Red Hat Security Advisory: kernel security update
Affects Red Hat Product Security Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · fixed in 10.2 : patch Red Hat Product Security Red Hat soon.
Data as of 10/25/2026, 09:04:00 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.09% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 10.2
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/kernelpkg:rpm/redhat/kernelOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released updated kernel packages that fix these vulnerabilities. Users should apply the available kernel updates for Red Hat Enterprise Linux 10 and reboot their systems to ensure the fixes take effect. Refer to Red Hat's official advisory RHSA-2026:38492 and article https://access.redhat.com/articles/11258 for detailed update instructions.
Description
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Impact
Successful exploitation of these vulnerabilities could cause kernel crashes, leading to denial of service or system instability. There are no known exploits in the wild at this time. The vulnerabilities affect the core Linux kernel, which is critical to system operation.
Weaknesses
- CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
- CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
References
- access.redhat.com/errata/RHSA-2026:38492 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2467059 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2480453 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2492805 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38492.json (opens in a new tab)