RHSA-2026:68532 - Security Advisory

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
• kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
• kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
• kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
• kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
• kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
• kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
• kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
• kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for Real Time 8 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64

Fixes

• BZ - 2436771 - CVE-2026-23103 kernel: ipvlan: Make the addrs_lock be per port
• BZ - 2461462 - CVE-2026-31663 kernel: xfrm: hold dev ref until after transport_finish NF_HOOK
• BZ - 2467135 - CVE-2026-43233 kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
• BZ - 2468102 - CVE-2026-43339 kernel: ipv6: prevent possible UaF in addrconf_permanent_addr()
• BZ - 2484456 - CVE-2026-46266 kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
• BZ - 2486463 - CVE-2026-46306 kernel: flow_dissector: do not dissect PPPoE PFC frames
• BZ - 2492112 - CVE-2026-52920 kernel: netfilter: xt_policy: fix strict mode inbound policy matching
• BZ - 2492295 - CVE-2026-53075 kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
• BZ - 2492733 - CVE-2026-53228 kernel: ipv6: sit: reload inner IPv6 header after GSO offloads
• BZ - 2492741 - CVE-2026-53176 kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
• BZ - 2492747 - CVE-2026-53131 kernel: netfilter: require Ethernet MAC header before using eth_hdr()
• BZ - 2492770 - CVE-2026-53268 kernel: netfilter: conntrack_irc: fix possible out-of-bounds read
• BZ - 2492779 - CVE-2026-53239 kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
• BZ - 2492792 - CVE-2026-53192 kernel: ALSA: timer: Fix UAF at snd_timer_user_params()
• BZ - 2492811 - CVE-2026-53223 kernel: net: guard timestamp cmsgs to real error queue skbs
• BZ - 2492841 - CVE-2026-53275 kernel: ipv6: mcast: Fix use-after-free when processing MLD queries
• BZ - 2502363 - CVE-2026-64002 kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
• BZ - 2502368 - CVE-2026-63921 kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
• BZ - 2502412 - CVE-2026-63919 kernel: xfrm: input: hold netns during deferred transport reinjection
• BZ - 2502434 - CVE-2026-63917 kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()
• BZ - 2513218 - CVE-2026-68143 kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change
• BZ - 2513477 - CVE-2026-68426 kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment
• BZ - 2516599 - CVE-2026-72298 kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

CVEs

• CVE-2026-23103
• CVE-2026-31663
• CVE-2026-43233
• CVE-2026-43339
• CVE-2026-46266
• CVE-2026-46306
• CVE-2026-52920
• CVE-2026-53075
• CVE-2026-53131
• CVE-2026-53176
• CVE-2026-53192
• CVE-2026-53223
• CVE-2026-53228
• CVE-2026-53239
• CVE-2026-53268
• CVE-2026-53275
• CVE-2026-63917
• CVE-2026-63919
• CVE-2026-63921
• CVE-2026-64002
• CVE-2026-68143
• CVE-2026-68426
• CVE-2026-72298

References

• https://access.redhat.com/security/updates/classification/#important