Red Hat RHEL 8 Kernel Updates Address Multiple Flaws
Tech GuruQuick Answer
Red Hat's RHEL 8 kernel and kernel-rt updates fix 20 vulnerabilities, including CVE-2025-39964, which CISA lists as known exploited. Install the update for the host's kernel flavor and entitled release stream, then reboot: Red Hat explicitly requires a restart for these fixes to take effect.
Confirm Scope And Apply The Supported Fix
What to do now: Match each RHEL 8.10 host to the standard or real-time kernel advisory, schedule the required reboot, and include applicable systems in the response to the KEV-listed CVE. Preserve incident evidence if compromise is suspected.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8 kernel and kernel-rt packages |
|---|---|
| Advisory | RHSA-2026:70402 / RHSA-2026:70403 |
| CVEs | CVE-2023-54120, CVE-2023-54214, CVE-2025-39964, CVE-2025-71082, CVE-2026-43334, CVE-2026-45894, CVE-2026-46043, CVE-2026-46133, CVE-2026-52918, CVE-2026-53053, CVE-2026-53062, CVE-2026-53254, CVE-2026-53256, CVE-2026-63823, CVE-2026-63947, CVE-2026-63975, CVE-2026-64534, CVE-2026-64582, CVE-2026-68188, CVE-2026-68293 |
| Red Hat initial advisory publication | 2026-09-22: RHSA-2026:70402 at 21:24:45 UTC; RHSA-2026:70403 at 20:09:45 UTC |
| CSAF generation time (historical snapshot) | 2026-09-23 03:36:07 UTC |
| Affected versions | Affected builds in the entitled RHEL 8.10 kernel or kernel-rt streams covered by the two advisories. Match architecture and flavor; the product-family name alone is insufficient. |
| Fixed version | kernel 4.18.0-553.166.1.el8_10 or kernel-rt 4.18.0-553.166.1.rt7.507.el8_10 |
| CVSS base score | 5.5 / 5.8 / 7.0 / 7.1 / 7.3 / 7.8 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Red Hat does not state exploitation status here. The CISA KEV catalog lists CVE-2025-39964, added 2026-09-18. That establishes exploitation of the CVE, not that every listed kernel configuration is exploitable or any particular host is compromised. |
What Changed
The fixes span several subsystems rather than one shared attack path. CVE-2025-39964 is a race between concurrent writes to an AF_ALG socket, potentially causing a local crash or corrupting cryptographic results. Other entries include Bluetooth RFCOMM memory-safety defects; reachability and prerequisites differ by CVE and enabled subsystem.
What To Validate Now
- Inventory. Locate RHEL 8 kernel and kernel-rt packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Record the running kernel, installed kernel packages, architecture and repository entitlement. Use RHSA-2026:70402 for the standard kernel and RHSA-2026:70403 for kernel-rt; assess each CVE's subsystem prerequisites separately.
- Remediate. Install the matching vendor packages: kernel 4.18.0-553.166.1.el8_10 or kernel-rt 4.18.0-553.166.1.rt7.507.el8_10, including the corresponding runtime subpackages. A source RPM alone does not update the running kernel. Reboot through the approved maintenance process.
- Validate. After reboot, confirm the running kernel matches the fixed flavor/build and verify storage, networking and workload health. For real-time systems, also check timing-sensitive workloads and the agreed recovery path; no workload test was performed here.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Keep standard and real-time kernel streams separate and retain a tested boot/recovery option. Installation without the required reboot is incomplete remediation. Disabling one affected subsystem cannot be assumed to mitigate all 20 CVEs; use the vendor's per-CVE guidance.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
