SB20260928208 - Red Hat Enterprise Linux 8 update for kernel
Published: September 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2025-40323)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the include/linux/fbcon.h. A local user can escalate privileges on the system.
2) Race condition (CVE-ID: CVE-2026-45942)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in ext4 buddy bitmap handling when processing mixed huge-page workloads and concurrent page migration. A local user can trigger filesystem activity that hits the race window to cause a denial of service.
The issue can lead to ext4 e4b bitmap inconsistency reports and false-positive corruption reports during stress conditions.
3) Out-of-bounds read (CVE-ID: CVE-2026-46230)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the amdgpu vcn3 decoder message parser when parsing decoder messages from a buffer object. A local user can supply a specially crafted decoder message to disclose sensitive information.
4) Out-of-bounds read (CVE-ID: CVE-2026-46204)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the amdgpu vcn4 IB parser when parsing IB data. A local user can provide a specially crafted IB to disclose sensitive information.
5) Out-of-bounds read (CVE-ID: CVE-2026-46199)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the drm/amdgpu vcn4 decoder message parser when parsing a decoder message from a buffer object. A local user can provide a specially crafted decoder message to disclose sensitive information.
6) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-63875)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper cache invalidation in arm64 TLB flushing logic when unsharing PMD tables. A local user can trigger PMD table unsharing to cause a denial of service.
The issue can leave a stale PMD page table entry in the walk cache, which may result in incorrect page table walks.
7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64034)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass bounds validation.
The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.
Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.
8) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64556)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to improper state management in perf_event_remove_on_exec() and event group handling in the perf subsystem when removing events marked remove_on_exec. A local user can trigger event removal for a group leader with surviving siblings to corrupt kernel memory.
The issue occurs when a removed event is a group leader and sibling events without remove_on_exec remain active in a stale group state.
9) Out-of-bounds write (CVE-ID: CVE-2026-68159)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.
The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].
10) Use-after-free (CVE-ID: CVE-2026-68156)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.
The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.
11) Improper input validation (CVE-ID: CVE-2026-68155)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.
The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.
12) Use-after-free (CVE-ID: CVE-2026-68273)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free and NULL pointer dereference in the amdgpu context pstate handling code when initializing or finalizing GPU contexts while stable pstate state changes are processed. A local user can create and tear down crafted contexts to cause a denial of service.
The issue arises because context pstate ownership transitions were not consistently protected by the stable_pstate_ctx_lock, and sysfs-triggered state changes can race with context handling.
13) Use-after-free (CVE-ID: CVE-2026-74753)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a use-after-free in perf_event_open() group handling in kernel/events/core.c when attaching a new event to a group leader in the EXIT state. A local user can open a perf event as a sibling of a detached leader to execute arbitrary code.
The issue occurs because a sibling event can retain a group_leader pointer to a freed event after remove-on-exec detaches the original leader.
Remediation
Install update from vendor's website.