RHSA-2026:70402 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)
• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:RHEL-243217)
• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:RHEL-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

• BZ - 2403545 - CVE-2025-39964 kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
• BZ - 2425183 - CVE-2023-54120 kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread
• BZ - 2426069 - CVE-2023-54214 kernel: Bluetooth: L2CAP: Fix potential user-after-free
• BZ - 2429054 - CVE-2025-71082 kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb
• BZ - 2468050 - CVE-2026-43334 kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response
• BZ - 2481940 - CVE-2026-45894 kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry
• BZ - 2482127 - CVE-2026-46043 kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
• BZ - 2482550 - CVE-2026-46133 kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing
• BZ - 2492092 - CVE-2026-52918 kernel: Bluetooth: serialize accept_q access
• BZ - 2492278 - CVE-2026-53062 kernel: dm cache policy smq: fix missing locks in invalidating cache blocks
• BZ - 2492310 - CVE-2026-53053 kernel: iommu/amd: Fix clone_alias() to use the original device's devid
• BZ - 2492717 - CVE-2026-53256 kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
• BZ - 2492795 - CVE-2026-53254 kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers
• BZ - 2502218 - CVE-2026-63823 kernel: keys: Pin request_key_auth payload in instantiate paths
• BZ - 2502346 - CVE-2026-63975 kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
• BZ - 2502388 - CVE-2026-63947 kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()
• BZ - 2507399 - CVE-2026-64534 kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
• BZ - 2511448 - CVE-2026-64582 kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• BZ - 2513150 - CVE-2026-68293 kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
• BZ - 2513222 - CVE-2026-68188 kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

CVEs

• CVE-2023-54120
• CVE-2023-54214
• CVE-2025-39964
• CVE-2025-71082
• CVE-2026-43334
• CVE-2026-45894
• CVE-2026-46043
• CVE-2026-46133
• CVE-2026-52918
• CVE-2026-53053
• CVE-2026-53062
• CVE-2026-53254
• CVE-2026-53256
• CVE-2026-63823
• CVE-2026-63947
• CVE-2026-63975
• CVE-2026-64534
• CVE-2026-64582
• CVE-2026-68188
• CVE-2026-68293

References

• https://access.redhat.com/security/updates/classification/#important