SB2026081112 - Red Hat Enterprise Linux 10 update for kernel
Published: August 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2024-53143)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the fsnotify_get_sb_watched_objects() and fsnotify_get_inode_ref() functions in fs/notify/mark.c. A local user can escalate privileges on the system.
2) Input validation error (CVE-ID: CVE-2025-71072)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the shmem_rename2() function in mm/shmem.c. A local user can perform a denial of service (DoS) attack.
3) Use-after-free (CVE-ID: CVE-2026-23415)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __futex_key_to_node() when processing futex operations during a race with vma policy replacement. A local user can trigger concurrent futex activity and memory policy changes to cause a denial of service.
The issue is caused by a race between futex_key_to_node_opt() and vma_replace_policy() that leads to a use-after-free read of mpol->mode from a freed mempolicy pointer.
4) Use-after-free (CVE-ID: CVE-2026-31488)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the amdgpu display manager stream handling logic when processing KMS commits involving DSC validation and unrelated mode changes. A local user can trigger a crafted display configuration change to cause a denial of service.
The issue can occur when MST/DSC configuration changes happen in the same commit as a separate mode change, leading to incorrect stream lifetime handling when the stream is later disabled.
5) Use-after-free (CVE-ID: CVE-2026-52923)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.
A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.
6) Improper Initialization (CVE-ID: CVE-2026-64368)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in slab allocation handling in mm/slub.c when allocating kmalloc objects with zeroing enabled. A local user can trigger a memory allocation pattern that leaves part of the allocated object uninitialized to disclose sensitive information.
The issue occurs when requested-size tracking is not enabled while red zoning alone is enabled, which can break krealloc() __GFP_ZERO expectations.
7) Improper input validation (CVE-ID: CVE-2026-64531)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of oversized nested action attributes in openvswitch flow action construction when processing user-supplied openvswitch nested action attributes. A local user can supply specially crafted nested CLONE or CT actions to cause a denial of service.
The issue occurs because a generated nested action attribute can be closed with a truncated nla_len, causing later dump or teardown operations to walk a structurally different action stream than the one that was validated.
Remediation
Install update from vendor's website.