RHSA-2026:72059: Critical: kernel security update

A critical security advisory for Red Hat systems has been issued concerning an update to the Linux kernel, specifically for RHEL 10. The update addresses three distinct vulnerabilities found within the kernel packages. These vulnerabilities are: a flaw in `crypto: afalg` regarding concurrent writes, a vulnerability in `netfilter: ebtables` concerning SNAT target writes to shared memory pages during ARP hardware address rewrite, and a use-after-free error in `net: ipv6: fib6rulesuppress` related to stale pointer management.
Red Hat emphasizes that kernel errata are treated as security-relevant due to the kernel's fundamental role in system security. The recommended solution requires rebooting the system for the update to take effect. Red Hat advises immediate patching, noting that updates may be associated with future CVE assignments, and strongly discourages delaying updates to maintain system security.
The necessary fixes are identified by specific bug reports: CVE-2025-39964, CVE-2026-53266, and CVE-2026-74581. The fix applies to Red Hat Enterprise Linux for ARM 64 10 systems.

* An update for the kernel is available for NVIDIA for RHEL 10.
* The update has been rated as having a security impact of Critical by Red Hat Product Security.
* Security fixes include addressing CVE-2025-39964 (kernel: crypto: afalg), CVE-2026-53266 (kernel: netfilter: ebtables), and CVE-2026-74581 (kernel: net: ipv6: use-after-free).
* The affected products are Red Hat Enterprise Linux for ARM 64 10.
* The specific fixes correspond to bug reports BZ - 2403545, BZ - 2485368, and BZ - 2520980.
* Specific kernel RPM files with SHA-256 hashes are provided for the patch set (e.g., kernel-6.12.0-231.20.el10nv.aarch64.rpm).
* The solution requires a system reboot to apply the update.

This advisory highlights the systemic risk inherent in core operating system components. The fact that multiple critical memory and network-related bugs (concurrent writes, use-after-free) exist within the kernel suggests a complex interaction between high-level networking stacks and low-level memory management, pointing to potential vulnerabilities stemming from asynchronous operations or stale pointer references under specific hardware conditions. The prioritization of treating all kernel errata as security-relevant underscores a critical assumption: the integrity of the kernel is the foundation for all subsequent security controls.
The pattern observed here involves patching foundational layers that manage concurrent state (crypto) and complex system interactions (netfilter/ipv6). This points toward a potential vulnerability class where state corruption during rapid, parallel operations can lead to exploitable memory errors. The proactive approach by Red Hat in associating these errata with immediate security updates demonstrates an attempt to mitigate the latency between discovery and remediation, implicitly acknowledging that delayed patching compounds risk when dealing with deeply embedded code like the kernel.
The implication is a challenge for maintaining systemic resilience: how effectively can patch management systems ensure timely application of fixes across diverse hardware architectures, and how robust are the verification processes when updates involve complex, multi-component kernel changes? What structures exist to ensure that fundamental security relies not just on the correctness of the patch itself, but on the integrity of the entire update pipeline?