Skip to content
Fencer Vulns
high 8.8

CVE-2026-43158 json

xfs: fix freemap adjustments when adding xattrs to leaf blocks

published 2026-05-06 6 mo ago modified 2026-10-19 20 d ago also EUVD-2026-27719

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix freemap adjustments when adding xattrs to leaf blocks

xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs:

ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf));

Upon enabling quite a lot more debugging code, I narrowed this down to fsstress trying to set a local extended attribute with namelen=3 and valuelen=71. This results in an entry size of 80 bytes.

At the start of xfs_attr3_leaf_add_work, the freemap looks like this:

i 0 base 448 size 0 rhs 448 count 46 i 1 base 388 size 132 rhs 448 count 46 i 2 base 2120 size 4 rhs 448 count 46 firstused = 520

where "rhs" is the first byte past the end of the leaf entry array. This is inconsistent -- the entries array ends at byte 448, but freemap[1] says there's free space starting at byte 388!

By the end of the function, the freemap is in worse shape:

i 0 base 456 size 0 rhs 456 count 47 i 1 base 388 size 52 rhs 456 count 47 i 2 base 2120 size 4 rhs 456 count 47 firstused = 440

Important note: 388 is not aligned with the entries array element size of 8 bytes.

Based on the incorrect freemap, the name area starts at byte 440, which is below the end of the entries array! That's why the assertion triggers and the filesystem shuts down.

How did we end up here? First, recall from the previous patch that the freemap array in an xattr leaf block is not intended to be a comprehensive map of all free space in the leaf block. In other words, it's perfectly legal to have a leaf block with:

* 376 bytes in use by the entries array * freemap[0] has [base = 376, size = 8] * freemap[1] has [base = 388, size = 1500] * the space between 376 and 388 is free, but the freemap stopped tracking that some time ago

If we add one xattr, the entries array grows to 384 bytes, and freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we add a second xattr, the entries array grows to 392 bytes, and freemap[0] gets pushed up to [base = 392, size = 0]. This is bad, because freemap[1] hasn't been updated, and now the entries array and the free space claim the same space.

The fix here is to adjust all freemap entries so that none of them collide with the entries array. Note that this fix relies on commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and the previous patch that resets zero length freemap entries to have base = 0.

Patch / fix

  • Linux Linux 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0
  • linux Debian 12 6.1.170-1
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.19.6-1

debian advisories DEBIAN-CVE-2026-43158

  • linux Ubuntu 22.04 LTS 5.15.0-186.196
  • linux Ubuntu 24.04 LTS 6.8.0-134.134
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1058.64

ubuntu advisories UBUNTU-CVE-2026-43158

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-kvm RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-core RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-modules RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-debug-kvm RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-debug-core RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-debug-modules RHEL 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel-rt-modules-extra RHEL 8 4.18.0-553.126.1.rt7.467.el8_10

red hat advisories RHSA-2026:41236RHSA-2026:33215RHSA-2026:27735RHSA-2026:27729RHSA-2026:27708RHSA-2026:26570

  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
  • kernel-obs-build Linux Micro Extras 6.2 6.12.0-160000.36.1
  • kernel-rt Linux Micro 6.2 6.12.0-160000.36.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.36.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.36.1.160000.2.17
  • kernel-azure SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.36.1

suse advisories SUSE-SU-2026:22742-1SUSE-SU-2026:22769-1SUSE-SU-2026:22835-1SUSE-SU-2026:22812-1SUSE-SU-2026:2799-1SUSE-SU-2026:2722-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.36.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.36.1

opensuse advisories openSUSE-SU-2026:21388-1

  • kernel AlmaLinux 9 5.14.0-687.12.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.12.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.12.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.12.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.12.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.12.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.12.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.12.1.el9_8

almalinux advisories ALSA-2026:21556ALSA-2026:21557ALSA-2026:21706ALSA-2026:21745

  • kernel Rocky Linux 10 6.12.0-211.18.1.el10_2
  • kernel-rt Rocky Linux 8 4.18.0-553.126.1.rt7.467.el8_10
  • kernel Rocky Linux 8 4.18.0-553.126.1.el8_10
  • kernel Rocky Linux 9 5.14.0-687.12.1.el9_8

rocky linux advisories RLSA-2026:21557RLSA-2026:21745RLSA-2026:21706RLSA-2026:21556

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43158 updated cvss 5.5

kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks

  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.123.1.el9_6
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.12.1.el9_8, perf 5.14.0-687.12.1.el9_8, rtla 5.14.0-687.12.1.el9_8, python3-perf 5.14.0-687.12.1.el9_8, kernel-devel-matched 5.14.0-687.12.1.el9_8, kernel-64k-devel-matched 5.14.0-687.12.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:21556
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.18.1.el10_2, perf 6.12.0-211.18.1.el10_2, rtla 6.12.0-211.18.1.el10_2, python3-perf 6.12.0-211.18.1.el10_2, kernel-devel-matched 6.12.0-211.18.1.el10_2, kernel-64k-devel-matched 6.12.0-211.18.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:21557
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.176.1.el9_2, rtla 5.14.0-284.176.1.el9_2, kernel-devel-matched 5.14.0-284.176.1.el9_2, kernel-64k-devel-matched 5.14.0-284.176.1.el9_2, kernel-debug-devel-matched 5.14.0-284.176.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.176.1.el9_2, +5 more
    fixed: vendor fix RHSA-2026:26515
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) rv 5.14.0-427.132.1.el9_4, perf 5.14.0-427.132.1.el9_4, rtla 5.14.0-427.132.1.el9_4, kernel-devel-matched 5.14.0-427.132.1.el9_4, kernel-64k-devel-matched 5.14.0-427.132.1.el9_4, kernel-debug-devel-matched 5.14.0-427.132.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:27735
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.84.1.el10_0, perf 6.12.0-55.84.1.el10_0, rtla 6.12.0-55.84.1.el10_0, python3-perf 6.12.0-55.84.1.el10_0, kernel-devel-matched 6.12.0-55.84.1.el10_0, kernel-64k-devel-matched 6.12.0-55.84.1.el10_0, +7 more
    fixed: vendor fix RHSA-2026:33215
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.123.1.el9_6, perf 5.14.0-570.123.1.el9_6, rtla 5.14.0-570.123.1.el9_6, python3-perf 5.14.0-570.123.1.el9_6, kernel-devel-matched 5.14.0-570.123.1.el9_6, kernel-64k-devel-matched 5.14.0-570.123.1.el9_6, +7 more
    fixed: vendor fix RHSA-2026:27708
show 32 more
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.126.1.el8_10, kernel 4.18.0-553.126.1.el8_10, bpftool 4.18.0-553.126.1.el8_10, kernel-core 4.18.0-553.126.1.el8_10, kernel-tools 4.18.0-553.126.1.el8_10, python3-perf 4.18.0-553.126.1.el8_10, +15 more
    fixed: vendor fix RHSA-2026:21706
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.12.1.el9_8, kernel-64k 5.14.0-687.12.1.el9_8, kernel-core 5.14.0-687.12.1.el9_8, kernel-tools 5.14.0-687.12.1.el9_8, kernel-modules 5.14.0-687.12.1.el9_8, kernel-64k-core 5.14.0-687.12.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:21556
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.18.1.el10_2, kernel-64k 6.12.0-211.18.1.el10_2, kernel-core 6.12.0-211.18.1.el10_2, kernel-tools 6.12.0-211.18.1.el10_2, kernel-modules 6.12.0-211.18.1.el10_2, kernel-64k-core 6.12.0-211.18.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:21557
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perf 4.18.0-305.194.1.el8_4, kernel 4.18.0-305.194.1.el8_4, bpftool 4.18.0-305.194.1.el8_4, kernel-core 4.18.0-305.194.1.el8_4, kernel-tools 4.18.0-305.194.1.el8_4, python3-perf 4.18.0-305.194.1.el8_4, +8 more
    fixed: vendor fix RHSA-2026:26535
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.196.1.el8_6, kernel 4.18.0-372.196.1.el8_6, bpftool 4.18.0-372.196.1.el8_6, kernel-core 4.18.0-372.196.1.el8_6, kernel-tools 4.18.0-372.196.1.el8_6, python3-perf 4.18.0-372.196.1.el8_6, +8 more
    fixed: vendor fix RHSA-2026:26570
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) perf 4.18.0-477.147.1.el8_8, kernel 4.18.0-477.147.1.el8_8, bpftool 4.18.0-477.147.1.el8_8, kernel-core 4.18.0-477.147.1.el8_8, kernel-tools 4.18.0-477.147.1.el8_8, python3-perf 4.18.0-477.147.1.el8_8, +9 more
    fixed: vendor fix RHSA-2026:26563
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.176.1.el9_2, kernel 5.14.0-284.176.1.el9_2, kernel-64k 5.14.0-284.176.1.el9_2, kernel-core 5.14.0-284.176.1.el9_2, kernel-tools 5.14.0-284.176.1.el9_2, python3-perf 5.14.0-284.176.1.el9_2, +28 more
    fixed: vendor fix RHSA-2026:26515
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool 7.3.0-427.132.1.el9_4, kernel 5.14.0-427.132.1.el9_4, kernel-64k 5.14.0-427.132.1.el9_4, kernel-core 5.14.0-427.132.1.el9_4, kernel-tools 5.14.0-427.132.1.el9_4, python3-perf 5.14.0-427.132.1.el9_4, +28 more
    fixed: vendor fix RHSA-2026:27735
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.84.1.el10_0, kernel-64k 6.12.0-55.84.1.el10_0, kernel-core 6.12.0-55.84.1.el10_0, kernel-tools 6.12.0-55.84.1.el10_0, kernel-modules 6.12.0-55.84.1.el10_0, kernel-64k-core 6.12.0-55.84.1.el10_0, +27 more
    fixed: vendor fix RHSA-2026:33215
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.123.1.el9_6, kernel-64k 5.14.0-570.123.1.el9_6, kernel-core 5.14.0-570.123.1.el9_6, kernel-tools 5.14.0-570.123.1.el9_6, kernel-modules 5.14.0-570.123.1.el9_6, kernel-64k-core 5.14.0-570.123.1.el9_6, +27 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) perf 4.18.0-305.194.1.el8_4, kernel 4.18.0-305.194.1.el8_4, bpftool 4.18.0-305.194.1.el8_4, kernel-core 4.18.0-305.194.1.el8_4, kernel-tools 4.18.0-305.194.1.el8_4, python3-perf 4.18.0-305.194.1.el8_4, +8 more
    fixed: vendor fix RHSA-2026:26535
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) perf 4.18.0-372.196.1.el8_6, kernel 4.18.0-372.196.1.el8_6, bpftool 4.18.0-372.196.1.el8_6, kernel-core 4.18.0-372.196.1.el8_6, kernel-tools 4.18.0-372.196.1.el8_6, python3-perf 4.18.0-372.196.1.el8_6, +8 more
    fixed: vendor fix RHSA-2026:26570
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) perf 4.18.0-477.147.1.el8_8, kernel 4.18.0-477.147.1.el8_8, bpftool 4.18.0-477.147.1.el8_8, kernel-core 4.18.0-477.147.1.el8_8, kernel-tools 4.18.0-477.147.1.el8_8, python3-perf 4.18.0-477.147.1.el8_8, +8 more
    fixed: vendor fix RHSA-2026:26563
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.12.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.12.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.12.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.12.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.12.1.el9_8
    fixed: vendor fix RHSA-2026:21556
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.18.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.18.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.18.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.18.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.18.1.el10_2
    fixed: vendor fix RHSA-2026:21557
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.84.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.84.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.84.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.84.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.84.1.el10_0
    fixed: vendor fix RHSA-2026:33215
  • Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.126.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.126.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.126.1.el8_10
    fixed: vendor fix RHSA-2026:21706
  • Red Hat Enterprise Linux for Real Time (v. 7 ELS) kernel-rt 3.10.0-1160.155.1.rt56.1307.el7, kernel-rt-trace 3.10.0-1160.155.1.rt56.1307.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.155.1.rt56.1307.el7
    fixed: vendor fix RHSA-2026:41236
  • Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-kvm 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-core 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-modules 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-debug-kvm 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-debug-core 4.18.0-553.126.1.rt7.467.el8_10, +4 more
    fixed: vendor fix RHSA-2026:21745
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.12.1.el9_8, kernel-rt-64k 5.14.0-687.12.1.el9_8, kernel-rt-core 5.14.0-687.12.1.el9_8, kernel-rt-modules 5.14.0-687.12.1.el9_8, kernel-rt-64k-core 5.14.0-687.12.1.el9_8, kernel-rt-debug-core 5.14.0-687.12.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:21556
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.18.1.el10_2, kernel-rt-64k 6.12.0-211.18.1.el10_2, kernel-rt-core 6.12.0-211.18.1.el10_2, kernel-rt-modules 6.12.0-211.18.1.el10_2, kernel-rt-64k-core 6.12.0-211.18.1.el10_2, kernel-rt-debug-core 6.12.0-211.18.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:21557
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-core 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-modules 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-debug-core 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-modules-core 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-debug-modules 5.14.0-284.176.1.rt14.461.el9_2, +4 more
    fixed: vendor fix RHSA-2026:26462
  • Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt 5.14.0-427.132.1.el9_4, kernel-rt-core 5.14.0-427.132.1.el9_4, kernel-rt-modules 5.14.0-427.132.1.el9_4, kernel-rt-debug-core 5.14.0-427.132.1.el9_4, kernel-rt-modules-core 5.14.0-427.132.1.el9_4, kernel-rt-debug-modules 5.14.0-427.132.1.el9_4, +4 more
    fixed: vendor fix RHSA-2026:27735
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.84.1.el10_0, kernel-rt-64k 6.12.0-55.84.1.el10_0, kernel-rt-core 6.12.0-55.84.1.el10_0, kernel-rt-modules 6.12.0-55.84.1.el10_0, kernel-rt-64k-core 6.12.0-55.84.1.el10_0, kernel-rt-debug-core 6.12.0-55.84.1.el10_0, +14 more
    fixed: vendor fix RHSA-2026:33215
  • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.123.1.el9_6, kernel-rt-64k 5.14.0-570.123.1.el9_6, kernel-rt-core 5.14.0-570.123.1.el9_6, kernel-rt-modules 5.14.0-570.123.1.el9_6, kernel-rt-64k-core 5.14.0-570.123.1.el9_6, kernel-rt-debug-core 5.14.0-570.123.1.el9_6, +14 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.12.1.el9_8, kernel-rt-core 5.14.0-687.12.1.el9_8, kernel-rt-modules 5.14.0-687.12.1.el9_8, kernel-rt-debug-core 5.14.0-687.12.1.el9_8, kernel-rt-modules-core 5.14.0-687.12.1.el9_8, kernel-rt-debug-modules 5.14.0-687.12.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:21556
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.18.1.el10_2, kernel-rt-core 6.12.0-211.18.1.el10_2, kernel-rt-modules 6.12.0-211.18.1.el10_2, kernel-rt-debug-core 6.12.0-211.18.1.el10_2, kernel-rt-modules-core 6.12.0-211.18.1.el10_2, kernel-rt-debug-modules 6.12.0-211.18.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:21557
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-kvm 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-core 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-modules 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-debug-kvm 5.14.0-284.176.1.rt14.461.el9_2, kernel-rt-debug-core 5.14.0-284.176.1.rt14.461.el9_2, +6 more
    fixed: vendor fix RHSA-2026:26462
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt 5.14.0-427.132.1.el9_4, kernel-rt-kvm 5.14.0-427.132.1.el9_4, kernel-rt-core 5.14.0-427.132.1.el9_4, kernel-rt-modules 5.14.0-427.132.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.132.1.el9_4, kernel-rt-debug-core 5.14.0-427.132.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:27735
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.84.1.el10_0, kernel-rt-kvm 6.12.0-55.84.1.el10_0, kernel-rt-core 6.12.0-55.84.1.el10_0, kernel-rt-modules 6.12.0-55.84.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.84.1.el10_0, kernel-rt-debug-core 6.12.0-55.84.1.el10_0, +6 more
    fixed: vendor fix RHSA-2026:33215
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.123.1.el9_6, kernel-rt-kvm 5.14.0-570.123.1.el9_6, kernel-rt-core 5.14.0-570.123.1.el9_6, kernel-rt-modules 5.14.0-570.123.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.123.1.el9_6, kernel-rt-debug-core 5.14.0-570.123.1.el9_6, +6 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-core 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-modules 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-debug-core 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-debug-modules 4.18.0-553.126.1.rt7.467.el8_10, kernel-rt-modules-extra 4.18.0-553.126.1.rt7.467.el8_10, +2 more
    fixed: vendor fix RHSA-2026:21745

2 more fixed, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
24 d ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-664 Improper Control of a Resource Through its Lifetime
  • CWE-787 Out-of-bounds Write
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.