SB2026093063 - Red Hat Enterprise Linux 9 update for kernel
Published: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Division by zero (CVE-ID: CVE-2022-49670)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a division by zero error within the include/linux/dim.h. A local user can perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2026-31581)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in usb6fire_chip_abort() in the ALSA 6fire USB driver when handling device disconnect. A local user can trigger a device disconnect to cause a denial of service.
The issue occurs because the card private data may be freed synchronously when no file handles are open, after which the code accesses the freed chip structure.
3) Use-after-free (CVE-ID: CVE-2026-52924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP outqueue and stream scheduler state handling when processing a stale COOKIE-ECHO condition. A remote attacker can send a stale cookie error during SCTP association handling to cause a denial of service.
The issue occurs when an association is rolled back from COOKIE_ECHOED to COOKIE_WAIT, leaving scheduler state referencing freed stream entries.
4) Improper input validation (CVE-ID: CVE-2026-53091)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.
5) Out-of-bounds write (CVE-ID: CVE-2026-53059)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.
The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.
6) Stack-based buffer overflow (CVE-ID: CVE-2026-53002)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in the nf_nat_sip netfilter helper when processing crafted SIP/SDP messages. A remote attacker can send specially crafted network traffic to cause a denial of service.
The issue is triggered in mangle_content_len() during SIP message handling.
7) Double free (CVE-ID: CVE-2026-52993)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in tipc_buf_append() when validating a reassembled skb after tipc_msg_validate() reallocates it. A local user can trigger the error-handling path with a crafted TIPC message to cause a denial of service.
8) Race condition (CVE-ID: CVE-2026-53071)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt kernel memory.
The vulnerability exists due to a race condition in l2cap_ecred_reconf_rsp in the L2CAP subsystem when processing a crafted L2CAP ECRED reconfiguration response from a remote BLE device. A remote attacker can send a specially crafted L2CAP ECRED reconfiguration response to corrupt kernel memory.
Exploitation requires concurrent channel list iteration by another thread.
9) Use-after-free (CVE-ID: CVE-2026-53185)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in zram_bvec_write_partial() when processing partial writes for ZRAM_WB slots. A local user can trigger an asynchronous backing device read and subsequent access to a freed page to cause a denial of service.
The issue occurs because the read operation may still be in flight when the buffer page is freed.
10) Out-of-bounds read (CVE-ID: CVE-2026-64191)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.
The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.
11) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)
CWE-ID: CWE-691 - Insufficient Control Flow Management
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.
Only systems affected by SRSO are vulnerable.
12) Improper access control (CVE-ID: CVE-2026-68294)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass network namespace isolation.
The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.
The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.
13) Out-of-bounds write (CVE-ID: CVE-2026-72098)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.
The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.
14) Use-after-free (CVE-ID: CVE-2026-74746)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.
KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.
15) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-45919)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper logic in rto_next_cpu() when handling RT load balancing on an overloaded CPU. A local user can trigger repeated self-IPIs to cause a denial of service.
The issue can lead to a CPU hardlockup when HAVE_RT_PUSH_IPI is enabled and the affected CPU remains overloaded while other CPUs run pull_rt_task().
Remediation
Install update from vendor's website.