Skip to content
OpenAdvisories
High ALSA-2026:21557 18 CVEs

Important: kernel security update

Published May 28, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
* kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
* kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
* kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
* kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
* kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
* kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
* kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
* kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
* kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
* kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
* kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
* kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.18.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.18.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.18.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.18.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.18.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.18.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.18.1.el10_2

Vulnerabilities 18

  • Critical 9.8
    CVE-2024-56645

    can: j1939: j1939_session_new(): fix skb reference counting

    In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.4
    CVE-2026-31685

    netfilter: ip6t_eui64: reject invalid MAC header for all packets

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 sour…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-23455

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43110

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-43158

    xfs: fix freemap adjustments when adding xattrs to leaf blocks

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43190

    netfilter: xt_tcpmss: check remaining length before reading optlen

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-43051

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-68183

    ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

    In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43023

    Bluetooth: SCO: fix race conditions in sco_sock_connect()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43116

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43303

    mm/page_alloc: clear page->private in free_pages_prepare()

    In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-43006

    io_uring/rsrc: reject zero-length fixed buffer import

    In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-23375

    mm: thp: deny THP for files on anonymous inodes

    In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_fil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-31684

    net: sched: act_csum: validate nested VLAN headers

    In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43020

    Bluetooth: MGMT: validate LTK enc_size on load

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43027

    netfilter: nf_conntrack_helper: pass helper to expect cleanup

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43205

    dpaa2-switch: validate num_ifs to prevent out-of-bounds write

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-56645
  • report
    https://access.redhat.com/security/cve/CVE-2025-68183
  • report
    https://access.redhat.com/security/cve/CVE-2026-23375
  • report
    https://access.redhat.com/security/cve/CVE-2026-23392
  • report
    https://access.redhat.com/security/cve/CVE-2026-23455
  • report
    https://access.redhat.com/security/cve/CVE-2026-31684
  • report
    https://access.redhat.com/security/cve/CVE-2026-31685
  • report
    https://access.redhat.com/security/cve/CVE-2026-43006
  • report
    https://access.redhat.com/security/cve/CVE-2026-43020
  • report
    https://access.redhat.com/security/cve/CVE-2026-43023
  • report
    https://access.redhat.com/security/cve/CVE-2026-43027
  • report
    https://access.redhat.com/security/cve/CVE-2026-43051
  • report
    https://access.redhat.com/security/cve/CVE-2026-43110
  • report
    https://access.redhat.com/security/cve/CVE-2026-43116
  • report
    https://access.redhat.com/security/cve/CVE-2026-43158
  • report
    https://access.redhat.com/security/cve/CVE-2026-43190
  • report
    https://access.redhat.com/security/cve/CVE-2026-43205
  • report
    https://access.redhat.com/security/cve/CVE-2026-43303
  • report
    https://bugzilla.redhat.com/2334560
  • report
    https://bugzilla.redhat.com/2422699
  • report
    https://bugzilla.redhat.com/2451199
  • report
    https://bugzilla.redhat.com/2451218
  • report
    https://bugzilla.redhat.com/2454810
  • report
    https://bugzilla.redhat.com/2461757
  • report
    https://bugzilla.redhat.com/2461759
  • report
    https://bugzilla.redhat.com/2464369
  • report
    https://bugzilla.redhat.com/2464402
  • report
    https://bugzilla.redhat.com/2464455
  • report
    https://bugzilla.redhat.com/2464462
  • report
    https://bugzilla.redhat.com/2464496
  • report
    https://bugzilla.redhat.com/2467005
  • report
    https://bugzilla.redhat.com/2467014
  • report
    https://bugzilla.redhat.com/2467064
  • report
    https://bugzilla.redhat.com/2467090
  • report
    https://bugzilla.redhat.com/2467210
  • report
    https://bugzilla.redhat.com/2468091
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-21557.html