Skip to content
OpenAdvisories
Medium ALSA-2026:4012 10 CVEs

Moderate: kernel security update

Published Mar 9, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141)
* kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106)
* kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)
* kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760)
* kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818)
* kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service (CVE-2025-40249)
* kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
* kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)
* kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)
* kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation (CVE-2026-23156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-124.43.1.el10_1
AlmaLinux · 10 kernel-doc 6.12.0-124.43.1.el10_1

Vulnerabilities 10

  • High 7.8
    CVE-2025-38106

    io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()

    In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by ta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38141

    dm: fix dm_blk_report_zones

    In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38703

    drm/xe: Make dma-fences compliant with the safe access rules

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace cl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39818

    HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KAS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40249

    gpio: cdev: make sure the cdev fd is still active before emitting events

    In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23001 Public exploit

    macvlan: fix possible UAF in macvlan_forward_source()

    In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-71085

    ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is tri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23097

    migrate: correct lock ordering for hugetlb file folios

    In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23156

    efivarfs: fix error propagation in efivar_entry_get()

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitial…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-38106
  • report
    https://access.redhat.com/security/cve/CVE-2025-38141
  • report
    https://access.redhat.com/security/cve/CVE-2025-38703
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • report
    https://access.redhat.com/security/cve/CVE-2025-39818
  • report
    https://access.redhat.com/security/cve/CVE-2025-40249
  • report
    https://access.redhat.com/security/cve/CVE-2025-71085
  • report
    https://access.redhat.com/security/cve/CVE-2026-23001
  • report
    https://access.redhat.com/security/cve/CVE-2026-23097
  • report
    https://access.redhat.com/security/cve/CVE-2026-23156
  • report
    https://bugzilla.redhat.com/2376052
  • report
    https://bugzilla.redhat.com/2376077
  • report
    https://bugzilla.redhat.com/2393157
  • report
    https://bugzilla.redhat.com/2394601
  • report
    https://bugzilla.redhat.com/2395797
  • report
    https://bugzilla.redhat.com/2418886
  • report
    https://bugzilla.redhat.com/2429026
  • report
    https://bugzilla.redhat.com/2432664
  • report
    https://bugzilla.redhat.com/2436802
  • report
    https://bugzilla.redhat.com/2439951
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-4012.html