Skip to content
OpenAdvisories
High ALSA-2026:27789 17 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jun 22, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
* kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
* kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
* kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
* kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
* kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
* kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

* AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048)
* [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
* DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
* DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823)
* ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
* AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317)
* rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.17.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.17.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.17.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.17.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.17.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.17.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.17.1.el9_8

Vulnerabilities 17

  • Critical 9.8
    CVE-2026-31669

    mptcp: fix slab-use-after-free in __inet_lookup_established

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43414

    scsi: qla2xxx: Completely fix fcport double free

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-46135

    nvmet-tcp: fix race between ICReq handling and queue teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46056

    Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46125

    wifi: mac80211: remove station if connection prep fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46152

    wifi: mac80211: drop stray 'static' from fast-RX rx_result

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-46166

    wifi: mac80211: use safe list iteration in radar detect work

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31474

    can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

    In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31772

    Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43279

    ALSA: usb-audio: Add sanity check for OOB writes at silencing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45984

    gfs2: Fix use-after-free in iomap inline data write path

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46117

    RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46145

    RDMA/mana: Validate rx_hash_key_len

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46173

    exit: prevent preemption of oopsing TASK_DEAD task

    In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46331 Public exploit

    net/sched: fix pedit partial COW leading to page cache corruption

    In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-31787 Public exploit

    xen/privcmd: fix double free via VMA splitting

    In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43260

    bnxt_en: Fix RSS context delete logic

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31474
  • report
    https://access.redhat.com/security/cve/CVE-2026-31669
  • report
    https://access.redhat.com/security/cve/CVE-2026-31772
  • report
    https://access.redhat.com/security/cve/CVE-2026-31787
  • report
    https://access.redhat.com/security/cve/CVE-2026-43260
  • report
    https://access.redhat.com/security/cve/CVE-2026-43279
  • report
    https://access.redhat.com/security/cve/CVE-2026-43414
  • report
    https://access.redhat.com/security/cve/CVE-2026-45984
  • report
    https://access.redhat.com/security/cve/CVE-2026-46056
  • report
    https://access.redhat.com/security/cve/CVE-2026-46117
  • report
    https://access.redhat.com/security/cve/CVE-2026-46125
  • report
    https://access.redhat.com/security/cve/CVE-2026-46135
  • report
    https://access.redhat.com/security/cve/CVE-2026-46145
  • report
    https://access.redhat.com/security/cve/CVE-2026-46152
  • report
    https://access.redhat.com/security/cve/CVE-2026-46166
  • report
    https://access.redhat.com/security/cve/CVE-2026-46173
  • report
    https://access.redhat.com/security/cve/CVE-2026-46331
  • report
    https://bugzilla.redhat.com/2460646
  • report
    https://bugzilla.redhat.com/2461503
  • report
    https://bugzilla.redhat.com/2464092
  • report
    https://bugzilla.redhat.com/2464502
  • report
    https://bugzilla.redhat.com/2467083
  • report
    https://bugzilla.redhat.com/2467215
  • report
    https://bugzilla.redhat.com/2468155
  • report
    https://bugzilla.redhat.com/2479492
  • report
    https://bugzilla.redhat.com/2481922
  • report
    https://bugzilla.redhat.com/2482181
  • report
    https://bugzilla.redhat.com/2482563
  • report
    https://bugzilla.redhat.com/2482576
  • report
    https://bugzilla.redhat.com/2482581
  • report
    https://bugzilla.redhat.com/2482608
  • report
    https://bugzilla.redhat.com/2482634
  • report
    https://bugzilla.redhat.com/2482645
  • report
    https://bugzilla.redhat.com/2482654
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-27789.html