Skip to content
OpenAdvisories
High ALSA-2026:23329 7 CVEs

Important: kernel security update

Published Jun 4, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
* kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
* kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
* kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322)
* kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.20.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.20.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.20.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.20.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.20.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.20.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.20.1.el10_2

Vulnerabilities 7

  • High 8.8
    CVE-2026-31709

    smb: client: validate the whole DACL before rewriting it in cifsacl

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incomin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43322

    Bluetooth: hci_sync: Fix UAF in le_read_features_complete

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_featu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-31613

    smb: client: fix OOB reads parsing symlink error response

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38653

    proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

    In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43329

    netfilter: flowtable: strictly check for maximum number of actions

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-46243 Public exploit

    smb: client: reject userspace cifs.spnego descriptions

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as ke…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68366

    nbd: defer config unlock in nbd_genl_connect

    In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-38653
  • report
    https://access.redhat.com/security/cve/CVE-2025-68366
  • report
    https://access.redhat.com/security/cve/CVE-2026-31613
  • report
    https://access.redhat.com/security/cve/CVE-2026-31709
  • report
    https://access.redhat.com/security/cve/CVE-2026-43322
  • report
    https://access.redhat.com/security/cve/CVE-2026-43329
  • report
    https://access.redhat.com/security/cve/CVE-2026-46243
  • report
    https://bugzilla.redhat.com/2390372
  • report
    https://bugzilla.redhat.com/2424881
  • report
    https://bugzilla.redhat.com/2461480
  • report
    https://bugzilla.redhat.com/2464476
  • report
    https://bugzilla.redhat.com/2468124
  • report
    https://bugzilla.redhat.com/2468131
  • report
    https://bugzilla.redhat.com/2481486
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-23329.html