Red Hat Product Errata RHSA-2026:63128 - Security Advisory Issued: 2026-09-03 Updated: 2026-09-03 RHSA-2026:63128 - Security Advisory Overview Updated Packages Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2492447 - CVE-2026-53073 kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error BZ - 2502235 - CVE-2026-63808 kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() BZ - 2502248 - CVE-2026-63824 kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() BZ - 2507046 - CVE-2026-64387 kernel: smb: client: fix query directory replay double-free BZ - 2513392 - CVE-2026-68145 kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range BZ - 2520980 - CVE-2026-74581 kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer CVEs CVE-2026-53073 CVE-2026-63808 CVE-2026-63824 CVE-2026-64387 CVE-2026-68145 CVE-2026-74581 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM kernel-6.12.0-211.51.1.el10_2.src.rpm SHA-256: 7cadc05cfbbe6d7f277b47566e050f428aef3680abf6c5fba8983e93e42a970b x86_64 kernel-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 77e8fc183820848a08fd7237eb66c9551cc39aed8838d2fb86da671310666e6d kernel-abi-stablelists-6.12.0-211.51.1.el10_2.noarch.rpm SHA-256: 31a2ff8e430f41152b70647e3c6db6618de5be2f724c4a07d96849d08cb7a4b7 kernel-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 190df65bc0c09c5e1d8ba71a7ac168b25307b8d5fe767894752eb04acc905a90 kernel-debug-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 0e3acc70066ae38f9a6e82d4e12d5a43a6a0d0b5bb06aa17529d9e0331aceb3c kernel-debug-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: cf0f18bb2b987d10cc7d710f5d820d16c4b7fb3df77a406746cdbb12cfaaee42 kernel-debug-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 2674c994a0a1253d1d8f725ebc6da8154daf18025212164ddf9e46a7c121c73b kernel-debug-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 2674c994a0a1253d1d8f725ebc6da8154daf18025212164ddf9e46a7c121c73b kernel-debug-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 2674c994a0a1253d1d8f725ebc6da8154daf18025212164ddf9e46a7c121c73b kernel-debug-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 2674c994a0a1253d1d8f725ebc6da8154daf18025212164ddf9e46a7c121c73b kernel-debug-devel-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 8071987d52effe274a96f07d4f65a71c4344b4f251aaa730c69b003783f4e4fe kernel-debug-devel-matched-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 06a500f781544b239c1bdfb4c9327fba922e9c5a890859253be9bab40a873441 kernel-debug-modules-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 51a3d1918ccea67914c6b1d299af685210e4cc248d866261543c68995c630635 kernel-debug-modules-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: f392cf4a30fbbe0d1fc1be019fbc466a7134d4aa7f3bba73ab06ef8983c7bb0d kernel-debug-modules-extra-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 37bc6b7d4ffa3204064d1ea46ae782463261536acac2152ea78a1ea472393ee4 kernel-debug-uki-virt-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 20c753221b1dac1a982ec16d42e8942435d3d9ee42fe401107a179c9574706bb kernel-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: f44aa957210d06031b16b9b768f7da5564a030208f6e425a91a5ae95355772df kernel-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: f44aa957210d06031b16b9b768f7da5564a030208f6e425a91a5ae95355772df kernel-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: f44aa957210d06031b16b9b768f7da5564a030208f6e425a91a5ae95355772df kernel-debuginfo-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: f44aa957210d06031b16b9b768f7da5564a030208f6e425a91a5ae95355772df kernel-debuginfo-common-x86_64-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 52bb15baf0c7107465f845eb194e3d0b20be2ed64c661255a6a9900fde346061 kernel-debuginfo-common-x86_64-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 52bb15baf0c7107465f845eb194e3d0b20be2ed64c661255a6a9900fde346061 kernel-debuginfo-common-x86_64-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 52bb15baf0c7107465f845eb194e3d0b20be2ed64c661255a6a9900fde346061 kernel-debuginfo-common-x86_64-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 52bb15baf0c7107465f845eb194e3d0b20be2ed64c661255a6a9900fde346061 kernel-devel-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 1f5786d1f2dd47fc1194279a52d9231c8d72d0dd64f5e76272b6c5b9e48046d3 kernel-devel-matched-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 8f608ed89827683d979219b139e1eeadbb3a6507d91ce500271a4a855feb1328 kernel-doc-6.12.0-211.51.1.el10_2.noarch.rpm SHA-256: e34ea46c060a796f4c3f543b9fe8b4cbde134242380d981da92dd8eb197c8d07 kernel-headers-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 5b5026365d898e6c41330fb31e77f70deaed8f60d8706fedfc53dbf9902ce8c2 kernel-modules-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: c6a0ce1fbb713b654b806bc94e776b66caeea39eb69b948d4ce198cdce1c15cd kernel-modules-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 4836c5c997875e4275d9f7247396ae2a2fdbbb4182257c59840a1b5ec826abd0 kernel-modules-extra-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: fdb8bed40a23c68e635b36107c25c12490caa2ec34b6be8f01f260ef2f15de0c kernel-modules-extra-matched-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: a4c348a6367171ebf55451b7c957b6f416f52cd96781e43f0ace885fde04d347 kernel-rt-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: e66ee1cb8df0514ad6007279871e1cedaf1210f5200cc5a1900d00f74e5e91de kernel-rt-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: e66ee1cb8df0514ad6007279871e1cedaf1210f5200cc5a1900d00f74e5e91de kernel-rt-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 55afb955062b1eec3498bacf4e3bd40a0476dc8a755a1b6cd3f0eb1bd3614bf5 kernel-rt-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: 55afb955062b1eec3498bacf4e3bd40a0476dc8a755a1b6cd3f0eb1bd3614bf5 kernel-rt-debug-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: c8f0f2c5d3e0eaeb1e96633e3d5a17f976eac998605b66b3b78cda870786e6f2 kernel-rt-debug-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: c8f0f2c5d3e0eaeb1e96633e3d5a17f976eac998605b66b3b78cda870786e6f2 kernel-rt-debug-core-6.12.0-211.51.1.el10_2.x86_64.rpm SHA-256: d22f702582648bae5e8a849c8dbe86c98a036818fc804574cb208e170