SB2026101574 - Red Hat Enterprise Linux 8 update for kernel
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-31678)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the openvswitch tunnel device destruction path when destroying a tunnel vport after device unregistration. A local user can trigger concurrent access to a detached device reference to cause a denial of service.
2) Out-of-bounds read (CVE-ID: CVE-2026-63920)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.
Exploitation is reachable from an unprivileged user namespace.
3) Double free (CVE-ID: CVE-2026-68236)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.
The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.
4) Out-of-bounds write (CVE-ID: CVE-2026-68278)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause memory corruption.
The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.
The issue is reachable from a DP MST device over a physical connection.
5) Use-after-free (CVE-ID: CVE-2026-68409)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the mac80211 link RX stats handling in sta_remove_link() when processing concurrent link removal and RX fast-path access. A local attacker can trigger the race condition to cause a denial of service.
The issue occurs only when uses_rss is enabled, which is when pcpu_rx_stats exists.
6) Integer overflow (CVE-ID: CVE-2026-68108)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause out-of-bounds memory access.
The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.
The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.
7) Out-of-bounds read (CVE-ID: CVE-2026-72318)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() when processing a malicious DFS referral response from a server. A remote attacker can supply crafted referral string offsets to cause an out-of-bounds read and disclose sensitive information.
The issue occurs when DfsPathOffset or NetworkAddressOffset points beyond the end of the response buffer, leading to a negative length being forwarded as a size_t in the non-Unicode path.
8) Integer overflow (CVE-ID: CVE-2026-80887)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass shader window bounds validation.
The vulnerability exists due to an integer overflow in vmw_shader_define() when processing user-supplied shader size and offset values. A local user can provide a crafted shader size and offset to bypass shader window bounds validation.
The unchecked offset is forwarded to host SVGA shader-create commands.
9) Race condition (CVE-ID: CVE-2026-89811)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the AMD KFD MES queue management code when evicting or suspending MES queues while DMA descriptors are in flight. A local user can trigger queue eviction or suspension while in-flight DMA descriptors access unmapped memory to cause a denial of service.
The issue occurs during SVM page migration.
Remediation
Install update from vendor's website.