Skip to content
OpenAdvisories
Critical RHSA-2026:68532 23 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Sep 17, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.164.1.rt7.505.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.164.1.rt7.505.el8_10

Vulnerabilities 23

  • Critical 9.8
    CVE-2026-53176

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-53228

    ipv6: sit: reload inner IPv6 header after GSO offloads

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68426

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-53131

    netfilter: require Ethernet MAC header before using eth_hdr()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46266

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

    In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-53075 Public exploit

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

    In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-53275

    ipv6: mcast: Fix use-after-free when processing MLD queries

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63917

    ip6: vti: Use ip6_tnl.net in vti6_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63919

    xfrm: input: hold netns during deferred transport reinjection

    In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63921

    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-72298

    net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.3
    CVE-2026-52920

    netfilter: xt_policy: fix strict mode inbound policy matching

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43233

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-53268

    netfilter: conntrack_irc: fix possible out-of-bounds read

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23103

    ipvlan: Make the addrs_lock be per port

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31663

    xfrm: hold dev ref until after transport_finish NF_HOOK

    In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43339

    ipv6: prevent possible UaF in addrconf_permanent_addr()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53192

    ALSA: timer: Fix UAF at snd_timer_user_params()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53239

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64002

    ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68143

    net: slip: serialize receive against buffer reallocation

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46306

    flow_dissector: do not dissect PPPoE PFC frames

    In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-53223

    net: guard timestamp cmsgs to real error queue skbs

    In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436771
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467135
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468102
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484456
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2486463
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492112
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492295
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492733
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492741
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492747
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492770
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492779
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492811
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492841
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502434
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516599
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68532.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-23103
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-23103
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-23103
  • article
    https://lore.kernel.org/linux-cve-announce/2026020429-CVE-2026-23103-63b3@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-31663
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-31663
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-31663
  • article
    https://lore.kernel.org/linux-cve-announce/2026042404-CVE-2026-31663-164c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43233
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43233
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43233
  • article
    https://lore.kernel.org/linux-cve-announce/2026050657-CVE-2026-43233-e6b4@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43339
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43339