RHSA-2026:0537 — Security Advisory

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638)

• kernel: smb: client: fix potential UAF in cifs_stats_proc_write() (CVE-2024-35868)

• kernel: Linux kernel: SCTP use-after-free due to race condition in sendmsg (CVE-2025-23142)

• kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

• kernel: smb: client: fix race with concurrent opens in rename(2) (CVE-2025-39825)

• kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)

• kernel: net/mlx5e: Check for NOT_READY flag state after locking (CVE-2023-53581)

• kernel: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

• kernel: scsi: ses: Fix possible desc_ptr out-of-bounds accesses (CVE-2023-53675)

• kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982)

• kernel: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CVE-2023-53705)

• kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287)

• kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.