CVE-2026-22977VulnerabilityPublished 1 Nov 2026

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Affects Red Hat kernel security,Source GCVE Database

Compare

Mentioned vulnerabilities

Authoritative record:CVE-2026-22977· High

Not known to be exploited · fixed in Red Hat package updates : patch Red Hat kernel security, soon.

Data as of 2 Nov 2026, 00:02 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

Patch: Available – fixed in e00b169eaac5f7cdbf710c354c8fa76d02009115, c655d2167bf014d4c61b4faeca59b60ff9b9f6b1, 005671c60fcf1dbdb8bddf12a62568fd5e4ec391 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 21 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < e00b169eaac5f7cdbf710c354c8fa76d02009115	Fixed in e00b169eaac5f7cdbf710c354c8fa76d02009115
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < c655d2167bf014d4c61b4faeca59b60ff9b9f6b1	Fixed in c655d2167bf014d4c61b4faeca59b60ff9b9f6b1
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < 005671c60fcf1dbdb8bddf12a62568fd5e4ec391	Fixed in 005671c60fcf1dbdb8bddf12a62568fd5e4ec391
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < 582a5e922a9652fcbb7d0165c95d5b20aa37575d	Fixed in 582a5e922a9652fcbb7d0165c95d5b20aa37575d
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < 88dd6be7ebb3153b662c2cebcb06e032a92857f5	Fixed in 88dd6be7ebb3153b662c2cebcb06e032a92857f5
LinuxLinux	Affected ≥ 6d07d1cd300f4c7e16005f881fea388164999cc8, < 8c6901aa29626e35045130bac09b75f791acca85	Fixed in 8c6901aa29626e35045130bac09b75f791acca85

AI-suggested

Red Hat has released an updated kernel package that addresses all listed vulnerabilities and bugs. Users should apply the update promptly and reboot their systems to ensure the fixes take effect. Red Hat recommends treating all kernel errata as security-relevant and not delaying updates. No alternative mitigations are specified; patching and rebooting is the advised course of action.

Description

This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 10. The issues include denial of service, use-after-free, improper resource isolation, integer overflow, and other memory safety problems across various kernel subsystems such as network socket handling, CPU cache, I2C, PPP over L2TP, multipath TCP, TIPCv2 netlink, seccomp, KVM, SCSI, virtio-fs, SMB client, encrypted keys, and others. The update also includes robustness improvements and feature enhancements. Systems must be rebooted after applying the update for changes to take effect.

Impact

The vulnerabilities collectively impact the Linux kernel's stability, security, and memory safety, potentially allowing denial of service, privilege escalation, information disclosure, or system crashes. The issues affect critical kernel components such as networking, CPU resource isolation, device drivers, and virtualization. Exploitation could disrupt system operations or compromise kernel integrity. The advisory rates the overall security impact as important (high severity).

CWE-489Active Debug Code (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product is released with debugging code still enabled or active.
Build and Compilation · Distribution
Remove debug code before deploying the application.
Attack patterns
Exploit Non-Production Interfaces (opens in a new tab)
Root/Jailbreak Detection Evasion via Debugging (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-653Improper Isolation or Compartmentalization (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Architecture and Design
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
OWASP Cheat Sheets
Secure Design Principles (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.3 (opens in a new tab)
V11.1.6 (opens in a new tab)
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-266Incorrect Privilege Assignment (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-824Access of Uninitialized Pointer (opens in a new tab)
Base weakness
The product accesses or uses a pointer that has not been initialized.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-524Use of Cache Containing Sensitive Information (opens in a new tab)
Base weakness
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Architecture and Design
Protect information stored in cache.
Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Architecture and Design
Consider using encryption in the cache.
OWASP ASVS 4.0.3
V8.1.1 (opens in a new tab)
V8.1.2 (opens in a new tab)
Attack patterns
Lifting Sensitive Data Embedded in Cache (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: Red Hat Product Security
Advisory ID: RHSA-2026:93413
Vendor Severity: high
CVE Count: 16
Additional Cves: CVE-2026-46174, CVE-2026-64191, CVE-2026-68169, CVE-2026-68398, CVE-2026-74283, CVE-2026-80586, CVE-2026-89603, CVE-2026-89932, CVE-2026-90011, CVE-2026-93787, CVE-2026-93827, CVE-2026-98222, CVE-2026-98364, CVE-2026-98432, CVE-2026-98725

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 2 Nov 2026, 00:02 UTC

WeaknessesCWE-489, CWE-653, CWE-787 +7

Technical details

References

Community reviews

Related threats