Skip to content
OpenAdvisories
High ALSA-2026:27353 8 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jun 19, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
* kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
* kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

* AlmaLinux8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex de-boosting (JIRA:AlmaLinux-178520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.136.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.136.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.136.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.136.1.el8_10

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-46135

    nvmet-tcp: fix race between ICReq handling and queue teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31419

    net: bonding: fix use-after-free in bond_xmit_broadcast()

    In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31488

    drm/amd/display: Do not skip unrelated mode changes in DSC validation

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC sta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43056

    net: mana: fix use-after-free in add_adev() error path

    In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43279

    ALSA: usb-audio: Add sanity check for OOB writes at silencing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46090

    ALSA: aloop: Fix peer runtime UAF during format-change stop

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture strea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46145

    RDMA/mana: Validate rx_hash_key_len

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46331 Public exploit

    net/sched: fix pedit partial COW leading to page cache corruption

    In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31419
  • report
    https://access.redhat.com/security/cve/CVE-2026-31488
  • report
    https://access.redhat.com/security/cve/CVE-2026-43056
  • report
    https://access.redhat.com/security/cve/CVE-2026-43279
  • report
    https://access.redhat.com/security/cve/CVE-2026-46090
  • report
    https://access.redhat.com/security/cve/CVE-2026-46135
  • report
    https://access.redhat.com/security/cve/CVE-2026-46145
  • report
    https://access.redhat.com/security/cve/CVE-2026-46331
  • report
    https://bugzilla.redhat.com/2457829
  • report
    https://bugzilla.redhat.com/2460619
  • report
    https://bugzilla.redhat.com/2464449
  • report
    https://bugzilla.redhat.com/2467215
  • report
    https://bugzilla.redhat.com/2479492
  • report
    https://bugzilla.redhat.com/2481980
  • report
    https://bugzilla.redhat.com/2482581
  • report
    https://bugzilla.redhat.com/2482654
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-27353.html