SB2026090249 - Red Hat Enterprise Linux 9 update for kernel
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-46744)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the squashfs_read_inode() function in fs/squashfs/inode.c. A local user can perform a denial of service (DoS) attack.
2) Improper locking (CVE-ID: CVE-2025-68211)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the should_skip_rmap_item() and scan_get_next_rmap_item() functions in mm/ksm.c. A local user can perform a denial of service (DoS) attack.
3) Race condition (CVE-ID: CVE-2026-43023)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition leading to use-after-free in sco_sock_connect() when handling concurrent connect() calls on the same Bluetooth SCO socket. A local user can issue concurrent connect() syscalls on the same socket to cause a denial of service.
The issue can revive a BT_CLOSED and SOCK_ZAPPED socket back to BT_CONNECT during concurrent execution.
4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43114)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of stale bits in nft_set_pipapo_avx2 match functions in the netfilter pipapo set implementation when processing crafted set elements during avx2-based matching. A local user can load and reload a crafted pipapo set to cause a denial of service.
The issue occurs with avx2 matching functions and can cause a non-matching expired entry to be treated as a match after a set flush and reload operation.
5) Use-after-free (CVE-ID: CVE-2026-46099)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in seg6 and rpl lwtunnels when processing IPv6 routing lookups and caching a NOREF destination entry. A local user can trigger a race condition to cause a denial of service.
Exploitation requires PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK and a concurrent task able to release a shared nexthop per-cpu route entry.
6) Use-after-free (CVE-ID: CVE-2026-46056)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in SSP passkey handlers when handling Bluetooth SSP passkey and keypress notification events. A local user can trigger concurrent connection teardown during event processing to cause a denial of service.
7) Out-of-bounds write (CVE-ID: CVE-2026-46145)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to overwrite kernel memory.
The vulnerability exists due to an out-of-bounds write in the RDMA/mana rx hash key handling when processing a user-supplied uAPI structure. A local user can supply a crafted rx_hash_key_len value to overwrite kernel memory.
8) Use-after-free (CVE-ID: CVE-2026-53006)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in icmpv6_rcv() in the IPv6 ICMP handling code when processing ICMPv6 packets. A remote attacker can send a specially crafted ICMPv6 packet to cause a denial of service.
9) Use-after-free (CVE-ID: CVE-2026-64002)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.
The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.
10) Out-of-bounds write (CVE-ID: CVE-2026-64304)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.
The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.
11) Use-after-free (CVE-ID: CVE-2026-74480)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.
The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.
12) Improper access control (CVE-ID: CVE-2026-74580)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.
The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.
The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.
Remediation
Install update from vendor's website.