SB20260921118 - Red Hat Enterprise Linux 8 update for kernel-rt
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2024-53161)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to integer overflow within the bluefield_edac_check() function in drivers/edac/bluefield_edac.c. A local user can execute arbitrary code.
2) Resource management error (CVE-ID: CVE-2025-71127)
CWE-ID: CWE-399 - Resource Management Errors
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to resource management error within the ieee80211_rx_h_mgmt_check() function in net/mac80211/rx.c. A local user can perform a denial of service (DoS) attack.
3) Improper Initialization (CVE-ID: CVE-2026-43133)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in KVM nSVM VMLOAD/VMSAVE emulation when executing VMSAVE or VMLOAD in an L2 guest that is not intercepted by L1. A local user can execute crafted nested guest operations to cause a denial of service.
Exploitation requires a nested virtualization environment involving L1 and L2 guests.
4) Use-after-free (CVE-ID: CVE-2026-52947)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in qrtr_port_remove in the qrtr socket subsystem when handling concurrent qrtr port removal and lookup operations under RCU. A local user can trigger the race condition to cause a denial of service.
The issue arises because a socket pointer can remain reachable through the qrtr_ports XArray before the RCU grace period elapses.
5) Improper input validation (CVE-ID: CVE-2026-53182)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in nl80211_parse_rnr_elems() when parsing nested NL80211_ATTR_EMA_RNR_ELEMS input. A local user can send a specially crafted nl80211 message to cause a denial of service.
The issue is related to the element count being stored in a u8-backed cfg80211_rnr_elems::cnt field and incremented past its supported limit.
6) Use-after-free (CVE-ID: CVE-2026-63802)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.
The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.
7) Integer overflow (CVE-ID: CVE-2026-63889)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.
Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.
8) Use-after-free (CVE-ID: CVE-2026-64117)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ieee80211_invoke_fast_rx() when processing mesh forwarding in the unicast forward path. A local user can trigger mesh data handling that causes freed memory to be accessed to cause a denial of service.
The issue occurs because skb->cb storage is reused by mesh forwarding code before the caller finishes consuming the RX status, and the no-route path can free the skb before the stale status is accessed.
9) Use-after-free (CVE-ID: CVE-2026-68363)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.
The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.
10) Improper access control (CVE-ID: CVE-2026-68294)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass network namespace isolation.
The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.
The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.
11) Out-of-bounds write (CVE-ID: CVE-2026-72098)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.
The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.
12) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.
The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.
Remediation
Install update from vendor's website.