Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat kpatch may let attackers execute code

published 2 months ago

Summary

The kpatch tool that provides live kernel updates on Red Hat systems has a security weakness that could allow an attacker to run malicious code with system privileges. This could lead to loss of data or control over the server. Install the latest Red Hat update for kpatch immediately to close the gap.

What to do

Update redhat kpatch-patch-6_12_0-211_16_1 to version 0:1-8.el10_2.
Update redhat kpatch-patch-6_12_0-211_16_1-debuginfo to version 0:1-8.el10_2.
Update redhat kpatch-patch-6_12_0-211_16_1-debugsource to version 0:1-8.el10_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:10.2	redhat	kpatch-patch-6_12_0-211_16_1	< 0:1-8.el10_2 Fix: upgrade to 0:1-8.el10_2
Red Hat:enterprise_linux:10.2	redhat	kpatch-patch-6_12_0-211_16_1-debuginfo	< 0:1-8.el10_2 Fix: upgrade to 0:1-8.el10_2
Red Hat:enterprise_linux:10.2	redhat	kpatch-patch-6_12_0-211_16_1-debugsource	< 0:1-8.el10_2 Fix: upgrade to 0:1-8.el10_2

Original advisory text

Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update

References

https://access.redhat.com/errata/RHSA-2026:62642 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2466994 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467015 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2479832 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492413 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492851 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62642.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-43112 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-43112 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43112 Vendor Advisory
https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-43114 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-43114 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43114 Vendor Advisory
https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-46323 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46323 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46323 Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c... Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44be... Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4790... Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db7... Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334... Third Party Advisory
https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.17791940... Third Party Advisory
https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-52973 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-52973 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-52973 Vendor Advisory
https://lore.kernel.org/linux-cve-announce/2026062439-CVE-2026-52973-af9c@gregkh... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-53264 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-53264 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-53264 Vendor Advisory
https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published3 Sep 2026

Updated3 Sep 2026

First seen3 Sep 2026

Sources

RHSA-2026:62642 · OSV

Track software like this

Free during beta