Red Hat ships live kernel patches for SMB client and packet editing flaws

Red Hat released Important live kernel patch advisories for Red Hat Enterprise Linux 8, 9, and 10 to remediate two Linux kernel vulnerabilities: CVE-2026-46243 in the SMB/CIFS client and CVE-2026-46331 in net/sched/act_pedit. The updates were published across multiple kpatch streams, including RHEL 8.8 and 8.10, RHEL 9.2, 9.4, 9.6, and 9.8 variants, and RHEL 10, covering x86_64 and ppc64le platforms as well as AUS, SAP Solutions, Extended Update Support, and Extended Life Cycle channels.

CVE-2026-46243 stems from the kernel SMB client accepting userspace-created cifs.spnego key descriptions whose authority-bearing fields could be trusted by cifs.upcall as if they came from the kernel; the fix restricts acceptance to requests made while CIFS is using its private spnego_cred. CVE-2026-46331 affects tcf_pedit_act(), where packet edits could shift later header-relative offsets and cause writes beyond the originally ensured writable packet range; the fix expands the writable range using each key’s final computed write offset before mutation. Red Hat delivered the remediations through updated live patch modules so affected systems can be patched without rebooting.