Red Hat Security Advisory: kernel-rt security update

The Red Hat kernel-rt packages, providing a Real Time Linux Kernel, have multiple security vulnerabilities fixed in this advisory. The fixes address: CVE-2025-68183, where the IMA_DIGSIG flag was improperly cleared when setting or removing non-IMA extended attributes; CVE-2026-31408, a use-after-free in Bluetooth SCO due to missing sock_hold; CVE-2026-43198, a potential race condition in tcp_v6_syn_recv_sock(); CVE-2026-46189, a double free on pvrdma_alloc_ucontext() error path in RDMA/vmw_pvrdma; and CVE-2026-46135, a race condition between ICReq handling and queue teardown in nvmet-tcp. These vulnerabilities could impact kernel stability and security in real-time environments. The advisory references Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle 9.2 x86_64 as affected products. The update requires a reboot to apply.

The vulnerabilities fixed include use-after-free, race conditions, and double free errors in critical kernel components related to real-time processing, Bluetooth, TCP networking, and RDMA. These issues could lead to kernel crashes, denial of service, or potentially other security impacts in systems using the affected kernel-rt versions. The advisory rates the overall security impact as Important (high severity).

Red Hat has released an official security update for kernel-rt addressing these vulnerabilities. Users should apply the update as provided by Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle 9.2 x86_64. A system reboot is required for the update to take effect. No additional mitigation steps are indicated beyond applying the official update.