SB20260921100 - Red Hat Enterprise Linux 10 update for kernel
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-52933)
CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper type conversion in io_poll_get_ownership() in io_uring/poll.c when handling poll ownership checks. A local user can trigger the affected code path to cause a denial of service.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-53196)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in get_manuf_info() in the io_ti USB serial driver when processing a crafted USB device EEPROM descriptor. An attacker with physical access can connect a malicious USB device with a forged Size field to trigger the overflow and cause a denial of service or execute arbitrary code.
The out-of-bounds access is compounded because a checksum routine also iterates over the device-controlled length after the EEPROM data is read.
3) Double free (CVE-ID: CVE-2026-64387)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in SMB2_query_directory in the SMB client when handling replayed query directory responses and reinitialization failures. A local user can trigger a replayable error and subsequent cleanup conditions to cause a denial of service.
Remediation
Install update from vendor's website.