SB2026091007 - Red Hat Enterprise Linux 8 update for kernel
Published: September 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Double free (CVE-ID: CVE-2025-68745)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a double free error within the drivers/scsi/qla2xxx/qla_target.h. A local user can perform a denial of service (DoS) attack.
2) Out-of-bounds read (CVE-ID: CVE-2026-46149)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.
When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.
3) Out-of-bounds read (CVE-ID: CVE-2026-52942)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in dump_mac_header() in the netfilter nf_log syslog logger when processing an skb sent through AF_PACKET with PACKET_QDISC_BYPASS and an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.
Only skbs with an unset MAC header are affected.
4) Out-of-bounds read (CVE-ID: CVE-2026-52917)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the SCTP sock_diag dump-one path when processing an exact association lookup after taking the socket lock on a stale association. A local user can trigger a stale association lookup to disclose sensitive information.
The issue occurs when association state is reaped or detached from the endpoint while the lookup path resumes after blocking on the socket lock.
5) Improper input validation (CVE-ID: CVE-2026-53091)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.
6) Out-of-bounds read (CVE-ID: CVE-2026-52986)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the nf_conntrack_sip SIP message parser when parsing non-NUL-terminated SIP packet data containing crafted port values. A remote attacker can send a specially crafted SIP packet to cause a denial of service.
The issue involves port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request(), where parsing could reach the buffer limit without a trailing character.
7) Out-of-bounds read (CVE-ID: CVE-2026-53246)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause memory corruption.
The vulnerability exists due to an out-of-bounds read in sctp_unpack_cookie() and cached peer INIT chunk processing when processing a crafted COOKIE_ECHO chunk. A remote attacker can send a specially crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length to disclose sensitive information or cause memory corruption.
The issue occurs in a listening SCTP server while walking parameters from the cached peer INIT chunk embedded after the cookie.
8) Use-after-free (CVE-ID: CVE-2026-63801)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in tipc_aead_decrypt_done in the TIPC crypto subsystem when processing crafted encrypted frames during asynchronous decryption. A remote attacker can send crafted encrypted frames to trigger a read from freed memory and cause a denial of service.
Exploitation requires the asynchronous decryption path to be used and can occur while the associated network namespace is being torn down.
9) Race condition (CVE-ID: CVE-2026-63971)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.
Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.
10) Race condition (CVE-ID: CVE-2026-64015)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.
The issue affects persistent key handling, which uses a different locking model.
11) Use-after-free (CVE-ID: CVE-2026-64113)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.
The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.
12) Out-of-bounds read (CVE-ID: CVE-2026-68376)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.
The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.
13) Use-after-free (CVE-ID: CVE-2026-68117)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.
The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.
14) Improper Authentication (CVE-ID: CVE-2026-68300)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authentication.
The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.
This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.
15) Integer overflow (CVE-ID: CVE-2026-68315)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.
Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.
Remediation
Install update from vendor's website.