SB2026101675 - Red Hat Enterprise Linux 10 update for kernel
Published: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2026-43020)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to a stack-based buffer overflow in the Bluetooth MGMT Long Term Key load and reply handling logic when processing a crafted management LTK record with an oversized enc_size value. A remote user can supply a specially crafted LTK record to overflow a reply stack buffer to cause a denial of service or execute arbitrary code.
2) Stack-based buffer overflow (CVE-ID: CVE-2026-31772)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in hci_le_big_create_sync when processing a crafted ISO socket configuration. A local user can bind an ISO socket with a large number of BIS entries and call listen() to cause a denial of service.
The issue is triggered when the number of BIS entries is between 18 and 31, leading to a stack out-of-bounds write in the HCI command sync worker.
3) Out-of-bounds read (CVE-ID: CVE-2026-43450)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in nfnl_cthelper_dump_table() when handling netlink dump requests after a previously saved helper entry is deleted between dump rounds. A local user can trigger the affected dump logic to cause a denial of service.
The issue is triggered when the saved "last" helper is deleted between dump rounds, causing a restart path to bypass the loop bounds check.
4) Out-of-bounds read (CVE-ID: CVE-2026-46149)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.
When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.
5) Double free (CVE-ID: CVE-2026-46189)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in pvrdma_alloc_ucontext() error path when handling ucontext allocation failures. A local user can trigger the error path to cause a denial of service.
6) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-63924)
CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper pointer handling in the IPv6 extension header parser in net/ipv6/exthdrs.c when processing IPv6 jumbo hop-by-hop options. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.
7) Use-after-free (CVE-ID: CVE-2026-63922)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free risk from stale pointer reuse in ip6_parse_tlv() in net/ipv6/exthdrs.c when parsing IPv6 TLVs containing the HAO option. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.
The issue occurs when handling a cloned skb where header expansion moves the skb head and invalidates the cached network header pointer.
8) Out-of-bounds read (CVE-ID: CVE-2026-63920)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.
Exploitation is reachable from an unprivileged user namespace.
9) Use-after-free (CVE-ID: CVE-2026-63993)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a use-after-free in the vxlan_xmit_one function in drivers/net/vxlan/vxlan_core.c when processing packets after skb_tunnel_check_pmtu() updates the skb head. A local user can trigger the vulnerable code path to execute arbitrary code.
10) Integer overflow (CVE-ID: CVE-2026-63984)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory in a forwarded packet.
The vulnerability exists due to an integer overflow in ipv6_rpl_srh_decompress() and ipv6_rpl_srh_rcv() when processing a crafted IPv6 RPL source routing header. A remote attacker can send a specially crafted packet to corrupt memory in a forwarded packet.
The issue occurs because the computed hdrlen value can truncate to zero for a large segment count, causing the compressed header to overlap the decompressed routing data.
11) Use-after-free (CVE-ID: CVE-2026-64113)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.
The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.
12) Out-of-bounds read (CVE-ID: CVE-2026-64490)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds access in virtio-snd control handling in sound/virtio/virtio_kctl.c when processing device-provided control metadata. A local user can provide a malicious or buggy virtio sound device that advertises an invalid control type or an oversized value count to cause a denial of service.
Exploitation requires the presence of a virtio sound device that supplies crafted control metadata to the guest kernel.
13) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)
CWE-ID: CWE-691 - Insufficient Control Flow Management
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.
Only systems affected by SRSO are vulnerable.
14) Race condition (CVE-ID: CVE-2026-68086)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause data loss.
The vulnerability exists due to improper synchronization in mm/khugepaged collapse_file() when collapsing file-backed transparent huge pages in the presence of previously dirtied folios. A local user can write to a file, close it, and trigger a collapse operation to cause data loss.
The issue occurs in an edge case where dirty folios from previous writers can be discarded during page cache truncation after a later writable open.
15) Use-after-free (CVE-ID: CVE-2026-80792)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.
The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.
16) Use-after-free (CVE-ID: CVE-2026-98260)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in POSIX CPU timer cleanup during process execution and termination when a non-leader thread executes a program and a subsequent failure leaves a freed timer node queued. A local user can create and arm a per-thread CPU timer and trigger an execution failure after the thread ID exchange, followed by task reaping, to cause a denial of service.
The affected timer functionality requires CONFIG_POSIX_TIMERS to be enabled.
Remediation
Install update from vendor's website.