Summary
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
* kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
* kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
* kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | kernel-rt | 0:4.18.0-553.132.1.rt7.473.el8_10 |
Vulnerabilities 13
-
Critical 9.8
libceph: prevent potential out-of-bounds reads in handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…
-
Critical 9.8
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…
-
Critical 9.8
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…
-
Critical 9.8
dlm: validate length in dlm_search_rsb_tree
In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…
-
High 8.1
smb: client: fix OOB reads parsing symlink error response
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…
-
High 7.8
smc: Fix use-after-free in tcp_write_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…
-
High 7.8
geneve: Fix use-after-free in geneve_find_dev().
In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…
-
High 7.8
netfilter: nf_tables: release flowtable after rcu grace period on error
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…
-
High 7.8
RDMA/rxe: Fix double free in rxe_srq_from_init
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…
-
High 7.8
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …
-
High 7.5
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …
-
Unscored —
nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…
-
Unscored —
ALSA: 6fire: fix use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2351619
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2420279
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2424881
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2432389
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2432400
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2451218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461471
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461480
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464351
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464397
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467234
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482166
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482532