SB20260921145 - Red Hat Enterprise Linux 10 update for kernel
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 vulnerabilities.
1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64176)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to incorrect rate encoding in the iwlwifi mvm TX rate handling code when processing transmit rate settings on older devices. A local user can trigger use of malformed TX_CMD rate values to cause a denial of service.
The issue affects older devices that still use version 1 rate encoding, and firmware may assert or crash when handling beacon rates.
2) Double free (CVE-ID: CVE-2026-72102)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.
3) Improper access control (CVE-ID: CVE-2026-68294)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass network namespace isolation.
The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.
The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.
4) Use-after-free (CVE-ID: CVE-2026-68363)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.
The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.
5) Out-of-bounds write (CVE-ID: CVE-2026-68128)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in ice_parser_profile_init when processing a crafted VIRTCHNL_OP_ADD_RSS_CFG request with an out-of-range ptype value. A remote user can send a specially crafted VIRTCHNL request to cause a denial of service.
The issue can be triggered by a malicious VF supplying a ptype value greater than or equal to 1024, which can lead to a kernel page fault.
6) Race condition (CVE-ID: CVE-2026-68143)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.
7) Use-after-free (CVE-ID: CVE-2026-68200)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free.
The vulnerability exists due to use-after-free in ALSA timer callback handling in sound/core/timer.c when triggering the same userspace-driven timer concurrently through the TRIGGER ioctl. A local user can issue concurrent timer trigger operations to cause a use-after-free.
The issue is reachable by any user able to open /dev/snd/timer, including through a user timer instance and through a sequencer queue timer bound to the userspace-driven timer.
8) Out-of-bounds read (CVE-ID: CVE-2026-64456)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.
The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.
9) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64414)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unreadable fragments in netfilter packet processing when processing packets with unreadable fragments. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue affects the xt_u32 matcher, nfnetlink_queue, nfnetlink_log, and IPv6 fragment header handling in connection tracking reassembly.
10) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64175)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper state management in iwl_mld_tx_from_txq() when processing transmit queues during a firmware restart. A local attacker can trigger high-throughput network traffic while the firmware is restarting to cause a denial of service.
The issue can lead to excessive CPU consumption and memory pressure from rapid skb allocation churn and slab fragmentation after a firmware crash.
11) Out-of-bounds read (CVE-ID: CVE-2024-58007)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the qcom_socinfo_probe() function in drivers/soc/qcom/socinfo.c. A local user can perform a denial of service (DoS) attack.
12) Out-of-bounds write (CVE-ID: CVE-2026-63923)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or overwrite out-of-bounds memory.
The vulnerability exists due to an out-of-bounds write in rvu_mbox_handler_rep_event_notify and the representor event handling path when processing a crafted REP_EVENT_NOTIFY mailbox request with a sender-controlled body pcifunc value. A local user can send a specially crafted mailbox request to cause a denial of service or overwrite out-of-bounds memory.
Exploitation requires a VF attached to a PF that has been put into switchdev representor mode. For RVU_EVENT_MAC_ADDR_CHANGE, the invalid body pcifunc is used as a six-byte ether_addr_copy() target in the queued worker.
13) Use-after-free (CVE-ID: CVE-2026-64029)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in seq_ump_process_event() and snd_rawmidi_kernel_write1() when processing sequencer events during concurrent output teardown. A local user can trigger concurrent event delivery and output close operations to cause a denial of service.
The issue arises from a race condition between the event_input path and the last output unuse path, where the rawmidi substream runtime may be freed while still in use.
14) Out-of-bounds write (CVE-ID: CVE-2026-63869)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds shift in ieee80211_parse_tx_radiotap() when parsing the radiotap header of an injected frame. A local user can supply a crafted frame from userspace to cause a denial of service.
The issue is triggered by the IEEE80211_RADIOTAP_ANTENNA value being used directly as a shift count, and larger antenna indices cannot be represented by the 2-bit bitmap.
15) Use-after-free (CVE-ID: CVE-2026-53192)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in snd_timer_user_params() when handling a concurrent SNDRV_TIMER_IOCTL_PARAMS ioctl during timer object release. A local user can trigger concurrent timer operations to cause a denial of service.
The issue affects userspace timer handling with CONFIG_SND_UTIMER enabled.
16) Use-after-free (CVE-ID: CVE-2026-53193)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to a use-after-free in the ALSA timer subsystem when closing and freeing timer objects that still have pending timer instances, including slave instances associated with a master instance. A local user can open and close a userspace-driven timer while other applications continue accessing the timer to cause a denial of service or potentially execute arbitrary code.
The issue can be triggered particularly when userspace-driven timers are enabled with CONFIG_SND_UTIMER.
17) Out-of-bounds write (CVE-ID: CVE-2026-53176)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in isert_login_recv_done() and isert_rx_login_req() in drivers/infiniband/ulp/isert/ib_isert.c when processing a login PDU shorter than ISER_HEADERS_LEN. A remote attacker can send a specially crafted login send work request to cause a denial of service.
The vulnerable code path is reachable during the login phase before iSCSI authentication.
18) Use-after-free (CVE-ID: CVE-2026-52971)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ena PHC get_timestamp function when accessing PHC timestamp data during concurrent PHC destruction. A local user can trigger concurrent operations to cause a denial of service.
19) Memory leak (CVE-ID: CVE-2026-23172)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the t7xx_dpmaif_set_frag_to_skb() function in drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.