Skip to content
OpenAdvisories
High ALSA-2026:30129 10 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jun 25, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
* kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
* kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
* kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
* kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

* Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.28.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.28.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.28.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.28.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.28.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.28.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.28.1.el10_2

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-43038

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-43198

    tcp: fix potential race in tcp_v6_syn_recv_sock()

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-43414

    scsi: qla2xxx: Completely fix fcport double free

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-45898

    RDMA/iwcm: Fix workqueue list corruption by removing work_list

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_wo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-46135

    nvmet-tcp: fix race between ICReq handling and queue teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-46316 Public exploit

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-31636

    rxrpc: fix RESPONSE authenticator parser OOB read

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46117

    RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46145

    RDMA/mana: Validate rx_hash_key_len

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46054

    selinux: fix overlayfs mmap() and mprotect() access checks

    In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31636
  • report
    https://access.redhat.com/security/cve/CVE-2026-43038
  • report
    https://access.redhat.com/security/cve/CVE-2026-43198
  • report
    https://access.redhat.com/security/cve/CVE-2026-43414
  • report
    https://access.redhat.com/security/cve/CVE-2026-45898
  • report
    https://access.redhat.com/security/cve/CVE-2026-46117
  • report
    https://access.redhat.com/security/cve/CVE-2026-46135
  • report
    https://access.redhat.com/security/cve/CVE-2026-46145
  • report
    https://bugzilla.redhat.com/2461510
  • report
    https://bugzilla.redhat.com/2464397
  • report
    https://bugzilla.redhat.com/2467228
  • report
    https://bugzilla.redhat.com/2468155
  • report
    https://bugzilla.redhat.com/2482031
  • report
    https://bugzilla.redhat.com/2482576
  • report
    https://bugzilla.redhat.com/2482581
  • report
    https://bugzilla.redhat.com/2482654
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-30129.html