Red Hat Product Errata RHSA-2026:67720 - Security Advisory Issued: 2026-09-16 Updated: 2026-09-16 RHSA-2026:67720 - Security Advisory Overview Updated Packages Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) kernel: fanotify: fix false positive on permission events (CVE-2026-46150) kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) Bug Fix(es) and Enhancement(s): [ice] Unexplained random cTE values on NAC and CF [rhel-9.6.z] (JIRA:RHEL-186494) CLONE - netfilter: nftables CVE and memory safety backports for 9.6 (JIRA:RHEL-240165) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2482576 - CVE-2026-46117 kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() BZ - 2482612 - CVE-2026-46150 kernel: fanotify: fix false positive on permission events BZ - 2492273 - CVE-2026-53000 kernel: netfilter: nat: use kfree_rcu to release ops BZ - 2502422 - CVE-2026-63952 kernel: memfd: deny writeable mappings when implying SEAL_WRITE BZ - 2502443 - CVE-2026-63888 kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() BZ - 2502447 - CVE-2026-63887 kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf BZ - 2507042 - CVE-2026-64382 kernel: smb: client: fix double-free in SMB2_open() replay BZ - 2507046 - CVE-2026-64387 kernel: smb: client: fix query directory replay double-free BZ - 2507089 - CVE-2026-64268 kernel: Kernel: Remote out-of-bounds write in RDMA/siw BZ - 2507118 - CVE-2026-64438 kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() BZ - 2513167 - CVE-2026-68166 kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation CVEs CVE-2026-46117 CVE-2026-46150 CVE-2026-53000 CVE-2026-63887 CVE-2026-63888 CVE-2026-63952 CVE-2026-64268 CVE-2026-64382 CVE-2026-64387 CVE-2026-64438 CVE-2026-68166 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM kernel-5.14.0-570.141.1.el9_6.src.rpm SHA-256: 30e22b51237615a7b0e6d61aea18ab4140e8878517570e4996ff1f5a801ad51a x86_64 kernel-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 05db9c7acadbe4d57f0ae822feeed23688555e99fe9c311cdd7003c36e2f4768 kernel-abi-stablelists-5.14.0-570.141.1.el9_6.noarch.rpm SHA-256: d921f2f6e00cd7aee9debffba0ea934edbaf1b5e15e39be6a2a57e376506b70b kernel-core-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: c382bfbcf34f8a19569e307ff88ad3bf1637fb9a24027dc7ed364086f7d1a34c kernel-debug-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 95337ff9c24d885dbcb5ef678e61f42c7902fd2c01d973824b9250fb69ff98dd kernel-debug-core-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 7109f79e9c1a97160d43fac86645555d8d9b03800ba68d78ba59a2e2a4c0ce8e kernel-debug-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: b863f81bb52b823d26beb1af769e16e7e570a1a767ed35e01c8a242b5b732635 kernel-debug-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: b863f81bb52b823d26beb1af769e16e7e570a1a767ed35e01c8a242b5b732635 kernel-debug-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: b863f81bb52b823d26beb1af769e16e7e570a1a767ed35e01c8a242b5b732635 kernel-debug-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: b863f81bb52b823d26beb1af769e16e7e570a1a767ed35e01c8a242b5b732635 kernel-debug-devel-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 91ec7748bdace8a1acf38fdfd75cf68e3ea85c8869aa954ff462c3a3bb3deebd kernel-debug-devel-matched-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 9f2b563078eb567af3b8b7391d9e0f74589baf77137d83c89bf823da09965866 kernel-debug-modules-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: d1e523f0966f9548d2f0dcfd8423fd0b3dfa855d9b54044bc5cc633f07cf9cd1 kernel-debug-modules-core-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 6fe31cf963d51f2a40a739ee9b36dc183671562fbc72e8ec56fdd86b0787c7ff kernel-debug-modules-extra-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 073f09aca16a6845ec9c6ed35261167eb6974508e73067fc02917e48de49f330 kernel-debug-uki-virt-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: c6c27d1099d24df8fd362d7df61046b1b26c4928b1af96b7e424a06188771efb kernel-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 008bb35d10791aed9eba24c0413a5fe581ae7d73df3a71cf70a5fd0313afbe1f kernel-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 008bb35d10791aed9eba24c0413a5fe581ae7d73df3a71cf70a5fd0313afbe1f kernel-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 008bb35d10791aed9eba24c0413a5fe581ae7d73df3a71cf70a5fd0313afbe1f kernel-debuginfo-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 008bb35d10791aed9eba24c0413a5fe581ae7d73df3a71cf70a5fd0313afbe1f kernel-debuginfo-common-x86_64-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: ab7ca49673038c3298acd431252af39a7c5fdd385798e77c5bdc66b75fa3dcd3 kernel-debuginfo-common-x86_64-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: ab7ca49673038c3298acd431252af39a7c5fdd385798e77c5bdc66b75fa3dcd3 kernel-debuginfo-common-x86_64-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: ab7ca49673038c3298acd431252af39a7c5fdd385798e77c5bdc66b75fa3dcd3 kernel-debuginfo-common-x86_64-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: ab7ca49673038c3298acd431252af39a7c5fdd385798e77c5bdc66b75fa3dcd3 kernel-devel-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: ab02f5b92affe6658c2a45fe3cb0f499287d9eedbeb9544203f428a7f9e2d610 kernel-devel-matched-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 6abd0fb5df3d23071d898c36eb3199d3b4f60684f2edf413ffb6860561ccc80a kernel-doc-5.14.0-570.141.1.el9_6.noarch.rpm SHA-256: e8c37eecdc3c961b1041548409312d6680abe5126bc85fb61b97a6f447c0662c kernel-headers-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: b3b3d414fcc7b3116c990ea3bf2a376f049f78668a72372e683468e116d6d9dd kernel-modules-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 0e808e92e787c5a173a4e44661a1ca149e07c3b49bbcf2b6bf1fd7db9255b786 kernel-modules-core-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: 238e760d5acbfbd2c809dde281534b04db2e493929084473c743cac639d5e54e kernel-modules-extra-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: e5906406ac9e21ab3d2e8f2f9b17f70de1c7c6fb739c81e8e20d03a9c1817277 kernel-rt-5.14.0-570.141.1.el9_6.x86_64.rpm SHA-256: e8d8bf15cc78e4f5