Skip to content
OpenAdvisories
Critical RHSA-2026:94558 11 CVEs

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 14, 2026

Ecosystem: Red Hat

Fixed packages 32

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-debuginfo 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-devel 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-kvm 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debug-modules-extra 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debuginfo 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-devel 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-kvm 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::nfv kernel-rt-modules-extra 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-debuginfo 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-devel 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debug-modules-extra 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debuginfo 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-devel 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules-core 0:5.14.0-284.202.1.rt14.487.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::realtime kernel-rt-modules-extra 0:5.14.0-284.202.1.rt14.487.el9_2

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-64007

    netfilter: synproxy: refresh tcphdr after skb_ensure_writable

    In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64534

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-98432 Public exploit

    ipv4: free inet_opt and ireq_opt after an RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-43051

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-71066

    net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

    In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46259

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()

    In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53062

    dm cache policy smq: fix missing locks in invalidating cache blocks

    In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-89481

    nvme-tcp: fix host memory disclosure on R2T for a read command

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-53073

    Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-99284

    net: skbuff: propagate shared-frag marker in skb_zerocopy()

    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429036
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2484477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492278
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502361
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517010
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2532184
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553390
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559835
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94558.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-71066
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-71066
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-71066
  • article
    https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71066-f1fa@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-43051
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43051
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43051
  • article
    https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43051-0d15@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-46259
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46259
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46259
  • article
    https://lore.kernel.org/linux-cve-announce/2026060336-CVE-2026-46259-6c94@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53062
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53062
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53062
  • article
    https://lore.kernel.org/linux-cve-announce/2026062402-CVE-2026-53062-a727@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-53073
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53073
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53073
  • article
    https://lore.kernel.org/linux-cve-announce/2026062405-CVE-2026-53073-9692@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64007
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64007
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-64007
  • article
    https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64007-5e61@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-64534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-64534