This Red Hat security advisory addresses multiple vulnerabilities in the kernel-rt for RHEL 9.2 Update Services for SAP Solutions, including a critical netfilter flaw (CVE-2026-43114, CVSS 9.4) that could allow improper data return and several high-severity issues leading to use-after-free, heap overflow, or access control bypasses in components like Bluetooth, IPv6, and USB serial. The affected kernel versions are detailed in the NVD data for each CVE, such as Linux kernel 5.7 through 6.6.136 for CVE-2026-43114. The update provides fixed packages requiring a system reboot; no workarounds are specified, and immediate patching is strongly advised due to the kernel's critical role.
Red Hat Product Errata RHSA-2026:67721 - Security Advisory Issued: 2026-09-16 Updated: 2026-09-16 RHSA-2026:67721 - Security Advisory Overview Updated Packages Synopsis Important: kernel-rt security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) kernel: packet: use consistent hard_header_len in non-ring send paths () Bug Fix(es) and Enhancement(s): RT scheduler livelock caused by missing backport of 94894c9c477e (JIRA:RHEL-244407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Affected Products Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Fixes BZ - 2466994 - CVE-2026-43114 kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry BZ - 2482024 - CVE-2026-45998 kernel: rxrpc: Fix potential UAF after skb_unshare() failure BZ - 2482025 - CVE-2026-46054 kernel: selinux: fix overlayfs mmap() and mprotect() access checks BZ - 2482181 - CVE-2026-46056 kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers BZ - 2492269 - CVE-2026-53016 kernel: crypto: ccp - copy IV using skcipher ivsize BZ - 2492363 - CVE-2026-53006 kernel: ipv6: fix possible UAF in icmpv6_rcv() BZ - 2492458 - CVE-2026-53071 kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp BZ - 2492750 - CVE-2026-53196 kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() BZ - 2502329 - CVE-2026-63886 kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode BZ - 2507119 - CVE-2026-64304 kernel: crypto: qat - validate RSA CRT component lengths BZ - 2519475 - kernel: packet: use consistent hard_header_len in non-ring send paths CVEs CVE-2026-43114 CVE-2026-45998 CVE-2026-46054 CVE-2026-46056 CVE-2026-53006 CVE-2026-53016 CVE-2026-53071 CVE-2026-53196 CVE-2026-63886 CVE-2026-64304 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.src.rpm SHA-256: c1c2545488c41c1a2d42efd6dcc055e940f453a8d97baa64ddd21a7ffdb96b4f x86_64 kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: a3956b240a10cfe36bb32b5b41814809193550777ee4d633713ab70947d25605 kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: a3956b240a10cfe36bb32b5b41814809193550777ee4d633713ab70947d25605 kernel-rt-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9c27ea3f0389aa220f49aab36e95f815050feb4d87cb7432f42c5c77ae285d0e kernel-rt-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9c27ea3f0389aa220f49aab36e95f815050feb4d87cb7432f42c5c77ae285d0e kernel-rt-debug-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: ddd5da16126b6715747eadfd6556878c1645f906107e193f24945cd463cb45a3 kernel-rt-debug-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: ddd5da16126b6715747eadfd6556878c1645f906107e193f24945cd463cb45a3 kernel-rt-debug-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9eafa313b5562103ee3a43d3a96cd79c16cff58deb3892201743fc0f524d2fc1 kernel-rt-debug-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9eafa313b5562103ee3a43d3a96cd79c16cff58deb3892201743fc0f524d2fc1 kernel-rt-debug-debuginfo-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: ca250628a883693a9ab319d97a04189337c91d7f25fc4019a9551865b7fd2a80 kernel-rt-debug-debuginfo-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: ca250628a883693a9ab319d97a04189337c91d7f25fc4019a9551865b7fd2a80 kernel-rt-debug-devel-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 953b4484e559f6c4d997568f24bb08411a732e842f8c4df6959e77df212ef840 kernel-rt-debug-devel-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 953b4484e559f6c4d997568f24bb08411a732e842f8c4df6959e77df212ef840 kernel-rt-debug-kvm-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 08e30c747baf32c1c540c7e858ad612fa59acf1434f80a38449b615782f62238 kernel-rt-debug-modules-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 048caf5f71102bd1f6a6876d1202b9e0442e321a3ebd346e46fee26cbe28282c kernel-rt-debug-modules-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 048caf5f71102bd1f6a6876d1202b9e0442e321a3ebd346e46fee26cbe28282c kernel-rt-debug-modules-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 3a8ae5851d9fb440f5f58ca0d95ba3da69349c98cb66e46487fa21f655d6a286 kernel-rt-debug-modules-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 3a8ae5851d9fb440f5f58ca0d95ba3da69349c98cb66e46487fa21f655d6a286 kernel-rt-debug-modules-extra-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: f4d7f3b81bc84ea71b6472fcdd30605b30708c03ee07bd3f4fab9c261f1ed1d8 kernel-rt-debug-modules-extra-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: f4d7f3b81bc84ea71b6472fcdd30605b30708c03ee07bd3f4fab9c261f1ed1d8 kernel-rt-debuginfo-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 8c5052d6cbb28a0d49daad63f67a7e905fb9b964dc379cac2340b53c01a491e9 kernel-rt-debuginfo-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 8c5052d6cbb28a0d49daad63f67a7e905fb9b964dc379cac2340b53c01a491e9 kernel-rt-debuginfo-common-x86_64-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: bd43945d4a1614de48910e52a2d7de6423410de47154d1076976b3443862255e kernel-rt-debuginfo-common-x86_64-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: bd43945d4a1614de48910e52a2d7de6423410de47154d1076976b3443862255e kernel-rt-devel-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 28529b5c1244f5292cf872810c0c07040db7a1e8e994e5734f6c738aa1da680c kernel-rt-devel-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 28529b5c1244f5292cf872810c0c07040db7a1e8e994e5734f6c738aa1da680c kernel-rt-kvm-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: d9e9a7b42eb4b3df1ad6888001bf4e6c350e18e5030b6078f41896e7e0de5b5b kernel-rt-modules-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: fc2ad230498b7a6dcaf379bc6cfcb24790cbaa04d61ef94f6d35b9f3fe93ef6c kernel-rt-modules-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: fc2ad230498b7a6dcaf379bc6cfcb24790cbaa04d61ef94f6d35b9f3fe93ef6c kernel-rt-modules-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: fb5e7c15fd7f8e992b1b46cbdbc0406264f7f88cdbef6f930d144d2dee115ab8 kernel-rt-modules-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: fb5e7c15fd7f8e992b1b46cbdbc0406264f7f88cdbef6f930d144d2dee115ab8 kernel-rt-modules-extra-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 2f3e7d5e9f71e6af3f07e473499cd530dab61a796ae873b4519446dfcf418495 kernel-rt-modules-extra-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 2f3e7d5e9f71e6af3f07e473499cd530dab61a796ae873b4519446dfcf418495 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 SRPM kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.src.rpm SHA-256: c1c2545488c41c1a2d42efd6dcc055e940f453a8d97baa64ddd21a7ffdb96b4f x86_64 kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: a3956b240a10cfe36bb32b5b41814809193550777ee4d633713ab70947d25605 kernel-rt-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: a3956b240a10cfe36bb32b5b41814809193550777ee4d633713ab70947d25605 kernel-rt-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9c27ea3f0389aa220f49aab36e95f815050feb4d87cb7432f42c5c77ae285d0e kernel-rt-core-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA-256: 9c27ea3f0389aa220f49aab36e95f815050feb4d87cb7432f42c5c77ae285d0e kernel-rt-debug-5.14.0-284.191.1.rt14.476.el9_2.x86_64.rpm SHA