Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2026:70403 20 CVEs

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Published Sep 23, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.166.1.rt7.507.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.166.1.rt7.507.el8_10

Vulnerabilities 20

  • High 7.8
    CVE-2025-39964 Exploited Public exploit

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-64534

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-46043

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-54120

    Bluetooth: Fix race condition in hidp_session_thread

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-54214

    Bluetooth: L2CAP: Fix potential user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which mak…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43334

    Bluetooth: SMP: force responder MITM requirements before building the pairing response

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-52918

    Bluetooth: serialize accept_q access

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchron…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53053

    iommu/amd: Fix clone_alias() to use the original device's devid

    In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63947

    Bluetooth: HIDP: fix missing length checks in hidp_input_report()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63975

    Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-53254

    Bluetooth: RFCOMM: validate skb length in MCC handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can sen…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.0
    CVE-2026-53256

    Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-71082

    Bluetooth: btusb: revert use of devm_kzalloc in btusb

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45894

    iommu/vt-d: Clear Present bit before tearing down PASID entry

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53062

    dm cache policy smq: fix missing locks in invalidating cache blocks

    In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63823

    keys: Pin request_key_auth payload in instantiate paths

    In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64582

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46133

    RDMA/rxe: Reject unknown opcodes before ICRC processing

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-68293

    net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68188

    Bluetooth: RFCOMM: Fix session UAF in set_termios

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2403545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425183
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426069
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468050
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481940
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482550
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492092
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492278
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492717
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492795
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502346
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502388
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513150
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513222
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70403.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-54120
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-54120
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-54120
  • article
    https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2023-54120-d966@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-54214
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-54214
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-54214
  • article
    https://lore.kernel.org/linux-cve-announce/2025123025-CVE-2023-54214-c4a6@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-39964
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-39964
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-39964
  • article
    https://lore.kernel.org/linux-cve-announce/2025101334-CVE-2025-39964-7964@gregkh/T
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2025-71082
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71082
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71082
  • article
    https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71082-ef8a@gregkh/T