SB2026092302 - Red Hat Enterprise Linux 9 update for kernel
Published: September 23, 2026 Updated: October 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2025-21826)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory corruption within the nft_set_desc_concat_parse() and nft_set_desc_concat() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2026-64017)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in blk-mq cached request handling in block/blk-mq.c when submitting a bio while a cached request is peeked and the task sleeps before it is removed from the plug list. A local user can trigger request handling that hits this race condition to cause a denial of service.
The issue occurs when a plug flush frees cached requests before the cached request is popped for use.
3) Improper Initialization (CVE-ID: CVE-2026-64368)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in slab allocation handling in mm/slub.c when allocating kmalloc objects with zeroing enabled. A local user can trigger a memory allocation pattern that leaves part of the allocated object uninitialized to disclose sensitive information.
The issue occurs when requested-size tracking is not enabled while red zoning alone is enabled, which can break krealloc() __GFP_ZERO expectations.
4) Use-after-free (CVE-ID: CVE-2026-64564)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.
The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.
Remediation
Install update from vendor's website.