RHSA-2026:76739

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442) * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942) * kernel: gfs2: add some missing log locking (CVE-2026-53049) * kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z] (JIRA:RHEL-254192) * hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z] (JIRA:RHEL-262029) * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892) * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.