Summary
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
Bug Fix(es) and Enhancement(s):
* [AlmaLinux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:AlmaLinux-178088)
* SELinux TCP/MPTCP connect check bypass via TCP Fast Open [almalinux-8.10.z] (JIRA:AlmaLinux-222800)
* ss core dumped when there is an SCTP session [almalinux-8.10.z] (JIRA:AlmaLinux-212400)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | kernel-rt | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-core | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-debug | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-debug-core | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-debug-devel | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-debug-modules | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-debug-modules-extra | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-devel | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-modules | 4.18.0-553.158.1.rt7.499.el8_10 |
| AlmaLinux · 8 | kernel-rt-modules-extra | 4.18.0-553.158.1.rt7.499.el8_10 |
Vulnerabilities 8
-
Critical 9.8CVE-2026-52924 Public exploit
sctp: purge outqueue on stale COOKIE-ECHO handling
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …
-
Critical 9.8
scsi: target: iscsi: Validate CHAP_R length before base64 decode
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…
-
Critical 9.1
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-b…
-
High 8.2
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…
-
High 7.8
netfilter: ipset: fix race between dump and ip_set_list resize
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…
-
High 7.8
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-52924
-
report
https://access.redhat.com/security/cve/CVE-2026-63886
-
report
https://access.redhat.com/security/cve/CVE-2026-63913
-
report
https://access.redhat.com/security/cve/CVE-2026-64189
-
report
https://access.redhat.com/security/cve/CVE-2026-64191
-
report
https://access.redhat.com/security/cve/CVE-2026-64276
-
report
https://access.redhat.com/security/cve/CVE-2026-64277
-
report
https://access.redhat.com/security/cve/CVE-2026-64320
-
report
https://bugzilla.redhat.com/2492095
-
report
https://bugzilla.redhat.com/2502329
-
report
https://bugzilla.redhat.com/2502438
-
report
https://bugzilla.redhat.com/2502872
-
report
https://bugzilla.redhat.com/2502889
-
report
https://bugzilla.redhat.com/2507061
-
report
https://bugzilla.redhat.com/2507290
-
report
https://bugzilla.redhat.com/2507301
-
advisory
https://errata.almalinux.org/8/ALSA-2026-59737.html