Skip to content
OpenAdvisories
High ALSA-2026:36018 11 CVEs

Important: kernel security, bug fix, and enhancement update

Published Jul 6, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
* kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
* kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
* kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
* kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
* kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
* kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
* kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)
* kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

* WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [almalinux-9.8.z] (JIRA:AlmaLinux-160966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.22.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.22.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.22.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.22.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.22.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.22.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.22.1.el9_8

Vulnerabilities 11

  • Critical 9.3
    CVE-2026-46316 Public exploit

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2025-10263 Public exploit

    Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X…

    Arm Cortex-X925 Cortex-X3 Neoverse V3 Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2026-46155

    smb/client: fix out-of-bounds read in smb2_compound_op()

    In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns succe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46244

    netfilter: nft_inner: Fix IPv6 inner_thoff desync

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43112

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

    In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46116

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

    In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46209

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

    In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46227

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

    In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46259

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()

    In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46323

    net: gro: don't merge zcopy skbs

    In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43276

    net: mana: Fix double destroy_workqueue on service rescan PCI path

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-10263
  • report
    https://access.redhat.com/security/cve/CVE-2026-43112
  • report
    https://access.redhat.com/security/cve/CVE-2026-43276
  • report
    https://access.redhat.com/security/cve/CVE-2026-46116
  • report
    https://access.redhat.com/security/cve/CVE-2026-46155
  • report
    https://access.redhat.com/security/cve/CVE-2026-46209
  • report
    https://access.redhat.com/security/cve/CVE-2026-46227
  • report
    https://access.redhat.com/security/cve/CVE-2026-46244
  • report
    https://access.redhat.com/security/cve/CVE-2026-46259
  • report
    https://access.redhat.com/security/cve/CVE-2026-46316
  • report
    https://access.redhat.com/security/cve/CVE-2026-46323
  • report
    https://bugzilla.redhat.com/2467015
  • report
    https://bugzilla.redhat.com/2467113
  • report
    https://bugzilla.redhat.com/2479832
  • report
    https://bugzilla.redhat.com/2482523
  • report
    https://bugzilla.redhat.com/2482564
  • report
    https://bugzilla.redhat.com/2482636
  • report
    https://bugzilla.redhat.com/2482660
  • report
    https://bugzilla.redhat.com/2484451
  • report
    https://bugzilla.redhat.com/2484477
  • report
    https://bugzilla.redhat.com/2486958
  • report
    https://bugzilla.redhat.com/2486982
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-36018.html