Skip to content
OpenAdvisories
Critical RHSA-2026:1661 10 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Feb 2, 2026 · Updated Sep 27, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.100.1.rt7.441.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.100.1.rt7.441.el8_10

Vulnerabilities 10

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26766

    IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

    In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38024

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_descri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2022-50865

    tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-40322

    fbdev: bitblit: bound-check glyph index in bit_putcs*

    In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38415

    Squashfs: check return result of sb_min_blocksize

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38459

    atm: clip: Fix infinite recursive call of clip_push().

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273187
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373354
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383487
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419902
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426226
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1661.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-50865
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50865
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50865
  • article
    https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2024-26766
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-26766
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-26766
  • article
    https://lore.kernel.org/linux-cve-announce/2024040306-CVE-2024-26766-6b6a@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38022
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38022
  • article
    https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38024
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38024
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38024
  • article
    https://lore.kernel.org/linux-cve-announce/2025061847-CVE-2025-38024-2904@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38415
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38415
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38415
  • article
    https://lore.kernel.org/linux-cve-announce/2025072513-CVE-2025-38415-c634@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38459
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38459
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38459
  • article
    https://lore.kernel.org/linux-cve-announce/2025072507-CVE-2025-38459-e941@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39760
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39760