RLSA-2026:68532 (CVE-2026-23103)
Vulnerability from osv_rocky – Published: 2026-09-19 06:02 – Updated: 2026-09-19 18:13 – Source websiteThe kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
-
kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
-
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
-
kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
-
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
-
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
-
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
-
kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
-
kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
-
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
-
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
-
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
-
kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
-
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
-
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
-
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
-
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
-
kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
-
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
-
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
-
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
-
kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
-
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
-
kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:8",
"name": "kernel-rt",
"purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "NFV"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"database_specific": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:68532"
},
"details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n\n* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n\n* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n\n* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:68532",
"modified": "2026-09-19T18:13:17.275398Z",
"published": "2026-09-19T06:02:23.579834Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:68532"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436771"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467135"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492112"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492295"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492733"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492770"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502363"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513218"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516599"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: kernel-rt security update",
"upstream": [
"CVE-2026-23103",
"CVE-2026-31663",
"CVE-2026-43233",
"CVE-2026-43339",
"CVE-2026-46266",
"CVE-2026-46306",
"CVE-2026-52920",
"CVE-2026-53075",
"CVE-2026-53131",
"CVE-2026-53176",
"CVE-2026-53192",
"CVE-2026-53223",
"CVE-2026-53228",
"CVE-2026-53239",
"CVE-2026-53268",
"CVE-2026-53275",
"CVE-2026-63917",
"CVE-2026-63919",
"CVE-2026-63921",
"CVE-2026-64002",
"CVE-2026-68143",
"CVE-2026-68426",
"CVE-2026-72298"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.