SB20261007212 - Red Hat Enterprise Linux 9 update for kernel-rt
Published: October 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Division by zero (CVE-ID: CVE-2022-49670)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a division by zero error within the include/linux/dim.h. A local user can perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2026-31581)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in usb6fire_chip_abort() in the ALSA 6fire USB driver when handling device disconnect. A local user can trigger a device disconnect to cause a denial of service.
The issue occurs because the card private data may be freed synchronously when no file handles are open, after which the code accesses the freed chip structure.
3) Use-after-free (CVE-ID: CVE-2026-46120)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ip6erspan_changelink() when changing link configuration after network namespace migration. A local user can trigger tunnel reinsertion into the wrong per-netns hash to cause a denial of service.
The issue is reachable from an unprivileged user namespace.
4) Use-after-free (CVE-ID: CVE-2026-52924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP outqueue and stream scheduler state handling when processing a stale COOKIE-ECHO condition. A remote attacker can send a stale cookie error during SCTP association handling to cause a denial of service.
The issue occurs when an association is rolled back from COOKIE_ECHOED to COOKIE_WAIT, leaving scheduler state referencing freed stream entries.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-53002)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in the nf_nat_sip netfilter helper when processing crafted SIP/SDP messages. A remote attacker can send specially crafted network traffic to cause a denial of service.
The issue is triggered in mangle_content_len() during SIP message handling.
6) Double free (CVE-ID: CVE-2026-53009)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in ice_xmit_frame_ring() and tx ring buffer cleanup when handling transmit error paths and interface shutdown. A local user can trigger transmit checksum or tso failure conditions and then bring the interface down to cause a denial of service.
The issue occurs because a tx_buf entry can remain marked as valid and continue to reference an skb that was already freed in the error path.
7) Use-after-free (CVE-ID: CVE-2026-53185)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in zram_bvec_write_partial() when processing partial writes for ZRAM_WB slots. A local user can trigger an asynchronous backing device read and subsequent access to a freed page to cause a denial of service.
The issue occurs because the read operation may still be in flight when the buffer page is freed.
8) Out-of-bounds read (CVE-ID: CVE-2026-64191)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.
The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.
9) Improper access control (CVE-ID: CVE-2026-68294)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass network namespace isolation.
The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.
The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.
10) Use-after-free (CVE-ID: CVE-2026-74746)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.
KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.
11) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-45919)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper logic in rto_next_cpu() when handling RT load balancing on an overloaded CPU. A local user can trigger repeated self-IPIs to cause a denial of service.
The issue can lead to a CPU hardlockup when HAVE_RT_PUSH_IPI is enabled and the affected CPU remains overloaded while other CPUs run pull_rt_task().
Remediation
Install update from vendor's website.