Skip to content
OpenAdvisories
High 1 exploited CVE RLSA-2026:70403 20 CVEs

Important: kernel-rt security, bug fix, and enhancement update

Published Sep 24, 2026 · Updated Sep 24, 2026

Ecosystem: Rocky Linux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

* kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)

* kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

* kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)

* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

* kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

* kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

* kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

* kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

* kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

* kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

* Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

* xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 kernel-rt 0:4.18.0-553.166.1.rt7.507.el8_10

Vulnerabilities 20

  • High 7.8
    CVE-2025-39964 Exploited Public exploit

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-64534

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-46043

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-54120

    Bluetooth: Fix race condition in hidp_session_thread

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-54214

    Bluetooth: L2CAP: Fix potential user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which mak…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43334

    Bluetooth: SMP: force responder MITM requirements before building the pairing response

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-52918

    Bluetooth: serialize accept_q access

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchron…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53053

    iommu/amd: Fix clone_alias() to use the original device's devid

    In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63947

    Bluetooth: HIDP: fix missing length checks in hidp_input_report()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63975

    Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-53254

    Bluetooth: RFCOMM: validate skb length in MCC handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can sen…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.0
    CVE-2026-53256

    Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-71082

    Bluetooth: btusb: revert use of devm_kzalloc in btusb

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45894

    iommu/vt-d: Clear Present bit before tearing down PASID entry

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53062

    dm cache policy smq: fix missing locks in invalidating cache blocks

    In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63823

    keys: Pin request_key_auth payload in instantiate paths

    In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64582

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46133

    RDMA/rxe: Reject unknown opcodes before ICRC processing

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-68293

    net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68188

    Bluetooth: RFCOMM: Fix session UAF in set_termios

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2403545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425183
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426069
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2429054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2468050
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481940
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482550
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492092
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492278
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492717
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492795
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502346
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502388
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2511448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513150
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513222
  • advisory
    https://access.redhat.com/errata/RHSA-2026:70403