Skip to content
OpenAdvisories
High ALSA-2026:25217 11 CVEs

Important: kernel security update

Published Jun 11, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)
* kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
* kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)
* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
* kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
* kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.15.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.15.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.15.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.15.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.15.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.15.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.15.1.el9_8

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-43037

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43125

    dlm: validate length in dlm_search_rsb_tree

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43501 Public exploit

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

    In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31419

    net: bonding: fix use-after-free in bond_xmit_broadcast()

    In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31508

    net: openvswitch: Avoid releasing netdev before teardown completes

    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43056

    net: mana: fix use-after-free in add_adev() error path

    In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43116

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45852

    RDMA/rxe: Fix double free in rxe_srq_from_init

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fail…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46181

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23216

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31581

    ALSA: 6fire: fix use-after-free on disconnect

    In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-23216
  • report
    https://access.redhat.com/security/cve/CVE-2026-31419
  • report
    https://access.redhat.com/security/cve/CVE-2026-31508
  • report
    https://access.redhat.com/security/cve/CVE-2026-31581
  • report
    https://access.redhat.com/security/cve/CVE-2026-43037
  • report
    https://access.redhat.com/security/cve/CVE-2026-43056
  • report
    https://access.redhat.com/security/cve/CVE-2026-43116
  • report
    https://access.redhat.com/security/cve/CVE-2026-43125
  • report
    https://access.redhat.com/security/cve/CVE-2026-43501
  • report
    https://access.redhat.com/security/cve/CVE-2026-45852
  • report
    https://access.redhat.com/security/cve/CVE-2026-46181
  • report
    https://bugzilla.redhat.com/2440630
  • report
    https://bugzilla.redhat.com/2457829
  • report
    https://bugzilla.redhat.com/2460641
  • report
    https://bugzilla.redhat.com/2461471
  • report
    https://bugzilla.redhat.com/2464351
  • report
    https://bugzilla.redhat.com/2464449
  • report
    https://bugzilla.redhat.com/2467005
  • report
    https://bugzilla.redhat.com/2467234
  • report
    https://bugzilla.redhat.com/2480457
  • report
    https://bugzilla.redhat.com/2482166
  • report
    https://bugzilla.redhat.com/2482532
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-25217.html