Summary
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)
* kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
* kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)
* kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)
* kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
* kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
* kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138)
* kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
* kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)
* kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
* kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
* kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
* kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
* kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
Bug Fix(es) and Enhancement(s):
* Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-8.10.z] (JIRA:Rocky Linux-280584)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | kernel-rt | 0:4.18.0-553.178.1.rt7.519.el8_10 |
Vulnerabilities 14
-
Critical 9.8
net: gro: fix double aggregation of flush-marked skbs
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive…
-
Critical 9.8
ipvs: reload ip header after head reallocation
In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.
-
Critical 9.8
mptcp: options: reset DSS fields in case of unexpected size
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…
-
Critical 9.3CVE-2026-99999 Public exploit
ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…
-
High 8.8
net/iucv: fix use-after-free of a severed iucv_path
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When th…
-
High 8.1
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is …
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ========================================…
-
High 7.8CVE-2026-68138 Public exploit
net/sched: serialize qdisc_rtab_list against concurrent get/put
In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int …
-
High 7.8
net/packet: avoid fanout hook re-registration after unregister
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous runni…
-
High 7.8
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a …
-
High 7.5
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socke…
-
Unscored —
tcp: restrict SO_ATTACH_FILTER to priv users
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel …
-
Unscored —
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492709
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502255
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507296
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513163
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513264
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513293
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513343
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516251
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516417
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2524438
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528642
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532122
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532515
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2553429
-
advisory
https://access.redhat.com/errata/RHSA-2026:89082