SB2026100538 - Red Hat Enterprise Linux 8 update for kernel

Description

This security bulletin contains information about 29 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2026-63992)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iptunnel_pmtud_check_icmp() when processing ICMP packets without a valid transport header. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the function may be called while the skb transport header is not set.

2) Type conversion (CVE-ID: CVE-2026-97417)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an unaligned memory access.

The vulnerability exists due to an unsafe pointer cast in the tcp_sack() timestamp-only fast path when processing TCP options. A remote attacker can send a TCP packet containing unaligned options to trigger an unaligned memory access.

3) Missing Authorization (CVE-ID: CVE-2026-90227)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write data despite read-only access restrictions.

The vulnerability exists due to missing authorization in the NVME_IOCTL_SUBMIT_IO ioctl handler when submitting NVMe I/O commands. A local user can invoke the ioctl with a crafted I/O command to write data despite read-only access restrictions.

4) Use-after-free (CVE-ID: CVE-2026-89972)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a missing SRCU grace period in the nvme_alloc_ns() error path when concurrently accessing NVMe multipath namespace paths. A remote attacker can trigger concurrent namespace access during error handling to compromise confidentiality, integrity, and availability.

5) Improper input validation (CVE-ID: CVE-2026-89481)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in nvme_tcp_handle_r2t() when processing an R2T request for a read command. A remote attacker can send an R2T request for a read command to disclose sensitive information.

The disclosed read destination buffer may contain stale kernel data.

6) Improper access control (CVE-ID: CVE-2026-80921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a device that is no longer available.

The vulnerability exists due to improper access control in KVM s390 VSIE APCB shadowing when shadowing crypto access bits from a format 0 APCB. A local user can use stale crypto access bits to access a device that is no longer available.

The issue affects nested guest environments.

7) Use-after-free (CVE-ID: CVE-2026-74746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.

KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.

8) Use-after-free (CVE-ID: CVE-2026-74744)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.

The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.

9) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

10) Out-of-bounds read (CVE-ID: CVE-2026-74569)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ct_sip_get_header() in the nf_conntrack_sip SIP connection-tracking helper when processing NAT-rewritten SIP messages over TCP. A remote attacker can send a specially crafted SIP message with a long Contact list to cause a denial of service.

The issue is triggered by integer wraparound in size-change tracking during repeated URI rewriting, which can produce an invalid length value for a subsequent header parse.

11) Improper access control (CVE-ID: CVE-2026-74516)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in x2APIC MSR interception handling in KVM SVM/AVIC when AVIC is inhibited while an L2 guest is active. A local user can run a nested guest that triggers this state to cause a denial of service.

The issue can allow an L1 guest to read much of the host APIC state, send arbitrary interrupts, and change task priority before host disruption occurs.

12) Use-after-free (CVE-ID: CVE-2026-72255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue handling of bridge fake dst references when processing bridged packets queued to NFQUEUE. A local user can queue bridged packets to NFQUEUE during bridge device teardown to cause a denial of service.

The issue affects systems with CONFIG_BRIDGE_NETFILTER enabled and involves queued packets carrying a fake rtable associated with a bridge device.

13) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

14) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

15) Use-after-free (CVE-ID: CVE-2026-63994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() when processing tunnel PMTU ICMP and ICMPv6 packet generation. A local user can trigger skb_cow() reallocation while stale network header pointers are still used to cause a denial of service.

16) Use-after-free (CVE-ID: CVE-2025-39994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xc5000_release() function in drivers/media/tuners/xc5000.c. A local user can escalate privileges on the system.

17) Out-of-bounds write (CVE-ID: CVE-2026-63794)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in sev_dbg_crypt() when processing crafted KVM SEV debug encryption requests. A local user can send a crafted ioctl request with page offsets that cause the transfer length to exceed the destination page boundary to cause memory corruption.

The issue affects the encrypt path and can overflow a single-page intermediate buffer by up to 15 bytes when the destination offset is greater than the source offset.

18) Improper access control (CVE-ID: CVE-2026-63829)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipgre_changelink() and erspan_changelink() when handling RTM_NEWLINK changelink requests for GRE tunnel devices. A local privileged user can send a crafted RTM_NEWLINK request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, because the check was performed only against dev_net(dev).

19) Use-after-free (CVE-ID: CVE-2026-53270)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.

The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.

20) Out-of-bounds read (CVE-ID: CVE-2026-53230)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mlx5_query_nic_vport_mac_list when querying a VF vport MAC list with a larger configured maximum than the PF capability-based buffer size. A local user can configure or trigger processing of a VF vport with a larger MAC list to cause a denial of service.

The issue occurs in the mlx5 driver while handling vport address list updates.

21) Integer overflow (CVE-ID: CVE-2026-52972)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the af_alg control message handler when processing a crafted associated data length value for AEAD operations. A local user can send a specially crafted message to cause a denial of service.

22) Improper locking (CVE-ID: CVE-2026-53049)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in gfs2_logd() and log flushing functions in the gfs2 log subsystem when handling concurrent transactions. A local user can trigger concurrent log flush activity to cause a denial of service.

23) Use-after-free (CVE-ID: CVE-2026-46319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free race condition in tcf_ct_flow_table_get() in net/sched/act_ct.c when looking up a flow table and incrementing its reference count. A local user can trigger the race during act_ct initialization to escalate privileges.

The race window is very short and occurs after the flow table object is returned from the hash table lookup but before its reference count is successfully incremented.

24) Use-after-free (CVE-ID: CVE-2026-45861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qd_put and the gfs2 quota data LRU handling when shutting down the filesystem and the shrinker scans quota data objects. A local user can trigger filesystem shutdown to cause a denial of service.

25) Out-of-bounds read (CVE-ID: CVE-2026-45856)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ib_uverbs_post_send() when processing a user-supplied wqe_size value. A local user can provide a crafted small wqe_size value to disclose sensitive information.

An excessively large wqe_size value can also trigger a warning in the memory allocation path.

26) Input validation error (CVE-ID: CVE-2026-23105)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qfq_rm_from_agg() function in net/sched/sch_qfq.c. A local user can perform a denial of service (DoS) attack.

27) Buffer overflow (CVE-ID: CVE-2022-50756)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nvme_dbbuf_update_and_check_event() function in drivers/nvme/host/pci.c. A local user can escalate privileges on the system.

28) Double free (CVE-ID: CVE-2023-54048)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the drivers/infiniband/hw/bnxt_re/qplib_fp.h. A local user can perform a denial of service (DoS) attack.

29) Improper locking (CVE-ID: CVE-2025-40242)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the gdlm_put_lock() function in fs/gfs2/lock_dlm.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2026:75747