Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
Bug Fix(es) and Enhancement(s):
* [Rocky Linux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-166118)
* ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:Rocky Linux-212398)
* [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [rhel-9.8.z] (JIRA:Rocky Linux-245333)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-687.42.1.el9_8 |
Vulnerabilities 13
-
Critical 9.8CVE-2026-52924 Public exploit
sctp: purge outqueue on stale COOKIE-ECHO handling
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …
-
Critical 9.8
net: ipv6: clear suppressed fib6 rule result
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule sup…
-
Critical 9.4
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…
-
Critical 9.4
netfilter: require Ethernet MAC header before using eth_hdr()
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…
-
High 8.3
netfilter: xt_policy: fix strict mode inbound policy matching
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…
-
High 8.2
netfilter: conntrack_irc: fix possible out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…
-
High 7.8
zram: fix use-after-free in zram_bvec_write_partial()
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…
-
High 7.8
netfilter: ipset: fix race between dump and ip_set_list resize
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…
-
High 7.8
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
Unscored —
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highl…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2422696
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2432681
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2466994
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492095
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492112
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492735
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492747
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492770
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502872
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502889
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507290
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507301
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2520980
-
advisory
https://access.redhat.com/errata/RHSA-2026:59723