Skip to content
OpenAdvisories
High RLSA-2026:67469 12 CVEs

Important: kernel-rt security update

Published Sep 16, 2026 · Updated Sep 16, 2026

Ecosystem: Rocky Linux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)

* kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)

* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

* kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

* kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

* kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

* kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 kernel-rt 0:4.18.0-553.163.1.rt7.504.el8_10

Vulnerabilities 12

  • Critical 9.8
    CVE-2026-72098

    dm-verity: fix buffer overflow in FEC calculation

    In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64117

    wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee802…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-63889

    scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.9
    CVE-2026-43133

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52947

    net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53182

    wifi: nl80211: reject oversized EMA RNR lists

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-63802

    blk-cgroup: fix UAF in __blkcg_rstat_flush()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-71127

    wifi: mac80211: Discard Beacon frames to non-broadcast address

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-53161

    EDAC/bluefield: Fix potential integer overflow

    In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2333977
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467065
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492432
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492722
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502320
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513286
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516501
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517010
  • advisory
    https://access.redhat.com/errata/RHSA-2026:67469