CVE-2026-52929VulnerabilityPublished 1 Nov 2026

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Affects Red Hat kernel security,Source GCVE Database

Compare

Mentioned vulnerabilities

Authoritative record:CVE-2026-52929· High 7.5

Not known to be exploited · CVSS 7.5 High · fixed in Red Hat package updates : patch Red Hat kernel security, soon.

Data as of 2 Nov 2026, 00:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in d5ea0b3e261fcb2cfff142675516165244cab1da, a6724b7b812ac8793514a1d5938db5d9d29ae725, a5f8a90ac9f77c678a9781c0a464b635e0d63e49 +5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < d5ea0b3e261fcb2cfff142675516165244cab1da	Fixed in d5ea0b3e261fcb2cfff142675516165244cab1da
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < a6724b7b812ac8793514a1d5938db5d9d29ae725	Fixed in a6724b7b812ac8793514a1d5938db5d9d29ae725
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < a5f8a90ac9f77c678a9781c0a464b635e0d63e49	Fixed in a5f8a90ac9f77c678a9781c0a464b635e0d63e49
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < 9662eb0401518f0b4681f10e7fbf688f504f24cf	Fixed in 9662eb0401518f0b4681f10e7fbf688f504f24cf
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < 39dc2b0eb5371a669ebc9ec6072b9184eac95418	Fixed in 39dc2b0eb5371a669ebc9ec6072b9184eac95418
LinuxLinux	Affected ≥ 637784ade221a3c8a7ecd0f583eddd95d6276b9a, < 7dd9a42b044aad2dbe037db1c1e2943582485b44	Fixed in 7dd9a42b044aad2dbe037db1c1e2943582485b44

AI-suggested

A security update for the kernel packages is available from Red Hat for Red Hat Enterprise Linux 9. Users should apply the update promptly and reboot their systems to ensure the fixes take effect. Red Hat recommends treating all kernel errata as security-relevant and advises against delaying updates to avoid exposure to known vulnerabilities. No additional mitigations beyond applying the official update and rebooting are specified.

Description

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages used in Red Hat Enterprise Linux 9. The update includes fixes for several security issues such as use-after-free vulnerabilities, improper ownership management, privilege escalation, and denial of service conditions. The advisory also includes bug fixes and enhancements to improve kernel stability and functionality. Systems must be rebooted after applying the update for the fixes to take effect.

Impact

The vulnerabilities fixed in this advisory could allow local privilege escalation, denial of service, or other security impacts depending on the specific flaw. For example, use-after-free vulnerabilities can lead to memory corruption and privilege escalation. Improper ownership management and bypasses of security mechanisms like seccomp can also compromise system security. The kernel's fundamental role means these issues could affect the overall security posture of affected systems. The advisory rates the update as Important and the severity as high, indicating significant security impact if unpatched.

Summary

The advisory covers a comprehensive kernel update for Red Hat Enterprise Linux 9 that resolves numerous security vulnerabilities identified by CVE identifiers including CVE-2026-52929, CVE-2026-53228, CVE-2026-53270, CVE-2026-64303, CVE-2026-68169, CVE-2026-72083, CVE-2026-74283, CVE-2026-74510, CVE-2026-74582, CVE-2026-80586, CVE-2026-89603, CVE-2026-90011, CVE-2026-93827, CVE-2026-93787, CVE-2026-98364, CVE-2026-98432, CVE-2026-98466, and CVE-2026-98725. These vulnerabilities include use-after-free bugs, improper memory management, privilege escalation, and other kernel subsystem issues affecting SCTP, IPv6, IPVS, SPI, MPTCP, SCSI, TIPC, Bluetooth, packet handling, seccomp, virtio-fs, SMB client, XFRM, KVM on ARM64, and NVMe target authentication. The update also addresses kernel panics and improves robustness in GRE header handling and connection tracking. The advisory emphasizes the importance of applying these kernel fixes due to the kernel's critical role in system security.

CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.3 (opens in a new tab)
V11.1.6 (opens in a new tab)
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-266Incorrect Privilege Assignment (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-824Access of Uninitialized Pointer (opens in a new tab)
Base weakness
The product accesses or uses a pointer that has not been initialized.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-653Improper Isolation or Compartmentalization (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Architecture and Design
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
OWASP Cheat Sheets
Secure Design Principles (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: Red Hat Product Security
Advisory ID: RHSA-2026:93412
Vendor Severity: high
CVE Count: 18
Additional Cves: CVE-2026-53228, CVE-2026-53270, CVE-2026-64303, CVE-2026-68169, CVE-2026-72083, CVE-2026-74283, CVE-2026-74510, CVE-2026-74582, CVE-2026-80586, CVE-2026-89603, CVE-2026-90011, CVE-2026-93787, CVE-2026-93827, CVE-2026-98364, CVE-2026-98432, CVE-2026-98466, CVE-2026-98725

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 2 Nov 2026, 00:02 UTC

WeaknessesCWE-825, CWE-367, CWE-266 +5

Technical details

References

Community reviews

Related threats