Skip to content
OpenAdvisories
High 1 exploited CVE RLSA-2026:70498 12 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 24, 2026 · Updated Sep 24, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

* kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

* Update kernel to use new certificate paths [rhel-10.2.z] (JIRA:Rocky Linux-169478)

* RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:Rocky Linux-255517)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 kernel 0:6.12.0-211.58.1.el10_2

Vulnerabilities 12

  • High 7.8
    CVE-2025-39964 Exploited Public exploit

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-64534

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-68159

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45894

    iommu/vt-d: Clear Present bit before tearing down PASID entry

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45959

    crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` at…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53062

    dm cache policy smq: fix missing locks in invalidating cache blocks

    In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63823

    keys: Pin request_key_auth payload in instantiate paths

    In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68391

    Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74518

    mm/hugetlb: fix list corruption in allocate_file_region_entries()

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-68155

    libceph: Reject monmaps advertising zero monitors

    In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-68293

    net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68188

    Bluetooth: RFCOMM: Fix session UAF in set_termios

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2403545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481940
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481948
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2492278
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513150
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513165
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513222
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513295
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513453
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517004
  • advisory
    https://access.redhat.com/errata/RHSA-2026:70498