Skip to content
OpenAdvisories
Critical RHSA-2026:21745 19 CVEs

Red Hat Security Advisory: kernel-rt security update

Published May 29, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.126.1.rt7.467.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.126.1.rt7.467.el8_10

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-46195

    smb: client: validate dacloffset before building DACL pointers

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2025-71116

    libceph: make decode_pool() more resilient against corrupted osdmaps

    In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expect…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-31408

    Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-31709

    smb: client: validate the whole DACL before rewriting it in cifsacl

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incomin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-43051

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39981

    Bluetooth: MGMT: Fix possible UAFs

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-68183

    ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

    In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68347

    ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

    In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provide…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23243

    RDMA/umad: Reject negative data_len in ib_umad_write

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23270

    net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the curren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31532

    can: raw: fix ro->uniq use-after-free in raw_rcv()

    In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31684

    net: sched: act_csum: validate nested VLAN headers

    In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43020

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43027

    netfilter: nf_conntrack_helper: pass helper to expect cleanup

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43163

    md/bitmap: fix GPF in write_page caused by resize race

    In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404105
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422699
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424879
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429602
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448594
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448745
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455334
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464369
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464476
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467210
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21745.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-39981
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39981
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39981
  • article
    https://lore.kernel.org/linux-cve-announce/2025101559-CVE-2025-39981-fe1d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68183
  • article
    https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68183-f588@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-68347
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-68347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-68347
  • article
    https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2025-68347-74dd@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-71116
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71116
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71116
  • article
    https://lore.kernel.org/linux-cve-announce/2026011414-CVE-2025-71116-e57d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-23243
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23243
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23243