Skip to content
OpenAdvisories
Medium ALSA-2026:1661 10 CVEs

Moderate: kernel-rt security update

Published Feb 2, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error (CVE-2024-26766)
* kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022)
* kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024)
* kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415)
* kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)
* kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760)
* kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
* kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271)
* kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)
* kernel: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (CVE-2022-50865)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.100.1.rt7.441.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.100.1.rt7.441.el8_10

Vulnerabilities 10

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26766

    IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

    In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38024

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_descri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2022-50865

    tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-40322

    fbdev: bitblit: bound-check glyph index in bit_putcs*

    In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38415

    Squashfs: check return result of sb_min_blocksize

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38459

    atm: clip: Fix infinite recursive call of clip_push().

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-50865
  • report
    https://access.redhat.com/security/cve/CVE-2024-26766
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • report
    https://access.redhat.com/security/cve/CVE-2025-38024
  • report
    https://access.redhat.com/security/cve/CVE-2025-38415
  • report
    https://access.redhat.com/security/cve/CVE-2025-38459
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • report
    https://access.redhat.com/security/cve/CVE-2025-40258
  • report
    https://access.redhat.com/security/cve/CVE-2025-40271
  • report
    https://access.redhat.com/security/cve/CVE-2025-40322
  • report
    https://bugzilla.redhat.com/2273187
  • report
    https://bugzilla.redhat.com/2373326
  • report
    https://bugzilla.redhat.com/2373354
  • report
    https://bugzilla.redhat.com/2383404
  • report
    https://bugzilla.redhat.com/2383487
  • report
    https://bugzilla.redhat.com/2394601
  • report
    https://bugzilla.redhat.com/2418876
  • report
    https://bugzilla.redhat.com/2419837
  • report
    https://bugzilla.redhat.com/2419902
  • report
    https://bugzilla.redhat.com/2426226
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-1661.html