SB2026101583 - Red Hat Enterprise Linux 9 update for kernel
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 vulnerabilities.
1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72320)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass netfilter rules.
The vulnerability exists due to improper handling of inverted lookups in nft_lookup_eval() when processing catchall elements for interval sets. A local user can trigger a crafted lookup condition to bypass netfilter rules.
The issue affects inverted lookups using catchall elements for the open-ended default range in interval sets.
2) Improper input validation (CVE-ID: CVE-2026-93228)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause improper processing of malformed RPC-over-RDMA chunks.
The vulnerability exists due to improper input validation in the xdr_check_write_chunk() function when processing Write or Reply chunks with a zero segment count. A remote attacker can send a malformed Write or Reply chunk with a zero segment count to cause improper processing of malformed RPC-over-RDMA chunks.
3) Use-after-free (CVE-ID: CVE-2026-93207)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access freed memory.
The vulnerability exists due to a use-after-free condition in svcauth_gss_decode_credbody() when processing malformed RPC GSS credential bodies. A remote attacker can send a malformed RPC GSS credential to access freed memory.
The credential storage is reused across requests, allowing a dangling context-data pointer to be paired with a stale length after request pages are released.
4) Use-after-free (CVE-ID: CVE-2026-90036)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in the NFSD blocked-lock reaping logic when reaping blocked locks concurrently with client expiration. A remote attacker can cause a client to be freed before nfs4_put_stateowner() dereferences its cl_lock to trigger a use-after-free condition.
5) Improper access control (CVE-ID: CVE-2026-81003)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to inject data into existing AF_IUCV sockets and cause a denial of service.
The vulnerability exists due to improper ingress device validation in afiucv_hs_rcv() socket selection when processing a raw ETH_P_AF_IUCV frame received on a network device. A local user can send a crafted raw ETH_P_AF_IUCV frame through its loopback device to inject data into existing AF_IUCV sockets and cause a denial of service.
Exploitation requires CAP_NET_RAW in an unprivileged user and network namespace.
6) Out-of-bounds read (CVE-ID: CVE-2026-89526)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in RPC/RDMA Read chunk reconstruction when processing crafted Read chunk positions supplied by a remote client. A remote attacker can supply out-of-range or overlapping Read chunk positions to disclose sensitive information.
7) Out-of-bounds read (CVE-ID: CVE-2026-80985)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to delete registered remote tokens or install remote tokens.
The vulnerability exists due to an out-of-bounds read in the SMC-Rv2 LLC message queue handling when processing oversized SMC-Rv2 DELETE_RKEY_V2 or ADD_LINK messages. A remote attacker can send a crafted SMC-Rv2 LLC message to delete registered remote tokens or install remote tokens.
8) Use-after-free (CVE-ID: CVE-2026-74705)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.
9) Improper input validation (CVE-ID: CVE-2026-74641)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.
The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.
Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.
10) Use-after-free (CVE-ID: CVE-2026-46319)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a use-after-free race condition in tcf_ct_flow_table_get() in net/sched/act_ct.c when looking up a flow table and incrementing its reference count. A local user can trigger the race during act_ct initialization to escalate privileges.
The race window is very short and occurs after the flow table object is returned from the hash table lookup but before its reference count is successfully incremented.
11) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or disclose sensitive information.
The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.
The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.
12) Use-after-free (CVE-ID: CVE-2026-72288)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the KVM arm64 virtual generic interrupt controller (vgic) AP list handling when racing interrupt affinity changes with LPI disabling. A local user can trigger concurrent interrupt state changes to cause a denial of service.
The issue occurs during LPI handling involving multiple vCPUs.
13) Use-after-free (CVE-ID: CVE-2026-68409)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the mac80211 link RX stats handling in sta_remove_link() when processing concurrent link removal and RX fast-path access. A local attacker can trigger the race condition to cause a denial of service.
The issue occurs only when uses_rss is enabled, which is when pcpu_rx_stats exists.
14) Use-after-free (CVE-ID: CVE-2026-68140)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the af_iucv message queue handling when processing queued message notifications after a connection is severed. A local user can trigger connection severing with queued notifications still pending and then invoke recvmsg() to cause a denial of service.
The issue occurs because queued notifications retain stale references to a freed iucv_path.
15) Use-after-free (CVE-ID: CVE-2026-68377)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.
The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.
16) Race condition (CVE-ID: CVE-2026-68404)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in nl80211_netlink_notify() and cfg80211 wireless device autodisconnect handling when releasing a NETLINK_GENERIC socket that owns a connection. A local user can release a crafted netlink socket to cause a denial of service.
The issue occurs because autodisconnect work can be queued after teardown has cancelled pending work and after the wireless device has been removed from the device list.
17) Out-of-bounds read (CVE-ID: CVE-2026-64030)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in ieee80211_ml_epcs when processing an EPCS Enable Response action frame with a crafted PER_STA_PROFILE subelement containing link_id 15. A remote attacker can send a specially crafted action frame to cause a denial of service.
The unsolicited-notification path is reachable when EPCS is already enabled, and no prior client request is required when dialog_token is 0.
18) Use-after-free (CVE-ID: CVE-2026-53011)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in advance_sched() in the taprio scheduler when switching schedules. A local user can trigger a schedule switch to cause a denial of service.
Remediation
Install update from vendor's website.