CVE-2026-31692VulnerabilityPublished 31 Jul 2026Updated 29 Oct 2026

Red Hat Security Advisory: kernel-rt security update

Affects Linux kernelSource GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 29 Oct 2026, 07:28 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 31 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Red Hat has released updated kernel-rt packages that fix the described vulnerabilities. Users should apply the security update promptly and reboot their systems to ensure the fixes take effect. Red Hat recommends treating all kernel errata as security-relevant and advises against delaying updates to avoid exposure. Detailed update instructions are available in the Red Hat advisory. No additional mitigations are specified beyond applying the official patch and rebooting.

Description

Red Hat has issued a security advisory for kernel-rt, the Real Time Linux Kernel used in Red Hat Enterprise Linux 8. The update addresses multiple vulnerabilities including missing capability checks, unsafe access to connection tracking, false positives in permission events, and a use-after-free condition in network scheduling code. These issues could impact system security due to the kernel's critical role. The advisory rates the update as Important and recommends applying the patch and rebooting the system. No CVSS scores are provided, but the severity is considered high. The update affects Red Hat Enterprise Linux for Real Time 8 and related variants.

Impact

The vulnerabilities affect the kernel-rt, which is critical for systems requiring real-time performance and determinism. Exploitation could lead to privilege escalation, denial of service, or incorrect permission handling. Given the kernel's fundamental role, these issues pose a significant security risk. The advisory rates the impact as Important (high severity). No known exploits in the wild are reported at this time.

Summary

This advisory covers security fixes in the kernel-rt packages for Red Hat Enterprise Linux 8 Real Time variants. The vulnerabilities addressed include CVE-2026-31692 (missing netlink_ns_capable() check in rtnetlink), CVE-2026-43116 (unsafe access in netfilter ctnetlink), CVE-2026-46150 (false positive in fanotify permission events), and CVE-2026-64530 (use-after-free in net/sched cls_api handling TC_ACT_CONSUMED). These flaws could lead to privilege or stability issues in the kernel. Red Hat has released updated kernel-rt packages containing fixes and recommends rebooting after applying the update. The advisory emphasizes the importance of kernel updates due to their security relevance and notes that retroactive CVE assignments may occur. The update is rated as Important by Red Hat Product Security.

CWE-272Least Privilege Violation (opens in a new tab)
Base weakness
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
OWASP ASVS 4.0.3
V10.2.2 (opens in a new tab)
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
Attack patterns
Using Malicious Files (opens in a new tab)
Leverage Executable Code in Non-Executable Files (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Architecture and Design · Language Selection
Choose a language that provides automatic memory management.
Implementation · Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-280Improper Handling of Insufficient Permissions or Privileges (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation
Always check to see if you have successfully accessed a resource or system functionality, and use proper error handling if it is unsuccessful. Do this even when you are operating in a highly privileged mode, because errors or environmental conditions might still cause a failure.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-431Missing Handler (opens in a new tab)
Base weakness
A handler is not available or implemented.
Implementation
Handle all possible situations (e.g. error condition).
Implementation
If an operation can throw an Exception, implement a handler for that specific exception.
OWASP ASVS 4.0.3
V7.4.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2026, 07:28 UTC

WeaknessesCWE-272, CWE-416, CWE-280 +1

Technical details

References

Community reviews

Related threats