This advisory addresses multiple vulnerabilities in the Red Hat Enterprise Linux 8 Real Time Kernel (kernel-rt), including a high-severity use-after-free flaw in the netfilter ctnetlink component (CVE-2026-43116, CVSS 7.8) and a high-severity flaw in fanotify (CVE-2026-46150, CVSS 7.1). The vulnerabilities affect a wide range of upstream Linux kernel versions, with CVE-2026-46150 impacting versions from 4.12 through 6.12.88, for example. Red Hat has released a security update for the kernel-rt packages, and a system reboot is required for the patch to take effect.
Red Hat Product Errata RHSA-2026:49213 - Security Advisory Issued: 2026-07-31 Updated: 2026-07-31 RHSA-2026:49213 - Security Advisory Overview Updated Packages Synopsis Important: kernel-rt security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) kernel: fanotify: fix false positive on permission events (CVE-2026-46150) kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for Real Time 8 x86_64 Red Hat Enterprise Linux for Real Time for NFV 8 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Fixes BZ - 2464093 - CVE-2026-31692 kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns BZ - 2467005 - CVE-2026-43116 kernel: netfilter: ctnetlink: ensure safe access to master conntrack BZ - 2482612 - CVE-2026-46150 kernel: fanotify: fix false positive on permission events BZ - 2504052 - CVE-2026-64530 kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle BZ - 2507345 - kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle CVEs CVE-2026-31692 CVE-2026-43116 CVE-2026-46150 CVE-2026-64530 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for Real Time 8 SRPM kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.src.rpm SHA-256: dfe235a1bf142581baae1674859610be3a12a6fccc42315bef95f8a246cfe522 x86_64 kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: abea029f07f14ae45e73a8474a82cfb02ffb081be55e52a0122ca0bcaa06f661 kernel-rt-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c7a313f2093a730b9e4e00d576e539d200272cac8f785e05fb1c2fe230580c40 kernel-rt-debug-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: ec9a6772a7843aded5ea3dd299efa33c71031e49f9dd435356a5f7166763adf3 kernel-rt-debug-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 6691cee1876cfb4ef1fad028859efce44331cebf73d7d3bff95ef8e902cc6821 kernel-rt-debug-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: e0baec8ca180067d0d7bf905d6ec97703d727cfc0192471190bfffd80cc13bbf kernel-rt-debug-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0aebe32c19d0a28d532552ded0df5251a421fb8726b98c6a26e8125f3a93089e kernel-rt-debug-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c3f38a80a361f6e39c4f91dc2f00ba31664b3e3df5415a45521356cd20839bc2 kernel-rt-debug-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c4180fe414ee0aec3cf0605152b42893489a7c4943a9984eab69bc9a06e11725 kernel-rt-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 58683fb54d79d65de0baad64332725fd0c257ceafdfef6e846d2a45734f4bcb7 kernel-rt-debuginfo-common-x86_64-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 7f3815abee03400f1d1ae33134990e96bd8d869622577f671dd8d8b69e0a9871 kernel-rt-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 9c6177ea45123a205c7c2e5e660288f7a3d00c6c3ed8e25cce7e360e2407a32a kernel-rt-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0d9845991bcc88a6ab29a9d8ae9e12a40e09a410d06ab07433e3421b810f700c kernel-rt-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: f3f1c09ead9178e5f4f1c8937deceea72c8da51757d4d2b776d3df6a2f6e8541 Red Hat Enterprise Linux for Real Time for NFV 8 SRPM kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.src.rpm SHA-256: dfe235a1bf142581baae1674859610be3a12a6fccc42315bef95f8a246cfe522 x86_64 kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: abea029f07f14ae45e73a8474a82cfb02ffb081be55e52a0122ca0bcaa06f661 kernel-rt-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c7a313f2093a730b9e4e00d576e539d200272cac8f785e05fb1c2fe230580c40 kernel-rt-debug-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: ec9a6772a7843aded5ea3dd299efa33c71031e49f9dd435356a5f7166763adf3 kernel-rt-debug-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 6691cee1876cfb4ef1fad028859efce44331cebf73d7d3bff95ef8e902cc6821 kernel-rt-debug-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: e0baec8ca180067d0d7bf905d6ec97703d727cfc0192471190bfffd80cc13bbf kernel-rt-debug-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0aebe32c19d0a28d532552ded0df5251a421fb8726b98c6a26e8125f3a93089e kernel-rt-debug-kvm-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 601c9684d95d9ffaa25d746b34fdb3a6d22e0f6699051ebdde5286f9c96a6320 kernel-rt-debug-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c3f38a80a361f6e39c4f91dc2f00ba31664b3e3df5415a45521356cd20839bc2 kernel-rt-debug-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c4180fe414ee0aec3cf0605152b42893489a7c4943a9984eab69bc9a06e11725 kernel-rt-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 58683fb54d79d65de0baad64332725fd0c257ceafdfef6e846d2a45734f4bcb7 kernel-rt-debuginfo-common-x86_64-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 7f3815abee03400f1d1ae33134990e96bd8d869622577f671dd8d8b69e0a9871 kernel-rt-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 9c6177ea45123a205c7c2e5e660288f7a3d00c6c3ed8e25cce7e360e2407a32a kernel-rt-kvm-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 8224b6c4e3ba9c121bef8f8351dacab955fd4ec6e7f6f68e6277fa74918265c6 kernel-rt-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0d9845991bcc88a6ab29a9d8ae9e12a40e09a410d06ab07433e3421b810f700c kernel-rt-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: f3f1c09ead9178e5f4f1c8937deceea72c8da51757d4d2b776d3df6a2f6e8541 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.src.rpm SHA-256: dfe235a1bf142581baae1674859610be3a12a6fccc42315bef95f8a246cfe522 x86_64 kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: abea029f07f14ae45e73a8474a82cfb02ffb081be55e52a0122ca0bcaa06f661 kernel-rt-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: abea029f07f14ae45e73a8474a82cfb02ffb081be55e52a0122ca0bcaa06f661 kernel-rt-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c7a313f2093a730b9e4e00d576e539d200272cac8f785e05fb1c2fe230580c40 kernel-rt-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c7a313f2093a730b9e4e00d576e539d200272cac8f785e05fb1c2fe230580c40 kernel-rt-debug-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: ec9a6772a7843aded5ea3dd299efa33c71031e49f9dd435356a5f7166763adf3 kernel-rt-debug-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: ec9a6772a7843aded5ea3dd299efa33c71031e49f9dd435356a5f7166763adf3 kernel-rt-debug-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 6691cee1876cfb4ef1fad028859efce44331cebf73d7d3bff95ef8e902cc6821 kernel-rt-debug-core-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 6691cee1876cfb4ef1fad028859efce44331cebf73d7d3bff95ef8e902cc6821 kernel-rt-debug-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: e0baec8ca180067d0d7bf905d6ec97703d727cfc0192471190bfffd80cc13bbf kernel-rt-debug-debuginfo-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: e0baec8ca180067d0d7bf905d6ec97703d727cfc0192471190bfffd80cc13bbf kernel-rt-debug-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0aebe32c19d0a28d532552ded0df5251a421fb8726b98c6a26e8125f3a93089e kernel-rt-debug-devel-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 0aebe32c19d0a28d532552ded0df5251a421fb8726b98c6a26e8125f3a93089e kernel-rt-debug-kvm-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: 601c9684d95d9ffaa25d746b34fdb3a6d22e0f6699051ebdde5286f9c96a6320 kernel-rt-debug-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c3f38a80a361f6e39c4f91dc2f00ba31664b3e3df5415a45521356cd20839bc2 kernel-rt-debug-modules-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c3f38a80a361f6e39c4f91dc2f00ba31664b3e3df5415a45521356cd20839bc2 kernel-rt-debug-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_64.rpm SHA-256: c4180fe414ee0aec3cf0605152b42893489a7c4943a9984eab69bc9a06e11725 kernel-rt-debug-modules-extra-4.18.0-553.150.1.rt7.491.el8_10.x86_6