This Red Hat kernel security update addresses multiple high-severity vulnerabilities (CVSS scores 7.8-7.9), including a use-after-free in the GFS2 iomap write path (CVE-2026-45984) and a double-free in the Xen privcmd driver via VMA splitting (CVE-2026-31787). The vulnerabilities affect a wide range of Linux kernel versions; for example, CVE-2026-31787 affects kernels from 3.8 up to but excluding 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, and 6.18.26. The fix is provided via the Red Hat kernel package update for RHEL 9.2 Update Services for SAP Solutions, and a system reboot is required for the update to take effect.
Red Hat Product Errata RHSA-2026:51603 - Security Advisory Issued: 2026-08-07 Updated: 2026-08-07 RHSA-2026:51603 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): qemu-kvm: error: failed to set MSR 0xc0000102 to 0xff4547ceb1600000 [RHEL.9.2.z] (JIRA:RHEL-126981) [RHEL9.2-z] observe hang with nvme/051 test (JIRA:RHEL-129407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2406712 - CVE-2025-40026 kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O BZ - 2464092 - CVE-2026-31787 kernel: xen/privcmd: fix double free via VMA splitting BZ - 2481922 - CVE-2026-45984 kernel: gfs2: Fix use-after-free in iomap inline data write path BZ - 2486958 - CVE-2025-10263 kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources BZ - 2492094 - CVE-2026-52923 kernel: ipc: limit next_id allocation to the valid ID range BZ - 2507402 - CVE-2026-64531 kernel: net: openvswitch: reject oversized nested action attrs CVEs CVE-2025-10263 CVE-2025-40026 CVE-2026-31787 CVE-2026-45984 CVE-2026-52923 CVE-2026-64531 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM kernel-5.14.0-284.186.1.el9_2.src.rpm SHA-256: cdd053a3b646a36e2173aa18c7e6dbd13dd7180f45f0c7476c057eb1085d34c3 x86_64 bpftool-7.0.0-284.186.1.el9_2.x86_64.rpm SHA-256: fa9a55b2c3b54861a224e0c2f9d33af10f465f861cd00ee2b7de135d52e13685 bpftool-debuginfo-7.0.0-284.186.1.el9_2.x86_64.rpm SHA-256: 6f05be283fdc7acbc2d5b05b9aaef8b6a7fec006c10fde7bf2f0febecb11f8be bpftool-debuginfo-7.0.0-284.186.1.el9_2.x86_64.rpm SHA-256: 6f05be283fdc7acbc2d5b05b9aaef8b6a7fec006c10fde7bf2f0febecb11f8be kernel-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: c376a3610b3bfddf0ec4d9bf2133c2504e842fcbaaa74cc9c3cd49441a5a4182 kernel-abi-stablelists-5.14.0-284.186.1.el9_2.noarch.rpm SHA-256: 463706bf178d63b9540d902a2e3ef8970c62e78343fc2ccabfa3a057fd23709e kernel-core-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 5113811cb45d3ae1c9c9553f39da26a8f0a9e5f45385565c1aa030b1ca6ad4f4 kernel-debug-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 594599e2c38192f3108fc1615de0c3386eea7e99e02e5b80348a7b09b2390e42 kernel-debug-core-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 13766bd4f1f20d7d31c5b5ba7ad6b229cabd7ca4bb3cc4d31480b9f91e5495da kernel-debug-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 019f2842ff836060ea3947a09e1a6cc469dbeada3478d522a44781275c03a6e8 kernel-debug-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 019f2842ff836060ea3947a09e1a6cc469dbeada3478d522a44781275c03a6e8 kernel-debug-devel-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 4c0be95272fcbc333eed676c01ccb7ffd8ad9c174372c46d16e41ace24a17624 kernel-debug-devel-matched-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: bfc08041a4fd859394f348a7e2bcf3f5847b1ca279c2d6486052cfa1185dab0d kernel-debug-modules-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 2d347035e75af87198d57252cca4a058c165beebdc44dc74b1379905feffc2a2 kernel-debug-modules-core-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 9b96ee10d842ab11ccc90952c2dea83a8ce77f011fd14b712b0d44ca83606918 kernel-debug-modules-extra-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b224fa3ba95631492cd24f1118df16add0483952bf86519251e911ac3985ceae kernel-debug-uki-virt-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: f6a3bd2077739a911f90f7639b8f44e22d799d1c5aeadea32ccf6e2f1a95511c kernel-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b2f2070a0b8af5f9a4930bcd99a8c434caff3638ef2e711f218b8e9203520b06 kernel-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b2f2070a0b8af5f9a4930bcd99a8c434caff3638ef2e711f218b8e9203520b06 kernel-debuginfo-common-x86_64-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 10cc39b2cbf72c58894e1e9a030fae8b51a5fba40d59290b16f465db50d32542 kernel-debuginfo-common-x86_64-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 10cc39b2cbf72c58894e1e9a030fae8b51a5fba40d59290b16f465db50d32542 kernel-devel-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 3bd682c5489935ebc9d8db46f3274ade7283b942bde40f96a5230852bc96d171 kernel-devel-matched-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 740cfac2ed6c0e445bc7d0871a8b48e1b06bb963bda0caaf370fe86207dd72e7 kernel-doc-5.14.0-284.186.1.el9_2.noarch.rpm SHA-256: 9521cef592481f1af07bac3379f59f917c0855b5fff6e71af53b45a8bce6f2a1 kernel-headers-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 062bb9c10a09b04a7782d89270968addc087ab85b991ebb1f71d454afcb30fcd kernel-modules-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 7e70b5c789b88980806b16ab5406a16edff298cc17e861fb83204ea4429e36e9 kernel-modules-core-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b40ba57b15d2e74c2e1b1f8c85ecb71064c18e39647efc8f6fe261bee1dac87b kernel-modules-extra-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 15793b1e90a1f6f30afaa34516fb18eea9a2bcea604e19c9cad52b911b5afe5a kernel-tools-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 91c440a30f277622c1105853273ed9a2703a5c18474099a9be0faa902948146f kernel-tools-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 54e1d6627c9dea4f4a031a6910ac6fae7cf378026884f804c31efdc50dd7ebf2 kernel-tools-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 54e1d6627c9dea4f4a031a6910ac6fae7cf378026884f804c31efdc50dd7ebf2 kernel-tools-libs-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 805f417517b76675015500ee589c247e3711a860d74ebebdc40797f59a0326ed kernel-uki-virt-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 89af230222004b9c1ed2349b45ce46c22998d9d74aa83f33554504efd75ff059 perf-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: afeb0c343dbc9df7876f40a008be88ccc45fe89a7ae789a3ca5df7a871021a75 perf-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b3247fb273e44b4372760b28ac3a9af279b7c356db6b00d852f91352be899532 perf-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: b3247fb273e44b4372760b28ac3a9af279b7c356db6b00d852f91352be899532 python3-perf-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 961bb68bd5ab3fbfa008cc43549ddbbee66114fa64924650538e91b38122999b python3-perf-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 68d774713b9530f1ba566df96855db6b2cf2878b08584f61734e205c3f839b25 python3-perf-debuginfo-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 68d774713b9530f1ba566df96855db6b2cf2878b08584f61734e205c3f839b25 rtla-5.14.0-284.186.1.el9_2.x86_64.rpm SHA-256: 30c32140e376b9146c868f726c3a5f80a7bfe55bdbb0ea165c2e336679b6d4e5 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM kernel-5.14.0-284.186.1.el9_2.src.rpm SHA-256: cdd053a3b646a36e2173aa18c7e6dbd13dd7180f45f0c7476c057eb1085d34c3 ppc64le bpftool-7.0.0-284.186.1.el9_2.ppc64le.rpm SHA-256: 5cdc3102d2f8fefd50e2b66f7fc9d78af3b8deafa03b218505c739b4979623bf bpftool-debuginfo-7.0.0-284.186.1.el9_2.ppc64le.rpm SHA-256: 4e0cd14237addf7570bf1c2aa200470f34f58c1fc757e45b2a8a826e7eec82e0 bpftool-debuginfo-7.0.0-284.186.1.el9_2.ppc64le.rpm SHA-256: 4e0cd14237addf7570bf1c2aa200470f34f58c1fc757e45b2a8a826e7eec82e0 kernel-5.14.0-284.186.1.el9_2.ppc64le.rpm SHA-256: f3beb0a156d