Red Hat Kernel Updates Protect Extended-Support RHEL Streams
Tech GuruQuick Answer
Red Hat has released kernel fixes for the listed RHEL 8.4, 8.6 and 9.4 support streams. Install the matching kernel package set and reboot into it: Red Hat explicitly requires a reboot for these updates to take effect.
Confirm Scope And Apply The Supported Fix
What to do now: Record the installed and running kernel versions, support repository and architecture. Schedule the branch update and reboot with recovery access and workload failover available.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8.4, RHEL 8.6, and RHEL 9.4 extended-support kernel packages |
|---|---|
| Advisory | RHSA-2026:69874 / RHSA-2026:69906 / RHSA-2026:69908 |
| CVEs | CVE-2023-53781, CVE-2026-46150, CVE-2026-52993, CVE-2026-53002, CVE-2026-63887, CVE-2026-63888, CVE-2026-64268, CVE-2026-64368, CVE-2026-64564 |
| Authoritative release date | RHSA-2026:69874: 2026-09-22T08:07:16+00:00 (CSAF initial release) RHSA-2026:69906: 2026-09-22T09:11:49+00:00 (CSAF initial release) RHSA-2026:69908: 2026-09-22T11:34:51+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69874: 2026-09-22T08:07:16+00:00 (CSAF revision history) RHSA-2026:69906: 2026-09-22T09:11:49+00:00 (CSAF revision history) RHSA-2026:69908: 2026-09-22T11:34:51+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled RHEL 8.4, RHEL 8.6, and RHEL 9.4 extended-support kernel packages builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | kernel 4.18.0-305.208.1.el8_4, 4.18.0-372.216.1.el8_6, and 5.14.0-427.151.1.el9_4 |
| CVSS base score | 5.5 / 7.0 / 7.1 / 7.3 / 7.8 / 8.8 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | The three kernel advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The nine-CVE list combines different branch coverage. The RHEL 8 updates include network and event-handling fixes; the 8.6 advisory also covers RDMA/Soft-iWARP. The RHEL 9.4 advisory covers slab-memory handling and SCTP. Do not assume every subsystem flaw applies identically to all three branches.
What To Validate Now
- Inventory. Locate RHEL 8.4, RHEL 8.6, and RHEL 9.4 extended-support kernel packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled RHEL 8.4, RHEL 8.6, and RHEL 9.4 extended-support kernel packages builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Install kernel 4.18.0-305.208.1.el8_4 for the covered 8.4 stream, 4.18.0-372.216.1.el8_6 for 8.6, or 5.14.0-427.151.1.el9_4 for 9.4, with matching packages. Reboot through the approved maintenance process.
- Validate. After reboot, compare the running kernel release with the installed fixed package, then verify required drivers, storage, networking and application health. Record any node whose reboot or rollout remains incomplete.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The advisories describe disabling particular kernel modules for some CVEs, not a workaround for the entire group. Disabling SCTP, SIP helpers or Soft-iWARP can break services that require them and may itself require initramfs changes and reboot. Prefer the supported update; test driver compatibility and recovery before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
