SB2026092402 - Red Hat Enterprise Linux 9 update for kernel
Published: September 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Use of uninitialized resource (CVE-ID: CVE-2026-23007)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the bio_integrity_prep() function in block/bio-integrity-auto.c. A local user can perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2026-53005)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the AF_UNIX SOCKMAP handling and garbage collection logic when processing socket buffers carrying SCM file descriptor attributes through SOCKMAP. A local user can send crafted AF_UNIX messages with SCM file descriptor attributes through SOCKMAP to cause a denial of service.
The issue arises because redirected socket buffers are not visible to AF_UNIX garbage collection, and user interaction is not required.
3) Use-after-free (CVE-ID: CVE-2026-63831)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or corrupt data.
The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.
The issue can affect both RX and TX paths when skb data buffers are shared across clones.
4) Use-after-free (CVE-ID: CVE-2026-63802)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.
The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.
5) Out-of-bounds read (CVE-ID: CVE-2026-64053)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in bio_integrity_copy_user() and the block layer integrity handling when processing bio integrity metadata during read or write operations. A local user can trigger the vulnerable code path to cause an out-of-bounds read.
The issue occurs because bip_vcnt can exceed bip_max_vcnt, causing gap-merge checks to read past the bip_vec[] flexible array; on read operations the access remains in bounds but reaches a saved user bvec instead of the bounce segment.
6) Double free (CVE-ID: CVE-2026-64383)
CWE-ID: CWE-415 - Double Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to double free in SMB2_flush() when handling replay attempts for flush responses. A remote user can trigger a replayable flush response followed by a failed retry to cause a denial of service.
7) Use-after-free (CVE-ID: CVE-2026-64534)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in nvmet_tcp_try_recv_ddgst() when processing a command with a data digest mismatch after request initialization previously failed. A remote attacker can send a specially crafted request to cause a denial of service.
The issue can lead to a refcount underflow, kernel warnings, and a permanent workqueue deadlock.
8) Use-after-free (CVE-ID: CVE-2026-64564)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.
The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.
9) Use-after-free (CVE-ID: CVE-2026-68201)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the ALSA timer subsystem, specifically slave timer callback handling in snd_timer_close_locked() and remove_slave_links(), when closing a master timer instance while a slave callback is still in flight. A local user can trigger timer close operations while a slave callback is active to cause a denial of service.
The issue occurs because a slave instance can be freed after its ->timer pointer is cleared, causing its close path to skip draining an already running callback.
10) Out-of-bounds write (CVE-ID: CVE-2026-72261)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in snd_sof_update_control when processing firmware-provided control data. A local user can provide inconsistent control data values to cause a denial of service.
The issue occurs because num_elems was validated against a stored size field but not against the actual ipc_control_data allocation size before memcpy.
11) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds memory access.
The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.
12) Integer underflow (CVE-ID: CVE-2026-81000)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write packet data outside allocated memory.
The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.
13) Out-of-bounds read (CVE-ID: CVE-2026-89846)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.
Remediation
Install update from vendor's website.