RHSA-2026:94558 — Security Advisory

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

• kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

• kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability ()

Bug Fix(es) and Enhancement(s):

• The Kernel panic occurred at strlen+0x0 because a race event filter treats the user space pointer as a normal pointer (JIRA:RHEL-291138)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.