Skip to content
OpenAdvisories
High RLSA-2026:67470 7 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 16, 2026 · Updated Sep 16, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

* kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

* kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)

* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

* kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045)

* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

* gfs2: bufdata leaks [rhel-9.8.z] (JIRA:Rocky Linux-178223)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 kernel 0:5.14.0-687.48.1.el9_8

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63923

    octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-72045

    octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LM…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43248

    vhost: move vdpa group bound check to vhost_vdpa

    In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in v…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64015

    security/keys: fix missed RCU read section on lookup

    In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68143

    net: slip: serialize receive against buffer reallocation

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2467084
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502380
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502418
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2516639
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517010
  • advisory
    https://access.redhat.com/errata/RHSA-2026:67470