RLSA-2026:66180

See a problem?
Please try reporting it to the source first.
Source
https://errata.rockylinux.org/RLSA-2026:66180
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2026:66180.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2026:66180
Upstream
Published
2026-09-11T12:05:26Z
Modified
2026-09-11T12:30:02Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Important: kernel security, bug fix, and enhancement update
Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

  • kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

  • kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

  • kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

  • kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

  • kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

  • kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

  • kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

  • kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)

  • kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)

  • kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

  • kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

  • kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)

  • kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)

  • kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

  • kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

  • kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

  • kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

  • KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific 
{
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:66180"
}
References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:9 / kernel

Package

Name
kernel
Purl
pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:5.14.0-687.46.1.el9_8
Database specific
Show details 
{
    "yum_repository": "BaseOS"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:66180.json"