Red Hat Releases RHEL 10 Kernel Live Patches for Three Vulnerabilities

Quick Answer

RHSA-2026:72831 supplies livepatch modules for the specified RHEL 10.2 kernels 6.12.0-211.16.1.el10_2 and 6.12.0-211.49.1.el10_2. Match the running kernel and supported architecture to its package. Installation alone is not proof that the fix is active: confirm the matching module is loaded and enabled.

Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	RHEL 10.2 kernel live patches
Advisory	RHSA-2026:72831
CVEs	CVE-2026-46145, CVE-2026-46189, CVE-2026-74581
Authoritative release date	2026-10-02 09:14:56 UTC
Authority revision date	Latest current_release_date in the checked advisory set: 2026-10-02T17:35:22+00:00. Individual advisories may have earlier revisions.
Affected versions	The enumerated 6.12.0-211.16.1.el10_2 and 6.12.0-211.49.1.el10_2 kernel builds without the matching active fix. CSAF package architectures are x86_64 and ppc64le; an installed but unloaded module does not patch the running kernel.
Fixed version	kpatch-patch-6_12_0-211_16_1 1-9.el10_2 / kpatch-patch-6_12_0-211_49_1 1-1.el10_2
CVSS base score	7.0–7.8 (official CVSS v3.1 range)
CVSS severity	High
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

The three fixes address bounds handling in RDMA/mana, a double free in RDMA/vmw_pvrdma and an IPv6 routing use-after-free. The IPv6 description requires a local attacker able to configure routing/FIB rules. This notice does not establish that every network-facing RHEL 10 service can trigger all three flaws.

What To Validate Now

1. Inventory. Locate RHEL 10.2 kernel live patches deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
3. Remediate. Use the supported RHEL livepatch workflow and entitled repository to install the exact matching package: 1-9.el10_2 for 211.16.1 or 1-1.el10_2 for 211.49.1. Follow vendor prerequisites and do not force a module for a different kernel. These are host-kernel patches, not container-image changes.
4. Validate. Use kpatch list to distinguish loaded/enabled modules from installed modules and map the loaded package to this advisory. Check normal workload and network health and retain status output. The kernel version from uname -r does not change merely because a livepatch is active.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Confirm livepatch service persistence for the next boot and continue planning native-kernel updates for fixes not covered by livepatching. Red Hat does not support reverting a livepatch without rebooting; contact support if a patch causes trouble. Follow the RHEL 10 livepatch guidance. No patch was loaded here.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• RHSA-2026:72831

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.