Skip to content
OpenAdvisories
High ALSA-2026:21556 20 CVEs

Important: kernel security update

Published May 28, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
* kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
* kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
* kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
* kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
* kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
* kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
* kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
* kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
* kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
* kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
* kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.12.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.12.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.12.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.12.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.12.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.12.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.12.1.el9_8

Vulnerabilities 20

  • Critical 9.8
    CVE-2026-46195

    smb: client: validate dacloffset before building DACL pointers

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-31408

    Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a refer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-31709

    smb: client: validate the whole DACL before rewriting it in cifsacl

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incomin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-43051

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38653

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

    In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-68183

    ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

    In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68724

    crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

    In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-71089

    iommu: disable SVA when CONFIG_X86 is set

    In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43023

    Bluetooth: SCO: fix race conditions in sco_sock_connect()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43303

    mm/page_alloc: clear page->private in free_pages_prepare()

    In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68366

    nbd: defer config unlock in nbd_genl_connect

    In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31684

    net: sched: act_csum: validate nested VLAN headers

    In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43020

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43027

    netfilter: nf_conntrack_helper: pass helper to expect cleanup

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-38653
  • report
    https://access.redhat.com/security/cve/CVE-2025-68183
  • report
    https://access.redhat.com/security/cve/CVE-2025-68366
  • report
    https://access.redhat.com/security/cve/CVE-2025-68724
  • report
    https://access.redhat.com/security/cve/CVE-2025-71089
  • report
    https://access.redhat.com/security/cve/CVE-2026-23392
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • report
    https://access.redhat.com/security/cve/CVE-2026-31408
  • report
    https://access.redhat.com/security/cve/CVE-2026-31684
  • report
    https://access.redhat.com/security/cve/CVE-2026-31685
  • report
    https://access.redhat.com/security/cve/CVE-2026-31709
  • report
    https://access.redhat.com/security/cve/CVE-2026-43020
  • report
    https://access.redhat.com/security/cve/CVE-2026-43023
  • report
    https://access.redhat.com/security/cve/CVE-2026-43027
  • report
    https://access.redhat.com/security/cve/CVE-2026-43051
  • report
    https://access.redhat.com/security/cve/CVE-2026-43110
  • report
    https://access.redhat.com/security/cve/CVE-2026-43158
  • report
    https://access.redhat.com/security/cve/CVE-2026-43190
  • report
    https://access.redhat.com/security/cve/CVE-2026-43303
  • report
    https://bugzilla.redhat.com/2390372
  • report
    https://bugzilla.redhat.com/2422699
  • report
    https://bugzilla.redhat.com/2424881
  • report
    https://bugzilla.redhat.com/2424886
  • report
    https://bugzilla.redhat.com/2429104
  • report
    https://bugzilla.redhat.com/2451218
  • report
    https://bugzilla.redhat.com/2454810
  • report
    https://bugzilla.redhat.com/2455334
  • report
    https://bugzilla.redhat.com/2461757
  • report
    https://bugzilla.redhat.com/2461759
  • report
    https://bugzilla.redhat.com/2464369
  • report
    https://bugzilla.redhat.com/2464455
  • report
    https://bugzilla.redhat.com/2464462
  • report
    https://bugzilla.redhat.com/2464476
  • report
    https://bugzilla.redhat.com/2464496
  • report
    https://bugzilla.redhat.com/2467014
  • report
    https://bugzilla.redhat.com/2467064
  • report
    https://bugzilla.redhat.com/2467210
  • report
    https://bugzilla.redhat.com/2468091
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-21556.html