1c8e6b43dae029030530ae501316f0d5fbabbdb3be892ba kernel-debuginfo-common-x86_64-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 52719d1eaa8a1297a2ff6369fb5a7e8fd5b085a2bbc76f5a958ce3ed281d241b kernel-debuginfo-common-x86_64-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 52719d1eaa8a1297a2ff6369fb5a7e8fd5b085a2bbc76f5a958ce3ed281d241b kernel-debuginfo-common-x86_64-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 52719d1eaa8a1297a2ff6369fb5a7e8fd5b085a2bbc76f5a958ce3ed281d241b kernel-debuginfo-common-x86_64-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 52719d1eaa8a1297a2ff6369fb5a7e8fd5b085a2bbc76f5a958ce3ed281d241b kernel-devel-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: e1abc4fdbcb32c6124677295f3c4b0d6b78a2a31cdf5770175ec91c14ce4cfeb kernel-devel-matched-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 2604d776acecdcf567d96028614260486aeab19787e807fcb9b14706b594cf8f kernel-doc-5.14.0-687.33.1.el9_8.noarch.rpm SHA-256: 0b288363f3c585dadec35871db42bc5548cb81d172abd3ec748aaf92fcad681c kernel-headers-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: b2fad6a2fcb1a77e633a3f368301bdaab11a7b7347e7bbada815f0a0626d7695 kernel-modules-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 996aec6373b0e7bd4e9ea96feea15369686dbda4ba87d178e0e21e1f8a6e530a kernel-modules-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: a3cc8b8bc28dc3d1878085e2044e80b1f7b3b0cf210d26dbdf477bce2e764a82 kernel-modules-extra-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: d08473c01e8df3e3b2daa17212cef089fbd76453a14a203463c8dee7a87aedce kernel-rt-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: bef0c2591a01bb51da5f466e4dc0980fa2e3b25e3e5f521129a0147900c6fa3e kernel-rt-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: bef0c2591a01bb51da5f466e4dc0980fa2e3b25e3e5f521129a0147900c6fa3e kernel-rt-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: fb41892ff85770e755748d2fba0b4df99fc25e7a79f17e2bf74d4d513b66d98d kernel-rt-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: fb41892ff85770e755748d2fba0b4df99fc25e7a79f17e2bf74d4d513b66d98d kernel-rt-debug-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7daa73e16c9d86951b558286b4f7e7e8215e5691010185ad220702313c920767 kernel-rt-debug-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 7daa73e16c9d86951b558286b4f7e7e8215e5691010185ad220702313c920767 kernel-rt-debug-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 791392ada23eeadfecc9dfabe7e3006fd3283a3060abee3d2b5af88441381c23 kernel-rt-debug-core-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 791392ada23eeadfecc9dfabe7e3006fd3283a3060abee3d2b5af88441381c23 kernel-rt-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 9b853683e501e6fbe2289073411d10f7c4e1f17502ef038f12f1a3b5848894e7 kernel-rt-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 9b853683e501e6fbe2289073411d10f7c4e1f17502ef038f12f1a3b5848894e7 kernel-rt-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 9b853683e501e6fbe2289073411d10f7c4e1f17502ef038f12f1a3b5848894e7 kernel-rt-debug-debuginfo-5.14.0-687.33.1.el9_8.x86_64.rpm SHA-256: 9b853683e501e6fbe22