SB2026101584 - Red Hat Enterprise Linux 8 update for kernel
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-68377)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.
The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or disclose sensitive information.
The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.
The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.
3) Use-after-free (CVE-ID: CVE-2026-74583)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.
The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.
4) Improper input validation (CVE-ID: CVE-2026-74641)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.
The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.
Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.
5) Use-after-free (CVE-ID: CVE-2026-74705)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.
6) Out-of-bounds read (CVE-ID: CVE-2026-89526)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in RPC/RDMA Read chunk reconstruction when processing crafted Read chunk positions supplied by a remote client. A remote attacker can supply out-of-range or overlapping Read chunk positions to disclose sensitive information.
7) Use-after-free (CVE-ID: CVE-2026-90036)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in the NFSD blocked-lock reaping logic when reaping blocked locks concurrently with client expiration. A remote attacker can cause a client to be freed before nfs4_put_stateowner() dereferences its cl_lock to trigger a use-after-free condition.
8) Improper input validation (CVE-ID: CVE-2026-93228)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause improper processing of malformed RPC-over-RDMA chunks.
The vulnerability exists due to improper input validation in the xdr_check_write_chunk() function when processing Write or Reply chunks with a zero segment count. A remote attacker can send a malformed Write or Reply chunk with a zero segment count to cause improper processing of malformed RPC-over-RDMA chunks.
9) Use-after-free (CVE-ID: CVE-2026-93262)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in ppl_do_flush() when processing RAID5 PPL flushes. A local user can cause ppl_io_unit_finished() to free the io object while the loop continues accessing io->pending_flushes to trigger a use-after-free condition.
Remediation
Install update from vendor's website.