Skip to content
OpenAdvisories
High ALSA-2026:55764 11 CVEs

Important: kernel security, bug fix, and enhancement update

Published Aug 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Bug Fix(es) and Enhancement(s):

* Backport "sched/deadline: Fix bandwidth reclaim equation in GRUB" to AlmaLinux 8.10 (JIRA:AlmaLinux-189997)
* vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z] (JIRA:AlmaLinux-224556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.156.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.156.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.156.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.156.1.el8_10

Vulnerabilities 11

  • High 8.8
    CVE-2026-53374

    drm/amdgpu: zero-initialize GART table on allocation

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-74580 Public exploit

    vhost: reset the vring metadata cache on vring reconfiguration

    In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-17523

    can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

    In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43206

    drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Alpine
  • High 7.8
    CVE-2026-53016

    crypto: ccp - copy IV using skcipher ivsize

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer w…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63879

    drm/amdgpu: fix amdgpu_hmm_range_get_pages

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-63884

    drm/i915: Fix potential UAF in TTM object purge

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right po…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39902

    mm/slub: avoid accessing metadata when pointer is invalid in object_err()

    In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-53329

    drm/amd/display: Use krealloc_array() in dal_vector_reserve()

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, whic…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2026-64219

    drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-53136

    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-39902
  • report
    https://access.redhat.com/security/cve/CVE-2026-17523
  • report
    https://access.redhat.com/security/cve/CVE-2026-43206
  • report
    https://access.redhat.com/security/cve/CVE-2026-53016
  • report
    https://access.redhat.com/security/cve/CVE-2026-53136
  • report
    https://access.redhat.com/security/cve/CVE-2026-53329
  • report
    https://access.redhat.com/security/cve/CVE-2026-53374
  • report
    https://access.redhat.com/security/cve/CVE-2026-63879
  • report
    https://access.redhat.com/security/cve/CVE-2026-63884
  • report
    https://access.redhat.com/security/cve/CVE-2026-64219
  • report
    https://bugzilla.redhat.com/2400594
  • report
    https://bugzilla.redhat.com/2467156
  • report
    https://bugzilla.redhat.com/2492269
  • report
    https://bugzilla.redhat.com/2492768
  • report
    https://bugzilla.redhat.com/2495941
  • report
    https://bugzilla.redhat.com/2502188
  • report
    https://bugzilla.redhat.com/2502321
  • report
    https://bugzilla.redhat.com/2502463
  • report
    https://bugzilla.redhat.com/2506790
  • report
    https://bugzilla.redhat.com/2507407
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-55764.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-74580.html