RHSA-2026:75746 - Security Advisory

Topic

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• RHEL8.10 - s390/vfio_ccw: Error path cleanups (JIRA:RHEL-252194)
• RHEL8.10 - s390/topology: Use zero-based numbering (JIRA:RHEL-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:RHEL-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.

Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.

Affected Products

• Red Hat Enterprise Linux for Real Time 8 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64

Fixes

• BZ - 2404123 - CVE-2025-39994 kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition
• BZ - 2418819 - CVE-2025-40242 kernel: gfs2: Fix unlikely race in gdlm_put_lock
• BZ - 2425013 - CVE-2023-54048 kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction
• BZ - 2425209 - CVE-2022-50756 kernel: nvme-pci: fix mempool alloc size
• BZ - 2436789 - CVE-2026-23105 kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation
• BZ - 2482129 - CVE-2026-45856 kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
• BZ - 2482143 - CVE-2026-45861 kernel: gfs2: Fix slab-use-after-free in qd_put
• BZ - 2486979 - CVE-2026-46319 kernel: net/sched: act_ct: Only release RCU read lock after ct_ft
• BZ - 2492276 - CVE-2026-53049 kernel: gfs2: add some missing log locking
• BZ - 2492364 - CVE-2026-52972 kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000
• BZ - 2492728 - CVE-2026-53230 kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
• BZ - 2492853 - CVE-2026-53270 kernel: ipvs: clear the svc scheduler ptr early on edit
• BZ - 2502230 - CVE-2026-63829 kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2502241 - CVE-2026-63794 kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
• BZ - 2502431 - CVE-2026-63992 kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
• BZ - 2502444 - CVE-2026-63994 kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
• BZ - 2514441 - CVE-2026-68432 kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2516306 - CVE-2026-72052 kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
• BZ - 2516717 - CVE-2026-72255 kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
• BZ - 2516998 - CVE-2026-74516 kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
• BZ - 2517052 - CVE-2026-74569 kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
• BZ - 2521375 - CVE-2026-74669 kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• BZ - 2524431 - CVE-2026-74744 kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• BZ - 2524483 - CVE-2026-74746 kernel: netfilter: flowtable: publish GC-visible tuple last
• BZ - 2531066 - CVE-2026-80921 kernel: KVM: s390: vsie: zero stale crypto bits
• BZ - 2532184 - CVE-2026-89481 kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
• BZ - 2535140 - CVE-2026-89972 kernel: nvme: add missing SRCU grace period in error path
• BZ - 2536346 - CVE-2026-90227 kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
• BZ - 2540479 - CVE-2026-97417 kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

CVEs

• CVE-2022-50756
• CVE-2023-54048
• CVE-2025-39994
• CVE-2025-40242
• CVE-2026-23105
• CVE-2026-45856
• CVE-2026-45861
• CVE-2026-46319
• CVE-2026-52972
• CVE-2026-53049
• CVE-2026-53230
• CVE-2026-53270
• CVE-2026-63794
• CVE-2026-63829
• CVE-2026-63992
• CVE-2026-63994
• CVE-2026-68432
• CVE-2026-72052
• CVE-2026-72255
• CVE-2026-74516
• CVE-2026-74569
• CVE-2026-74669
• CVE-2026-74744
• CVE-2026-74746
• CVE-2026-80921
• CVE-2026-89481
• CVE-2026-89972
• CVE-2026-90227
• CVE-2026-97417

References

• https://access.redhat.com/security/updates/classification/#important