Red Hat Product Errata RHSA-2026:65712 - Security Advisory Issued: 2026-09-09 Updated: 2026-09-09 RHSA-2026:65712 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet (CVE-2025-38403) kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) Bug Fix(es) and Enhancement(s): smb: client: use actual path when queryfs (JIRA:RHEL-145425) RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.4.z] (JIRA:RHEL-244408) kernel warning : kernel/softirq.c:306 do_softirq_post_smp_call_flush+0x29/0x60 when system is booted with nosmt [rhel-9.4.z] (JIRA:RHEL-80300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2383421 - CVE-2025-38403 kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet BZ - 2466994 - CVE-2026-43114 kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry BZ - 2481972 - CVE-2026-46099 kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels BZ - 2482024 - CVE-2026-45998 kernel: rxrpc: Fix potential UAF after skb_unshare() failure BZ - 2482181 - CVE-2026-46056 kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers BZ - 2482576 - CVE-2026-46117 kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() BZ - 2482581 - CVE-2026-46145 kernel: RDMA/mana: Validate rx_hash_key_len BZ - 2492363 - CVE-2026-53006 kernel: ipv6: fix possible UAF in icmpv6_rcv() BZ - 2492390 - CVE-2026-53009 kernel: ice: fix double-free of tx_buf skb BZ - 2492750 - CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() BZ - 2502329 - CVE-2026-63886 kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode BZ - 2507119 - CVE-2026-64304 kernel: crypto: qat - validate RSA CRT component lengths CVEs CVE-2025-38403 CVE-2026-43114 CVE-2026-45998 CVE-2026-46056 CVE-2026-46099 CVE-2026-46117 CVE-2026-46145 CVE-2026-53006 CVE-2026-53009 CVE-2026-53196 CVE-2026-63886 CVE-2026-64304 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM kernel-5.14.0-427.149.1.el9_4.src.rpm SHA-256: 0def13e9c03d3b4c1c1bc60c971e62bdf6ae39f7c73b19acafb64a129febd3ad x86_64 bpftool-7.3.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2dc87e5351585e746801aa2400741eb132ce83625e1dbf824972203d428d0660 bpftool-debuginfo-7.3.0-427.149.1.el9_4.x86_64.rpm SHA-256: 64d69642f1d83022ac3e4da776b84a767d21f6429b7450eac7a18eb3cc77d023 bpftool-debuginfo-7.3.0-427.149.1.el9_4.x86_64.rpm SHA-256: 64d69642f1d83022ac3e4da776b84a767d21f6429b7450eac7a18eb3cc77d023 kernel-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 6483afa2d68e43cda14a8b547b290073eb461570a4594244c85b94f7811e7486 kernel-abi-stablelists-5.14.0-427.149.1.el9_4.noarch.rpm SHA-256: 05d9af2c8ac9a60bd99963965253c3d425720702515b7d8c8fafdd219d62ea97 kernel-core-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: f302ef1f8f053515bd99a470eee0ea976519d33e0ec2c810b5f668d0d6ef8d1a kernel-debug-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2819481e23f727d756a189ad42b7354623d8eec7e28cf9e02e3b7393b4cfc192 kernel-debug-core-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 9ee21e8fcb86d526976d6da35a2787ffed7a6ce0cd6c94d4663777dcfbd45fee kernel-debug-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 39d8bd0fce1d5df83236b258317ae9f56230b6076e46829c3855621ed258b403 kernel-debug-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 39d8bd0fce1d5df83236b258317ae9f56230b6076e46829c3855621ed258b403 kernel-debug-devel-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 063b997035cb39e5f829af99798afeea0f442cda240b697e6ff2cb65a9d9ab96 kernel-debug-devel-matched-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 6b14972d9dc95c12a3423e9f35c3810020068cbf75272c151fa4609fc7251c80 kernel-debug-modules-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2697fc99f0cfb5f1615874fce9e7337beb78dcce5ca3dc867dda2443629f6084 kernel-debug-modules-core-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: bc5b54cc51dc96562617a72936a1f17fe9b4216f5bb7eb4d11c6b0dbde22e95c kernel-debug-modules-extra-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 8d1d3da2ceecf5dc938f222dd885dcb65644fbcf8d26d32fff08ee6313e38d4e kernel-debug-uki-virt-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2c88be436b627bf548100c1fd63c94f3141fea78d3c8361864416675963318cc kernel-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: a5029f5a94b8004793a4987e01d89ebb04a0bd83b65e77f3c08f3f936dbe66c0 kernel-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: a5029f5a94b8004793a4987e01d89ebb04a0bd83b65e77f3c08f3f936dbe66c0 kernel-debuginfo-common-x86_64-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: dc9566af9b98b1fd4c683bcae949f0258dc9fb8f45d38aa39233ebf205160509 kernel-debuginfo-common-x86_64-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: dc9566af9b98b1fd4c683bcae949f0258dc9fb8f45d38aa39233ebf205160509 kernel-devel-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2995ee9f6836980650484fb55844770855b661bedb7c92e64d324a2cde002ab7 kernel-devel-matched-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: f1985d796cefa82068c7d1d13aea2f7b8c308fbc62caddb537d0176e4d406c3d kernel-doc-5.14.0-427.149.1.el9_4.noarch.rpm SHA-256: 9f980bfda81a603aad5cfbfe7d3055e38574019713c2582b34e062365376ee61 kernel-headers-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: b4d481b16b337fd5426b743778aae1f4e638eed65cd7d2db247afd1e28b53614 kernel-modules-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 00a21884f71305d0be875fe8317ca4d5cbd082314002d16533cbc31014a91842 kernel-modules-core-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 1eed0fce83753a618d5a0a201b8b80d4808e102c2ddf9e27eea1be24c2962971 kernel-modules-extra-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 9fa3888bd440e09871cf39c043401adb06ea2514276f6063ec25f1f27bb42f34 kernel-rt-debug-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 4f76081e75f82503868c584a48cfa8637a599049a8b19fb9d79ec465948bbab1 kernel-rt-debug-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 4f76081e75f82503868c584a48cfa8637a599049a8b19fb9d79ec465948bbab1 kernel-rt-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2a6782802814c2227887822bf8460be8020377aff10d72c2efae8e71725192b8 kernel-rt-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 2a6782802814c2227887822bf8460be8020377aff10d72c2efae8e71725192b8 kernel-tools-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: e3fedb0b1e566879b4c3f282d64323e257b1ca6b805ae330632dd5c240964b21 kernel-tools-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 479c492b674cb92d722aa4f343f9a36572adfc020adbc8aabd886316619dbd9d kernel-tools-debuginfo-5.14.0-427.149.1.el9_4.x86_64.rpm SHA-256: 479c492b674cb92d722aa4f343f9a36572adfc020adbc8aabd886316619dbd9d kernel-tools-libs-5.14.0-427.149.1.el9_4.x8