This Red Hat security advisory addresses four vulnerabilities in the kernel-rt package for RHEL 7 Extended Lifecycle Support, rated Important. The flaws include issues in network traffic validation (CVE-2026-31684, CVSS 5.5), real-time mutex handling (CVE-2026-43499, CVSS 7.8), IPsec state management (CVE-2026-46116, CVSS 7.8), and futex operations (CVE-2026-53166). The update provides fixed packages for the affected RHEL 7 Real Time kernel, and a system reboot is required after applying the patch.
Red Hat Product Errata RHSA-2026:41234 - Security Advisory Issued: 2026-07-17 Updated: 2026-07-17 RHSA-2026:41234 - Security Advisory Overview Updated Packages Synopsis Important: kernel-rt security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64 Fixes BZ - 2461757 - CVE-2026-31684 kernel: net: sched: act_csum: validate nested VLAN headers BZ - 2480453 - CVE-2026-43499 kernel: rtmutex: Use waiter::task instead of current in remove_waiter() BZ - 2482523 - CVE-2026-46116 kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete BZ - 2492805 - CVE-2026-53166 kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock CVEs CVE-2026-31684 CVE-2026-43499 CVE-2026-46116 CVE-2026-53166 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 SRPM kernel-rt-3.10.0-1160.156.1.rt56.1308.el7.src.rpm SHA-256: 3cd0fb3a96055e288739d59e4b0473231c8a58f802c3582a5ca6ddf152fb0ef6 x86_64 kernel-rt-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 4adad10131921576f7177f627a783e6f12472537557a6b27c1dbb66b0f2ec1b4 kernel-rt-debug-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 8af61dff8c352d5f1222f4948fde78641db0270ea13011c2645963209d3a9106 kernel-rt-debug-debuginfo-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 40683dc84aa749bd3630307292884333081449a10b2962f762041e723908d2fe kernel-rt-debug-devel-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 87a265069154ad0fbbc467ca99c59dfcdaa01b2786af1524860f2062f5b9d811 kernel-rt-debuginfo-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 5bd1cd5884efd02ba4236f1938f37e696f3a87150dc81bdfa1d4389edf6df0fa kernel-rt-debuginfo-common-x86_64-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 569e6101c4cd9ed8a077046ec7b99e69598e65d513a8278a806682037f4d4124 kernel-rt-devel-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 2ef61dbb1f247de40d428b2078c47adffc02cc3aaca3cba0efaccce577692ec8 kernel-rt-doc-3.10.0-1160.156.1.rt56.1308.el7.noarch.rpm SHA-256: f459036b1ee710e02c3846fd23ccb99faa96705b05faffde7d7c6c1e113cff8a kernel-rt-trace-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 9e3e9d1cac60cb2e55b686825722f2104bd63a3219aff8d8a3b6c72f4b5d36c4 kernel-rt-trace-debuginfo-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: c5d2c285e48523ff935857c000ba53b7f96e5ad93616dcb453148916e9b18e0f kernel-rt-trace-devel-3.10.0-1160.156.1.rt56.1308.el7.x86_64.rpm SHA-256: 50b3f37e221e7ed2d02009848730df6f63966ca74009394fdd2919d9d8bcc544 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .