RHSA-2026:93047 — Security Advisory

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (CVE-2022-50315)

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

• kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

• kernel: Linux kernel: xfrm single-frag length not properly limited ()

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224)

• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

• kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

• kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

• kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

• kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

• kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

• kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

• kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

• kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

Bug Fix(es) and Enhancement(s):

• BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 (JIRA:RHEL-242997)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.