SB2026103053 - Red Hat Enterprise Linux 9 update for kernel-rt

Description

This security bulletin contains information about 23 vulnerabilities.

1) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-63924)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper pointer handling in the IPv6 extension header parser in net/ipv6/exthdrs.c when processing IPv6 jumbo hop-by-hop options. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

2) Out-of-bounds read (CVE-ID: CVE-2026-89846)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.

3) Use-after-free (CVE-ID: CVE-2026-80792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

4) Improper input validation (CVE-ID: CVE-2026-74641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.

The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.

Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.

5) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

6) Out-of-bounds write (CVE-ID: CVE-2026-72098)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.

The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.

7) Out-of-bounds read (CVE-ID: CVE-2026-64319)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nvmet_auth_reply() when processing a crafted DHCHAP_REPLY message. A remote attacker can send a specially crafted authentication reply message with inconsistent hash and DH value lengths to disclose sensitive information.

Exploitation is possible pre-authentication when DH authentication is configured.

8) Use-after-free (CVE-ID: CVE-2026-64017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in blk-mq cached request handling in block/blk-mq.c when submitting a bio while a cached request is peeked and the task sleeps before it is removed from the plug list. A local user can trigger request handling that hits this race condition to cause a denial of service.

The issue occurs when a plug flush frees cached requests before the cached request is popped for use.

9) Integer overflow (CVE-ID: CVE-2026-63984)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory in a forwarded packet.

The vulnerability exists due to an integer overflow in ipv6_rpl_srh_decompress() and ipv6_rpl_srh_rcv() when processing a crafted IPv6 RPL source routing header. A remote attacker can send a specially crafted packet to corrupt memory in a forwarded packet.

The issue occurs because the computed hdrlen value can truncate to zero for a large segment count, causing the compressed header to overlap the decompressed routing data.

10) Use-after-free (CVE-ID: CVE-2026-63993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vxlan_xmit_one function in drivers/net/vxlan/vxlan_core.c when processing packets after skb_tunnel_check_pmtu() updates the skb head. A local user can trigger the vulnerable code path to execute arbitrary code.

11) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

12) Use-after-free (CVE-ID: CVE-2026-63922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free risk from stale pointer reuse in ip6_parse_tlv() in net/ipv6/exthdrs.c when parsing IPv6 TLVs containing the HAO option. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

The issue occurs when handling a cloned skb where header expansion moves the skb head and invalidates the cached network header pointer.

13) Out-of-bounds read (CVE-ID: CVE-2022-50315)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/ata/ahci.h. A local user can perform a denial of service (DoS) attack.

14) Use-after-free (CVE-ID: CVE-2026-63802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.

The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.

15) Use-after-free (CVE-ID: CVE-2026-63831)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt data.

The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.

The issue can affect both RX and TX paths when skb data buffers are shared across clones.

16) Out-of-bounds read (CVE-ID: CVE-2026-53246)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause memory corruption.

The vulnerability exists due to an out-of-bounds read in sctp_unpack_cookie() and cached peer INIT chunk processing when processing a crafted COOKIE_ECHO chunk. A remote attacker can send a specially crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length to disclose sensitive information or cause memory corruption.

The issue occurs in a listening SCTP server while walking parameters from the cached peer INIT chunk embedded after the cookie.

17) Out-of-bounds read (CVE-ID: CVE-2026-53224)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in SCTP cookie processing in sctp_unpack_cookie(), sctp_process_init(), and sctp_raw_to_bind_addrs() when handling a malformed COOKIE_ECHO containing a truncated embedded INIT chunk or malformed address parameters. A remote attacker can send a specially crafted COOKIE_ECHO to cause a denial of service.

When cookie authentication is disabled, an oversized raw address list length can also be used to trigger the out-of-bounds read condition.

18) Integer overflow (CVE-ID: CVE-2026-52972)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the af_alg control message handler when processing a crafted associated data length value for AEAD operations. A local user can send a specially crafted message to cause a denial of service.

19) Out-of-bounds read (CVE-ID: CVE-2026-46149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.

When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.

20) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43493)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the pcrypt crypto subsystem when processing MAY_BACKLOG requests. A local user can trigger requests that return EBUSY to cause a denial of service.

21) Out-of-bounds read (CVE-ID: CVE-2026-43450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in nfnl_cthelper_dump_table() when handling netlink dump requests after a previously saved helper entry is deleted between dump rounds. A local user can trigger the affected dump logic to cause a denial of service.

The issue is triggered when the saved "last" helper is deleted between dump rounds, causing a restart path to bypass the loop bounds check.

22) Stack-based buffer overflow (CVE-ID: CVE-2026-43020)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth MGMT Long Term Key load and reply handling logic when processing a crafted management LTK record with an oversized enc_size value. A remote user can supply a specially crafted LTK record to overflow a reply stack buffer to cause a denial of service or execute arbitrary code.

23) Double free (CVE-ID: CVE-2025-68745)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the drivers/scsi/qla2xxx/qla_target.h. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2026:93047