RHSA-2026:67469HighCVSS 7.9

Red Hat Security Advisory: kernel-rt security update

Published
September 15, 2026
Last Modified
September 15, 2026

🔗 CVE IDs covered (12)

CVE-2024-53161 →CVE-2026-43133 →CVE-2026-53182 →CVE-2026-63802 →CVE-2026-63889 →CVE-2026-74556 →CVE-2025-71127 →CVE-2026-52947 →CVE-2026-64117 →CVE-2026-68294 →CVE-2026-68363 →CVE-2026-72098 →

📋 Description

CVE-2024-53161 — kernel: EDAC/bluefield: Fix potential integer overflow CVE-2025-71127 — kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2026-43133 — kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-52947 — kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove CVE-2026-53182 — kernel: wifi: nl80211: reject oversized EMA RNR lists CVE-2026-63802 — kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() CVE-2026-63889 — kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 CVE-2026-64117 — kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb CVE-2026-68294 — kernel: net: qrtr: restrict socket creation to the initial network namespace CVE-2026-68363 — kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash CVE-2026-72098 — kernel: dm-verity: fix buffer overflow in FEC calculation CVE-2026-74556 — kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

🎯 Affected products32

  • Red Hat Enterprise Linux NFV (v. 8)
  • Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.163.1.rt7.504.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.163.1.rt7.504.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-core-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-core-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-core-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-debuginfo-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-devel-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-kvm-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debug-modules-extra-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-devel-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-devel-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • kernel-rt-kvm-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)
  • kernel-rt-modules-0:4.18.0-553.163.1.rt7.504.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Workaround: To mitigate this issue, prevent module bluefield_edac from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, prevent the `qrtr` kernel module from loading. Create a file `/etc/modprobe.d/blacklist-qrtr.conf` with the content `blacklist qrtr`. A system reboot is required for this change to take effect. This may impact functionality that relies on the QRTR inter-process communication mechanism, such as communication with modems or other remote processors. Workaround: If iSCSI initiator functionality is not required, prevent the `libiscsi_tcp` kernel module from loading by blacklisting it. Create a file such as `/etc/modprobe.d/blacklist-iscsi.conf` with the content `blacklist libiscsi_tcp`. A system reboot is required for this change to take effect. This may impact systems relying on iSCSI storage.

🔗 References (15)