Skip to content
OpenAdvisories
Critical RHSA-2026:98100 10 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-core 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-core 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-debuginfo 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-devel 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-kvm 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debug-modules-extra 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-devel 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-kvm 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::nfv kernel-rt-modules-extra 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-core 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-core 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-debuginfo 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-devel 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debug-modules-extra 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-debuginfo-common-x86_64 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-devel 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules 0:4.18.0-553.185.1.rt7.526.el8_10
Red Hat · RHEL 8 enterprise_linux:8::realtime kernel-rt-modules-extra 0:4.18.0-553.185.1.rt7.526.el8_10

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-68123

    openvswitch: fix GSO userspace truncation underflow

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-99153

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46330

    Revert "net/smc: Introduce TCP ULP support"

    In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68398 Public exploit

    ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

    In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74510

    Bluetooth: mgmt: fix UAF in pair command cancellation

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-90207

    ALSA: seq: midi: Serialize input teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98116

    ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

    In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-99152

    scsi: libiscsi: Validate the task named by a management response

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80842

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98403

    s390/boot: Avoid IPL parameter append past command line

    In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2486999
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513188
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513451
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516970
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528639
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2536701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2541360
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552209
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2562706
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98100.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-46330
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46330
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46330
  • article
    https://lore.kernel.org/linux-cve-announce/2026060910-CVE-2026-46330-28d2@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68123
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68123
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68123
  • article
    https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-68398
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68398
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68398
  • article
    https://lore.kernel.org/linux-cve-announce/2026081048-CVE-2026-68398-ca73@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-74510
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-74510
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-74510
  • article
    https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74510-f610@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2026-80842
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-80842
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-80842
  • article
    https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80842.mbox
  • report
    https://access.redhat.com/security/cve/CVE-2026-90207
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-90207
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-90207
  • article
    https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90207.mbox
  • report
    https://access.redhat.com/security/cve/CVE-2026-98116
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-98116
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-98116