SB20261007215 - Red Hat Enterprise Linux 9 update for kernel
Published: October 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-64007)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption or a denial of service.
The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.
The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.
2) Out-of-bounds write (CVE-ID: CVE-2026-80863)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.
3) Use-after-free (CVE-ID: CVE-2026-80864)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the RDMA/rxe responder resource handling when modifying IB_QP_MAX_DEST_RD_ATOMIC while the responder task is active. A local user can race the freeing and reallocation of rd_atomic resources to cause a denial of service.
4) Use-after-free (CVE-ID: CVE-2026-80792)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.
The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-72130)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.
This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.
6) Use-after-free (CVE-ID: CVE-2026-68426)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.
The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().
7) Use-after-free (CVE-ID: CVE-2026-64582)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.
Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.
8) Use-after-free (CVE-ID: CVE-2026-63917)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.
The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.
9) Use-after-free (CVE-ID: CVE-2026-63919)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm transport-mode deferred reinjection handling in net/xfrm/xfrm_input.c when processing deferred transport reinjection callbacks that use a stored network namespace pointer. A local user can trigger deferred transport reinjection with a dangling net namespace reference to cause a denial of service.
10) Integer overflow (CVE-ID: CVE-2026-63984)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory in a forwarded packet.
The vulnerability exists due to an integer overflow in ipv6_rpl_srh_decompress() and ipv6_rpl_srh_rcv() when processing a crafted IPv6 RPL source routing header. A remote attacker can send a specially crafted packet to corrupt memory in a forwarded packet.
The issue occurs because the computed hdrlen value can truncate to zero for a large segment count, causing the compressed header to overlap the decompressed routing data.
11) Improper access control (CVE-ID: CVE-2026-63921)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to redirect packets across network namespaces.
The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.
Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.
12) Use-after-free (CVE-ID: CVE-2026-31663)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.
13) Out-of-bounds read (CVE-ID: CVE-2026-63920)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.
Exploitation is reachable from an unprivileged user namespace.
14) Use-after-free (CVE-ID: CVE-2026-63922)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free risk from stale pointer reuse in ip6_parse_tlv() in net/ipv6/exthdrs.c when parsing IPv6 TLVs containing the HAO option. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.
The issue occurs when handling a cloned skb where header expansion moves the skb head and invalidates the cached network header pointer.
15) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-63924)
CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper pointer handling in the IPv6 extension header parser in net/ipv6/exthdrs.c when processing IPv6 jumbo hop-by-hop options. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.
16) Use-after-free (CVE-ID: CVE-2026-53239)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_policy_bysel_ctx() and inexact bin handling in the xfrm policy subsystem when processing concurrent policy deletion and hash rebuild operations. A local user can trigger a race condition to cause a denial of service.
The issue occurs because an inexact bin may be freed during a window after the policy lock is released and before pruning is performed.
17) Out-of-bounds read (CVE-ID: CVE-2026-46114)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in atomic_write_reply() in the RDMA rxe responder when processing a crafted ATOMIC_WRITE request with a zero-length logical payload. A remote attacker can send a specially crafted ATOMIC_WRITE request to disclose sensitive information.
The issue can leak kernel tailroom bytes into the attacker's memory region, including recognizable kernel strings and partial pointer words.
18) Out-of-bounds read (CVE-ID: CVE-2026-46133)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in rxe_icrc_hdr() and opcode handling in the Soft RoCE receive path when processing a specially crafted UDP packet with an unknown RDMA opcode. A remote attacker can send a specially crafted UDP packet to trigger an out-of-bounds read and cause a denial of service.
The issue can be triggered without authentication after the RDMA RXE interface is enabled, and no queue pair or connection setup is required.
19) Integer underflow (CVE-ID: CVE-2026-46043)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer underflow in rxe_rcv when processing a crafted RDMA packet with a forged BTH pad field and insufficient length. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because payload_size() uses the attacker-controlled pad value and ICRC size when calculating the payload length.
20) Race condition (CVE-ID: CVE-2026-45910)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in QP timer handlers in the RDMA rxe subsystem when handling Queue Pair timer callbacks during Queue Pair destruction. A local user can trigger concurrent timer activity and Queue Pair teardown to cause a denial of service.
The issue can lead to a reference count underflow and use-after-free warning during timer handler execution.
21) Out-of-bounds read (CVE-ID: CVE-2026-31613)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the SMB client symlink response parser when parsing a crafted symlink error response from an untrusted server. A remote attacker can send a specially crafted SMB response to disclose sensitive information.
The exposed heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).
Remediation
Install update from vendor's website.