SB2026092403 - Red Hat Enterprise Linux 10 update for kernel
Published: September 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Use of uninitialized resource (CVE-ID: CVE-2026-23007)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the bio_integrity_prep() function in block/bio-integrity-auto.c. A local user can perform a denial of service (DoS) attack.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53266) Exploited
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory handling in the ebtables SNAT target ARP sender hardware address rewrite in net/bridge/netfilter/ebt_snat.c when processing ARP packets in bridge netfilter hooks. A local user can trigger ARP sender hardware address rewriting on a crafted nonlinear skb to cause a denial of service.
Exploitation requires the ARP sender hardware address rewrite path to be reached with a nonlinear skb fragment backed by a splice-imported file page.
3) Use-after-free (CVE-ID: CVE-2026-63831)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or corrupt data.
The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.
The issue can affect both RX and TX paths when skb data buffers are shared across clones.
4) Use-after-free (CVE-ID: CVE-2026-63802)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.
The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.
5) Out-of-bounds read (CVE-ID: CVE-2026-64053)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in bio_integrity_copy_user() and the block layer integrity handling when processing bio integrity metadata during read or write operations. A local user can trigger the vulnerable code path to cause an out-of-bounds read.
The issue occurs because bip_vcnt can exceed bip_max_vcnt, causing gap-merge checks to read past the bip_vec[] flexible array; on read operations the access remains in bounds but reaches a saved user bvec instead of the bounce segment.
6) Double free (CVE-ID: CVE-2026-64383)
CWE-ID: CWE-415 - Double Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to double free in SMB2_flush() when handling replay attempts for flush responses. A remote user can trigger a replayable flush response followed by a failed retry to cause a denial of service.
7) Use-after-free (CVE-ID: CVE-2026-64564)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.
The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.
8) Use-after-free (CVE-ID: CVE-2026-68201)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the ALSA timer subsystem, specifically slave timer callback handling in snd_timer_close_locked() and remove_slave_links(), when closing a master timer instance while a slave callback is still in flight. A local user can trigger timer close operations while a slave callback is active to cause a denial of service.
The issue occurs because a slave instance can be freed after its ->timer pointer is cleared, causing its close path to skip draining an already running callback.
9) Improper access control (CVE-ID: CVE-2026-72243)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass SELinux connect-related permission checks.
The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.
10) Out-of-bounds read (CVE-ID: CVE-2026-74569)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in ct_sip_get_header() in the nf_conntrack_sip SIP connection-tracking helper when processing NAT-rewritten SIP messages over TCP. A remote attacker can send a specially crafted SIP message with a long Contact list to cause a denial of service.
The issue is triggered by integer wraparound in size-change tracking during repeated URI rewriting, which can produce an invalid length value for a subsequent header parse.
11) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds memory access.
The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.
12) Integer underflow (CVE-ID: CVE-2026-81000)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write packet data outside allocated memory.
The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.
13) Out-of-bounds read (CVE-ID: CVE-2026-89846)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.
Remediation
Install update from vendor's website.