SB2026100201 - Red Hat Enterprise Linux 9 update for kernel
Published: October 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-45856)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ib_uverbs_post_send() when processing a user-supplied wqe_size value. A local user can provide a crafted small wqe_size value to disclose sensitive information.
An excessively large wqe_size value can also trigger a warning in the memory allocation path.
2) Out-of-bounds write (CVE-ID: CVE-2026-63794)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in sev_dbg_crypt() when processing crafted KVM SEV debug encryption requests. A local user can send a crafted ioctl request with page offsets that cause the transfer length to exceed the destination page boundary to cause memory corruption.
The issue affects the encrypt path and can overflow a single-page intermediate buffer by up to 15 bytes when the destination offset is greater than the source offset.
3) Use-after-free (CVE-ID: CVE-2026-80775)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a race condition in futex_hash_allocate() when concurrently allocating the initial mm->futex_ref counter. A local user can concurrently invoke prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) to cause memory corruption.
Exploitation requires a vfork child to invoke vfork again and then be killed with SIGKILL, causing its parent and grandchild to run concurrently while sharing the same memory map.
Remediation
Install update from vendor's website.