Red Hat Product Errata RHSA-2026:59737 - Security Advisory Issued: 2026-08-26 Updated: 2026-08-26 RHSA-2026:59737 - Security Advisory Overview Updated Packages Synopsis Important: kernel-rt security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) Bug Fix(es) and Enhancement(s): [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088) SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800) ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for Real Time 8 x86_64 Red Hat Enterprise Linux for Real Time for NFV 8 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Fixes BZ - 2492095 - CVE-2026-52924 kernel: sctp: purge outqueue on stale COOKIE-ECHO handling BZ - 2502329 - CVE-2026-63886 kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode BZ - 2502438 - CVE-2026-63913 kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check BZ - 2502872 - CVE-2026-64191 kernel: i2c: stub: Reject I2C block transfers with invalid length BZ - 2502889 - CVE-2026-64189 kernel: netfilter: ipset: fix race between dump and ip_set_list resize BZ - 2507061 - CVE-2026-64320 kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page BZ - 2507290 - CVE-2026-64277 kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count BZ - 2507301 - CVE-2026-64276 kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count CVEs CVE-2026-52924 CVE-2026-63886 CVE-2026-63913 CVE-2026-64189 CVE-2026-64191 CVE-2026-64276 CVE-2026-64277 CVE-2026-64320 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for Real Time 8 SRPM kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.src.rpm SHA-256: fe9f0e1d77ab5d3f14ce73c2ff0f88e4e0e76d4734efa88221baaa4991e78b4f x86_64 kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 20f88af48e7f1ccf799ed8a31b2802b715009bf0f4ba1a80c0335780d57d5ec6 kernel-rt-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 3c1cb2098380a35db24e1cbd3d1a16e23211c881397fb142f5f329cbf1a8e59c kernel-rt-debug-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: bb6f6aba3c84a4b56422f476f0af5afc4a32097028bf155f923c4faa57fe0a76 kernel-rt-debug-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 2242cdce10fb687874b7f3ceee12c6b918336e13c1a8f5239d85672fc92382e0 kernel-rt-debug-debuginfo-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 53f95895bf60a6d084e2d157631c1334e6acbf2efa6dc66fc4b5820ed4102f7f kernel-rt-debug-devel-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: b2e94af62269f7a69d32c73d75df375960ddd7aba0b1a2656e93ec6d9ebeb6c1 kernel-rt-debug-modules-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: ffdfd640184e6035bee3dde9f49e55efeb761c97f9d575abd80658b2f53b552b kernel-rt-debug-modules-extra-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 331c4bcfc1626b6038ae2c63f3de439aeecdb222497b50a9f54bd1b9665d7f79 kernel-rt-debuginfo-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 0d3ea837fda7581eb581af2f8c58ed12a6994cbf0ef83e26e145067d7577a292 kernel-rt-debuginfo-common-x86_64-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 9b80f57b287559af0faa5e850117febc45fda25b96f7c68a2b0097bae2c7e925 kernel-rt-devel-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 5db69fd8d8985b5fcd803bc0d86f2ce31def63ffe05c1f2d5403a61e81708888 kernel-rt-modules-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: b948a0ba9f395a8f82de9992a2135dd047286f9f1cab7bce17f3df12a1690655 kernel-rt-modules-extra-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: d774051dedc03b0b7502a421edffff41dcb0b24e2654f2620db5d07738648b95 Red Hat Enterprise Linux for Real Time for NFV 8 SRPM kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.src.rpm SHA-256: fe9f0e1d77ab5d3f14ce73c2ff0f88e4e0e76d4734efa88221baaa4991e78b4f x86_64 kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 20f88af48e7f1ccf799ed8a31b2802b715009bf0f4ba1a80c0335780d57d5ec6 kernel-rt-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 3c1cb2098380a35db24e1cbd3d1a16e23211c881397fb142f5f329cbf1a8e59c kernel-rt-debug-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: bb6f6aba3c84a4b56422f476f0af5afc4a32097028bf155f923c4faa57fe0a76 kernel-rt-debug-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 2242cdce10fb687874b7f3ceee12c6b918336e13c1a8f5239d85672fc92382e0 kernel-rt-debug-debuginfo-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 53f95895bf60a6d084e2d157631c1334e6acbf2efa6dc66fc4b5820ed4102f7f kernel-rt-debug-devel-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: b2e94af62269f7a69d32c73d75df375960ddd7aba0b1a2656e93ec6d9ebeb6c1 kernel-rt-debug-kvm-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: d78485b1af46ea97bc4436e6c8b36f2ff48220781cc0a0401c9d812f3854b9de kernel-rt-debug-modules-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: ffdfd640184e6035bee3dde9f49e55efeb761c97f9d575abd80658b2f53b552b kernel-rt-debug-modules-extra-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 331c4bcfc1626b6038ae2c63f3de439aeecdb222497b50a9f54bd1b9665d7f79 kernel-rt-debuginfo-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 0d3ea837fda7581eb581af2f8c58ed12a6994cbf0ef83e26e145067d7577a292 kernel-rt-debuginfo-common-x86_64-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 9b80f57b287559af0faa5e850117febc45fda25b96f7c68a2b0097bae2c7e925 kernel-rt-devel-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 5db69fd8d8985b5fcd803bc0d86f2ce31def63ffe05c1f2d5403a61e81708888 kernel-rt-kvm-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 893720bc607d0a1750267cd4abe2273f7ee00cda97304237ab28775704f2f012 kernel-rt-modules-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: b948a0ba9f395a8f82de9992a2135dd047286f9f1cab7bce17f3df12a1690655 kernel-rt-modules-extra-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: d774051dedc03b0b7502a421edffff41dcb0b24e2654f2620db5d07738648b95 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.src.rpm SHA-256: fe9f0e1d77ab5d3f14ce73c2ff0f88e4e0e76d4734efa88221baaa4991e78b4f x86_64 kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 20f88af48e7f1ccf799ed8a31b2802b715009bf0f4ba1a80c0335780d57d5ec6 kernel-rt-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 20f88af48e7f1ccf799ed8a31b2802b715009bf0f4ba1a80c0335780d57d5ec6 kernel-rt-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 3c1cb2098380a35db24e1cbd3d1a16e23211c881397fb142f5f329cbf1a8e59c kernel-rt-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 3c1cb2098380a35db24e1cbd3d1a16e23211c881397fb142f5f329cbf1a8e59c kernel-rt-debug-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: bb6f6aba3c84a4b56422f476f0af5afc4a32097028bf155f923c4faa57fe0a76 kernel-rt-debug-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: bb6f6aba3c84a4b56422f476f0af5afc4a32097028bf155f923c4faa57fe0a76 kernel-rt-debug-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 2242cdce10fb687874b7f3ceee12c6b918336e13c1a8f5239d85672fc92382e0 kernel-rt-debug-core-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 2242cdce10fb687874b7f3ceee12c6b918336e13c1a8f5239d85672fc92382e0 kernel-rt-debug-debuginfo-4.18.0-553.158.1.rt7.499.el8_10.x86_64.rpm SHA-256: 53f95895bf60a6d084e2d157631c1334e6acbf2efa6dc66fc4b5820ed4102f7f kernel-rt-debug-debuginfo-4.18.0-553.158.1.rt7.499