SB2026101578 - Red Hat Enterprise Linux 9 update for kernel-rt
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-31663)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.
2) Use-after-free (CVE-ID: CVE-2026-53239)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_policy_bysel_ctx() and inexact bin handling in the xfrm policy subsystem when processing concurrent policy deletion and hash rebuild operations. A local user can trigger a race condition to cause a denial of service.
The issue occurs because an inexact bin may be freed during a window after the policy lock is released and before pruning is performed.
3) Improper access control (CVE-ID: CVE-2026-63921)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to redirect packets across network namespaces.
The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.
Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.
4) Use-after-free (CVE-ID: CVE-2026-63919)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm transport-mode deferred reinjection handling in net/xfrm/xfrm_input.c when processing deferred transport reinjection callbacks that use a stored network namespace pointer. A local user can trigger deferred transport reinjection with a dangling net namespace reference to cause a denial of service.
5) Use-after-free (CVE-ID: CVE-2026-63917)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.
The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.
6) Use-after-free (CVE-ID: CVE-2026-68426)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.
The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().
7) Heap-based buffer overflow (CVE-ID: CVE-2026-72130)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.
This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.
8) Use-after-free (CVE-ID: CVE-2026-74705)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.
Remediation
Install update from vendor's website.