Skip to content
OpenAdvisories
Critical ALSA-2026:25121 13 CVEs

Critical: kernel security update

Published Jun 10, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
* kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
* kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
* kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.132.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.132.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.132.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.132.1.el8_10

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-22984

    libceph: prevent potential out-of-bounds reads in handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43037

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43038

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-31613

    smb: client: fix OOB reads parsing symlink error response

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the syml…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53781

    smc: Fix use-after-free in tcp_write_timer_handler().

    In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21858

    geneve: Fix use-after-free in geneve_find_dev().

    In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23392

    netfilter: nf_tables: release flowtable after rcu grace period on error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46181

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22990

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

    In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68366

    nbd: defer config unlock in nbd_genl_connect

    In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31581

    ALSA: 6fire: fix use-after-free on disconnect

    In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-53781
  • report
    https://access.redhat.com/security/cve/CVE-2025-21858
  • report
    https://access.redhat.com/security/cve/CVE-2025-68366
  • report
    https://access.redhat.com/security/cve/CVE-2026-22984
  • report
    https://access.redhat.com/security/cve/CVE-2026-22990
  • report
    https://access.redhat.com/security/cve/CVE-2026-23392
  • report
    https://access.redhat.com/security/cve/CVE-2026-31581
  • report
    https://access.redhat.com/security/cve/CVE-2026-31613
  • report
    https://access.redhat.com/security/cve/CVE-2026-43037
  • report
    https://access.redhat.com/security/cve/CVE-2026-43038
  • report
    https://access.redhat.com/security/cve/CVE-2026-43125
  • report
    https://access.redhat.com/security/cve/CVE-2026-45852
  • report
    https://access.redhat.com/security/cve/CVE-2026-46181
  • report
    https://bugzilla.redhat.com/2351619
  • report
    https://bugzilla.redhat.com/2420279
  • report
    https://bugzilla.redhat.com/2424881
  • report
    https://bugzilla.redhat.com/2432389
  • report
    https://bugzilla.redhat.com/2432400
  • report
    https://bugzilla.redhat.com/2451218
  • report
    https://bugzilla.redhat.com/2461471
  • report
    https://bugzilla.redhat.com/2461480
  • report
    https://bugzilla.redhat.com/2464351
  • report
    https://bugzilla.redhat.com/2464397
  • report
    https://bugzilla.redhat.com/2467234
  • report
    https://bugzilla.redhat.com/2482166
  • report
    https://bugzilla.redhat.com/2482532
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-25121.html