RLSA-2026:75746 (CVE-2022-50756)

Vulnerability from osv_rocky – Published: 2026-10-06 06:02 – Updated: 2026-10-06 12:15 – Source website
VLAI
Summary
Important: kernel-rt security, bug fix, and enhancement update
Details

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

  • kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

  • kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

  • kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

  • kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

  • kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

  • kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

  • kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

  • kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

  • kernel: gfs2: add some missing log locking (CVE-2026-53049)

  • kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

  • kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

  • kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

  • kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

  • kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

  • kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

  • kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

  • kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

  • kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

  • kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

  • kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

  • kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

  • kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

  • kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

  • kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

  • kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

  • kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

  • kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

  • kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

  • kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

  • Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

  • Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

  • [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Credits
Rocky Enterprise Software Foundation
Red Hat
References
https://errata.rockylinux.org/RLSA-2026:75746 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2404123 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2418819 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2425013 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2425209 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2436789 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2482129 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2482143 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2486979 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2492276 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2492364 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2492728 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2492853 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2502230 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2502241 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2502431 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2502444 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2514441 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2516306 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2516717 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2516998 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2517052 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2521375 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2524431 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2524483 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2531066 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2532184 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2535140 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2536346 REPORT
https://bugzilla.redhat.com/show_bug.cgi?id=2540479 REPORT
https://access.redhat.com/errata/RHSA-2026:75746 ADVISORY
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel-rt",
        "purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "NFV"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.171.1.rt7.512.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:75746"
  },
  "details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)\n\n* kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)\n\n* kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)\n\n* kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)\n\n* kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)\n\n* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)\n\n* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)\n\n* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)\n\n* kernel: gfs2: add some missing log locking (CVE-2026-53049)\n\n* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)\n\n* kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)\n\n* kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)\n\n* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)\n\n* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)\n\n* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)\n\n* kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)\n\n* kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)\n\n* kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)\n\n* kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)\n\n* kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)\n\n* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)\n\n* kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)\n\n* kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)\n\n* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)\n\n* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)\n\n* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)\n\n* kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)\n\n* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)\n\n* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)\n\nBug Fix(es) and Enhancement(s):\n\n* Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)\n\n* Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)\n\n* [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:75746",
  "modified": "2026-10-06T12:15:24.832748Z",
  "published": "2026-10-06T06:02:31.784980Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:75746"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404123"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418819"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425013"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425209"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436789"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482129"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482143"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486979"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492276"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492364"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492728"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492853"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502230"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502241"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502431"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502444"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514441"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516306"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516717"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516998"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517052"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521375"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524431"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524483"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531066"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532184"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535140"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536346"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540479"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:75746"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel-rt security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2022-50756",
    "CVE-2023-54048",
    "CVE-2025-39994",
    "CVE-2025-40242",
    "CVE-2026-23105",
    "CVE-2026-45856",
    "CVE-2026-45861",
    "CVE-2026-46319",
    "CVE-2026-52972",
    "CVE-2026-53049",
    "CVE-2026-53230",
    "CVE-2026-53270",
    "CVE-2026-63794",
    "CVE-2026-63829",
    "CVE-2026-63992",
    "CVE-2026-63994",
    "CVE-2026-68432",
    "CVE-2026-72052",
    "CVE-2026-72255",
    "CVE-2026-74516",
    "CVE-2026-74569",
    "CVE-2026-74669",
    "CVE-2026-74744",
    "CVE-2026-74746",
    "CVE-2026-80921",
    "CVE-2026-89481",
    "CVE-2026-89972",
    "CVE-2026-90227",
    "CVE-2026-97417"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.