Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-74561

A flaw was found in the Linux kernel, specifically within its nexthop component responsible for network routing. A timing issue, known as a race condition, allows the system to access memory after it has been freed. This occurs when the kernel attempts to flush its routing cache while other...

CVE-2026-74511

A flaw was found in the Linux kernel's Bluetooth management component. A race condition exists during Extended Inquiry Response EIR updates when the MGMTOPSETLOCALNAME operation is processed concurrently with modifications to the UUID list. This can lead to a use-after-free vulnerability in the...

CVE-2026-74503

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. An unprivileged local user with access to the /dev/snd/timer and /dev/snd/seq devices can exploit a race condition where a timer instance's SNDRVTIMERIFLGDEAD flag is not properly cleared after closing...

CVE-2026-74565

A flaw was found in the Linux kernel's netfilter subsystem. The global nature of the nftobject rhltable allows a local attacker to access objects that are being deallocated by other network namespaces. This can lead to a use-after-free vulnerability, potentially resulting in memory corruption or...

CVE-2026-74529

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization component. This vulnerability, a Use-After-Free UAF, occurs when a connection object is prematurely released while the hcisync task is still active. A local attacker could potentially exploit this to...

Important: Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update

An update for kpatch-patch-6120-211161 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-74562

A flaw was found in the Linux kernel's nexthop component. A race condition exists where internal lists are walked without proper locking during nexthop replacement and route deletion. A local attacker could exploit this by concurrently manipulating IPv6 routes, leading to a use-after-free...

CVE-2026-74528

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a use-after-free, occurs when the hcisync component improperly handles connection references, leading to the potential reuse and access of freed memory pointers. A remote attacker could exploit this to cause system...

CVE-2026-72069

A flaw was found in the Linux kernel. The rtspinunlock function, and similar real-time RT locking mechanisms, incorrectly release Read-Copy-Update RCU protection before fully unlocking, leading to a Use-After-Free UAF vulnerability. This issue could allow a local attacker to potentially cause a...

CVE-2026-74506

A flaw was found in the Linux kernel's AFS Andrew File System component. A race condition exists in the afsmakecall function during asynchronous call reception and destruction when sending a message. This can lead to a Use-After-Free UAF vulnerability, where memory is improperly accessed after it...

CVE-2026-74471

A flaw was found in the Linux kernel's tracing subsystem. The tracemoduleaddevents function does not properly check the return value of registerevent. If event registration fails, a pointer to an event can still be created and retained even after the associated module memory is freed. This can le...

CVE-2026-72220

A flaw was found in the Linux kernel's sunrpc component. When a worker thread processes a new request and encounters an early error, a stale release hook can be re-triggered against previously used data. This can lead to a double-free or use-after-free vulnerability, potentially allowing an...

CVE-2026-72042

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. An issue in the event delivery mechanism, specifically a reference count underflow, can lead to a use-after-free vulnerability. This occurs when a user's reference count is prematurely decremented...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-49306

UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49306

CVE-2026-49306 is described as a use-after-free (UAF) vulnerability in the time and time zone module, impacting availability. The available context references Huawei consumer device bulletins (laptops, vision, wearables), with a CVSS v3.1 base score of 3.3 (LOW) and an exploit vector limited to l...

CVE-2026-49306

UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...

BIT-NODE-MIN-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...