# RHSA-2026:70403: Security update for 12 packages RHSA-2026:70403, released September 23, 2026, fixes 20 CVEs across 12 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/linux/rhsa-2026-70403 - Platform: Linux - Released: Sep 23, 2026 - Priority: Patch now (Closes CVE-2025-39964, exploited (CISA KEV)) - CVEs: 20, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://access.redhat.com/errata/RHSA-2026:70403 ## Applies to | Product | Release | Fixed in | |---|---|---| | [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-core](https://patchblox.com/security/data/product/linux/kernel-rt-core.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug](https://patchblox.com/security/data/product/linux/kernel-rt-debug.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug-core](https://patchblox.com/security/data/product/linux/kernel-rt-debug-core.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug-devel](https://patchblox.com/security/data/product/linux/kernel-rt-debug-devel.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug-kvm](https://patchblox.com/security/data/product/linux/kernel-rt-debug-kvm.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug-modules](https://patchblox.com/security/data/product/linux/kernel-rt-debug-modules.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-rt-debug-modules-extra.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-devel](https://patchblox.com/security/data/product/linux/kernel-rt-devel.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-kvm](https://patchblox.com/security/data/product/linux/kernel-rt-kvm.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-modules](https://patchblox.com/security/data/product/linux/kernel-rt-modules.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | | [kernel-rt-modules-extra](https://patchblox.com/security/data/product/linux/kernel-rt-modules-extra.md) | RHEL 8 | 0:4.18.0-553.166.1.rt7.507.el8_10 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-39964](https://patchblox.com/security/data/cve/CVE-2025-39964.md) | Patch now | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 8.8 | 0.0161 | CISA KEV | | [CVE-2026-64534](https://patchblox.com/security/data/cve/CVE-2026-64534.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un... | 9.8 | 0.0032 | | | [CVE-2026-53053](https://patchblox.com/security/data/cve/CVE-2026-53053.md) | Urgent | iommu/amd: Fix clone_alias() to use the original device's devid | 9.8 | 0.0013 | | | [CVE-2026-53062](https://patchblox.com/security/data/cve/CVE-2026-53062.md) | Urgent | dm cache policy smq: fix missing locks in invalidating cache blocks | 9.8 | 0.0010 | | | [CVE-2026-46133](https://patchblox.com/security/data/cve/CVE-2026-46133.md) | High | RDMA/rxe: Reject unknown opcodes before ICRC processing | 8.8 | 0.0057 | | | [CVE-2026-46043](https://patchblox.com/security/data/cve/CVE-2026-46043.md) | High | RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv | 9.1 | 0.0051 | | | [CVE-2026-63947](https://patchblox.com/security/data/cve/CVE-2026-63947.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0035 | | | [CVE-2023-54120](https://patchblox.com/security/data/cve/CVE-2023-54120.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_th... | 8.8 | 0.0031 | | | [CVE-2023-54214](https://patchblox.com/security/data/cve/CVE-2023-54214.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free... | 8.8 | 0.0030 | | | [CVE-2026-43334](https://patchblox.com/security/data/cve/CVE-2026-43334.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements... | 8.8 | 0.0028 | | | [CVE-2026-53254](https://patchblox.com/security/data/cve/CVE-2026-53254.md) | High | Bluetooth: RFCOMM: validate skb length in MCC handlers | 8.1 | 0.0028 | | | [CVE-2026-63975](https://patchblox.com/security/data/cve/CVE-2026-63975.md) | High | kernel-rt-64k-debug-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0027 | | | [CVE-2026-53256](https://patchblox.com/security/data/cve/CVE-2026-53256.md) | High | kernel-rt-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.1 | 0.0026 | | | [CVE-2026-52918](https://patchblox.com/security/data/cve/CVE-2026-52918.md) | High | Bluetooth: serialize accept_q access | 8.8 | 0.0022 | | | [CVE-2026-68188](https://patchblox.com/security/data/cve/CVE-2026-68188.md) | High | Bluetooth: RFCOMM: Fix session UAF in set_termios | 8.8 | 0.0022 | | | [CVE-2026-64582](https://patchblox.com/security/data/cve/CVE-2026-64582.md) | High | RDMA/rxe: Fix a use-after-free problem in rxe_mmap | 8.8 | 0.0017 | | | [CVE-2026-63823](https://patchblox.com/security/data/cve/CVE-2026-63823.md) | High | keys: Pin request_key_auth payload in instantiate paths | 8.8 | 0.0016 | | | [CVE-2025-71082](https://patchblox.com/security/data/cve/CVE-2025-71082.md) | High | Bluetooth: btusb: revert use of devm_kzalloc in btusb | 7.8 | 0.0015 | | | [CVE-2026-68293](https://patchblox.com/security/data/cve/CVE-2026-68293.md) | High | net/mlx5: Fix MCIA register buffer overflow on 32 dword reads | 8.8 | 0.0014 | | | [CVE-2026-45894](https://patchblox.com/security/data/cve/CVE-2026-45894.md) | High | iommu/vt-d: Clear Present bit before tearing down PASID entry | 8.8 | 0.0013 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo