SB2026092296 - Red Hat Enterprise Linux 8 update for kernel-rt
Published: September 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-53053)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access of device identifier data in clone_alias() in the AMD IOMMU subsystem when processing PCI DMA aliases. A local user can trigger alias cloning for a device to cause a denial of service.
Incorrect source device identifiers can cause wrong or stale device table entries to be propagated to an alias device.
2) Use-after-free (CVE-ID: CVE-2026-68188)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.
The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.
3) Out-of-bounds read (CVE-ID: CVE-2026-68293)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the MCIA register handling in the mlx5 driver when processing module EEPROM reads via ethtool. A local user can trigger a read of module EEPROM data to cause a denial of service.
The issue is detected on kernels built with FORTIFY_SOURCE, where it results in a kernel BUG.
4) Use-after-free (CVE-ID: CVE-2026-64582)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.
Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.
5) Use-after-free (CVE-ID: CVE-2026-64534)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in nvmet_tcp_try_recv_ddgst() when processing a command with a data digest mismatch after request initialization previously failed. A remote attacker can send a specially crafted request to cause a denial of service.
The issue can lead to a refcount underflow, kernel warnings, and a permanent workqueue deadlock.
6) Out-of-bounds read (CVE-ID: CVE-2026-63947)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in hidp_input_report() when processing truncated Bluetooth HIDP input packets. A remote user can send a specially crafted truncated packet to disclose sensitive information.
Exploitation requires a paired Bluetooth device.
7) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.
The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.
8) Use-after-free (CVE-ID: CVE-2026-63823)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.
The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.
9) Out-of-bounds read (CVE-ID: CVE-2026-53254)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the Bluetooth RFCOMM MCC handlers when processing truncated MCC frames from a remote Bluetooth device. A remote attacker can send specially crafted truncated MCC frames to cause a denial of service.
The issue affects the RFCOMM MCC handling paths including rfcomm_recv_mcc(), rfcomm_recv_pn(), rfcomm_recv_rpn(), rfcomm_recv_rls(), and rfcomm_recv_msc().
10) Use-after-free (CVE-ID: CVE-2026-53256)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in rfcomm_connect_ind() and rfcomm_get_sock_by_channel() when handling RFCOMM connection indications for a listener socket during a concurrent close. A remote attacker can trigger a race condition to cause a denial of service.
The issue occurs in the Linux kernel Bluetooth RFCOMM socket handling path when a listener socket is closed while a child socket is being queued, and KASAN reported the resulting slab-use-after-free in lock_sock_nested().
11) Race condition (CVE-ID: CVE-2025-39964) Exploited
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition within the include/crypto/if_alg.h. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
12) Use-after-free (CVE-ID: CVE-2026-53062)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the dm-cache smq policy invalidate_mapping operation when handling concurrent writes in passthrough mode. A local user can trigger concurrent cache block invalidations to cause a denial of service.
The issue occurs when the cache is operating in passthrough mode and multiple workers invalidate cache blocks simultaneously.
13) Race condition (CVE-ID: CVE-2026-52918)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.
The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.
14) Out-of-bounds read (CVE-ID: CVE-2026-46133)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in rxe_icrc_hdr() and opcode handling in the Soft RoCE receive path when processing a specially crafted UDP packet with an unknown RDMA opcode. A remote attacker can send a specially crafted UDP packet to trigger an out-of-bounds read and cause a denial of service.
The issue can be triggered without authentication after the RDMA RXE interface is enabled, and no queue pair or connection setup is required.
15) Integer underflow (CVE-ID: CVE-2026-46043)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer underflow in rxe_rcv when processing a crafted RDMA packet with a forged BTH pad field and insufficient length. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because payload_size() uses the attacker-controlled pad value and ICRC size when calculating the payload length.
16) Race condition (CVE-ID: CVE-2026-45894)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the Intel VT-d scalable mode PASID table entry handling when tearing down an active PASID entry. A local user can trigger concurrent PASID entry teardown to cause a denial of service.
The issue can lead to unpredictable behavior or spurious faults if the IOMMU hardware observes a torn read of the entry.
17) Improper access control (CVE-ID: CVE-2026-43334)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass man-in-the-middle protection during Bluetooth pairing.
The vulnerability exists due to improper access control in the Bluetooth SMP pairing response handling when processing a pairing request. A remote attacker can initiate a pairing request that omits MITM requirements to bypass man-in-the-middle protection during Bluetooth pairing.
Exploitation is possible when the local side requires high security and the selected pairing method becomes inconsistent with the responder's security policy.
18) Use-after-free (CVE-ID: CVE-2025-71082)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the btusb_probe() and btusb_disconnect() functions in drivers/bluetooth/btusb.c. A local user can escalate privileges on the system.
19) Use-after-free (CVE-ID: CVE-2023-54214)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the l2cap_sock_alloc_skb_cb() function in net/bluetooth/l2cap_sock.c. A local user can escalate privileges on the system.
20) Use-after-free (CVE-ID: CVE-2023-54120)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the hidp_set_timer() function in net/bluetooth/hidp/core.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.