Skip to content
OpenAdvisories
Critical RHSA-2026:2583 9 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Feb 12, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 32

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-debuginfo 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-devel 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-kvm 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules-extra 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debuginfo 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-devel 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-kvm 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules-extra 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-debuginfo 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-devel 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules-extra 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debuginfo 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-devel 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules-core 0:5.14.0-284.156.1.rt14.441.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules-extra 0:5.14.0-284.156.1.rt14.441.el9_2

Vulnerabilities 9

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-53673

    Bluetooth: hci_event: call disconnect callback before deleting conn

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38051

    smb: client: Fix use-after-free in cifs_fill_dirent

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40096

    drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

    In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on su…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40251

    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

    In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40304

    fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

    In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-40322

    fbdev: bitblit: bound-check glyph index in bit_putcs*

    In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53833

    drm/i915: Fix NULL ptr deref by checking new_crtc_state

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373326
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373329
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2407333
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418892
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419902
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420366
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2583.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-53673
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53673
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53673
  • article
    https://lore.kernel.org/linux-cve-announce/2025100706-CVE-2023-53673-36b9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53833
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53833
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53833
  • article
    https://lore.kernel.org/linux-cve-announce/2025120954-CVE-2023-53833-09d9@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38022
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38022
  • article
    https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-38051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-38051
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-38051
  • article
    https://lore.kernel.org/linux-cve-announce/2025061831-CVE-2025-38051-77da@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40096
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40096
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40096
  • article
    https://lore.kernel.org/linux-cve-announce/2025103016-CVE-2025-40096-09cc@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40251
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40251
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40251
  • article
    https://lore.kernel.org/linux-cve-announce/2025120431-CVE-2025-40251-7db7@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-40258
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40258
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40258
  • article
    https://lore.kernel.org/linux-cve-announce/2025120433-CVE-2025-40258-d10d@gregkh/T