RLSA-2026:99031: Moderate: kernel-rt security, bug fix, and enhancement update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events (CVE-2026-74446)
kernel: drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422)
kernel: drm/amd/pm: bound ppdpmsetpptable() memcpy (CVE-2026-97427)
kernel: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid (CVE-2026-97497)
kernel: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw (CVE-2026-97494)
kernel: drm/amdkfd: Check bounds on allocatedoorbell (CVE-2026-97495)
kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)
kernel: drm/amdgpu: fix buffer overflow during vBIOS update (CVE-2026-97425)
kernel: net/smc: protect clcsock lifetime in smcgetname (CVE-2026-99032)
kernel: kernel: Denial of Service via use-after-free race condition in SCSI tape driver (CVE-2026-99156)
Bug Fix(es) and Enhancement(s):
soft lockup occurs during iomapfinishioends (JIRA:Rocky Linux-258946)
gfs2: BUG during withdraw [Rocky Linux-8] (JIRA:Rocky Linux-298310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-coreto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debugto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-coreto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-debuginfoto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-develto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debuginfoto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debuginfo-common-x86_64to a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-kvmto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-modulesto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-debug-modules-extrato a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-develto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-kvmto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-modulesto a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
rocky-linux/kernel-rt-modules-extrato a version that resolves this vulnerability.Fixed in 0:4.18.0-553.186.1.rt7.527.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Rocky Linux systems with kernel-rt packages installed, particularly kernel-rt, kernel-rt-core, or the listed debug and debuginfo variants. The advisory covers issues in AMD GPU/KFD components, the SMC networking subsystem, and the SCSI tape driver.
What level of access does exploitation require?
The provided CVSS vector indicates local access, low privileges, and no user interaction are required. It also indicates high potential impact to confidentiality, integrity, and availability.
How can I identify potentially affected hosts?
Identify Rocky Linux hosts with any of the listed kernel-rt package names installed. Package inventory should include kernel-rt, kernel-rt-core, kernel-rt-debug, or the associated debug, debuginfo, and development packages.