Skip to content
OpenAdvisories
High ALSA-2026:27288 15 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jun 19, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
* kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
* kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
* kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
* kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
* kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
* kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
* kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
* kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
* kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
* kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

* AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
* AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
* objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
* ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
* rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
* AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
* [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.26.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.26.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.26.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.26.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.26.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.26.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.26.1.el10_2

Vulnerabilities 15

  • Critical 9.8
    CVE-2026-31669

    mptcp: fix slab-use-after-free in __inet_lookup_established

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46056

    Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46125

    wifi: mac80211: remove station if connection prep fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46152

    wifi: mac80211: drop stray 'static' from fast-RX rx_result

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46166

    wifi: mac80211: use safe list iteration in radar detect work

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31474

    can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

    In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31641

    rxrpc: Fix RxGK token loading to check bounds

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31772

    Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31786

    Buffer overflow in drivers/xen/sys-hypervisor.c

    In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43056

    net: mana: fix use-after-free in add_adev() error path

    In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43330

    crypto: caam - fix overflow on long hmac keys

    In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be roun…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46173

    exit: prevent preemption of oopsing TASK_DEAD task

    In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46331 Public exploit

    net/sched: fix pedit partial COW leading to page cache corruption

    In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31787 Public exploit

    xen/privcmd: fix double free via VMA splitting

    In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43260

    bnxt_en: Fix RSS context delete logic

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31474
  • report
    https://access.redhat.com/security/cve/CVE-2026-31641
  • report
    https://access.redhat.com/security/cve/CVE-2026-31669
  • report
    https://access.redhat.com/security/cve/CVE-2026-31772
  • report
    https://access.redhat.com/security/cve/CVE-2026-31786
  • report
    https://access.redhat.com/security/cve/CVE-2026-31787
  • report
    https://access.redhat.com/security/cve/CVE-2026-43056
  • report
    https://access.redhat.com/security/cve/CVE-2026-43260
  • report
    https://access.redhat.com/security/cve/CVE-2026-43330
  • report
    https://access.redhat.com/security/cve/CVE-2026-46056
  • report
    https://access.redhat.com/security/cve/CVE-2026-46125
  • report
    https://access.redhat.com/security/cve/CVE-2026-46152
  • report
    https://access.redhat.com/security/cve/CVE-2026-46166
  • report
    https://access.redhat.com/security/cve/CVE-2026-46173
  • report
    https://access.redhat.com/security/cve/CVE-2026-46331
  • report
    https://bugzilla.redhat.com/2460646
  • report
    https://bugzilla.redhat.com/2461503
  • report
    https://bugzilla.redhat.com/2461548
  • report
    https://bugzilla.redhat.com/2464092
  • report
    https://bugzilla.redhat.com/2464096
  • report
    https://bugzilla.redhat.com/2464449
  • report
    https://bugzilla.redhat.com/2464502
  • report
    https://bugzilla.redhat.com/2467083
  • report
    https://bugzilla.redhat.com/2468061
  • report
    https://bugzilla.redhat.com/2479492
  • report
    https://bugzilla.redhat.com/2482181
  • report
    https://bugzilla.redhat.com/2482563
  • report
    https://bugzilla.redhat.com/2482608
  • report
    https://bugzilla.redhat.com/2482634
  • report
    https://bugzilla.redhat.com/2482645
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-27288.html