Skip to content
OpenAdvisories
Medium ALSA-2026:2264 8 CVEs

Moderate: kernel security update

Published Feb 9, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)
* kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)
* kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
* kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)
* kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269)
* kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)
* kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)
* kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.104.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.104.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.104.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.104.1.el8_10

Vulnerabilities 8

  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50673

    ext4: fix use-after-free in ext4_orphan_cleanup

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40269

    ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-68349

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

    In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22998

    nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38403

    vsock/vmci: Clear the vmci transport packet properly when initializing it

    In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-50673
  • report
    https://access.redhat.com/security/cve/CVE-2025-38403
  • report
    https://access.redhat.com/security/cve/CVE-2025-40135
  • report
    https://access.redhat.com/security/cve/CVE-2025-40158
  • report
    https://access.redhat.com/security/cve/CVE-2025-40170
  • report
    https://access.redhat.com/security/cve/CVE-2025-40269
  • report
    https://access.redhat.com/security/cve/CVE-2025-68349
  • report
    https://access.redhat.com/security/cve/CVE-2026-22998
  • report
    https://bugzilla.redhat.com/2383421
  • report
    https://bugzilla.redhat.com/2414506
  • report
    https://bugzilla.redhat.com/2414521
  • report
    https://bugzilla.redhat.com/2414523
  • report
    https://bugzilla.redhat.com/2419919
  • report
    https://bugzilla.redhat.com/2420347
  • report
    https://bugzilla.redhat.com/2424880
  • report
    https://bugzilla.redhat.com/2432671
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-2264.html