Skip to content
OpenAdvisories
High ALSA-2026:59723 13 CVEs

Important: kernel security, bug fix, and enhancement update

Published Aug 26, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

* [AlmaLinux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-166118)
* ss core dumped when there is an SCTP session [almalinux-9.8.z] (JIRA:AlmaLinux-212398)
* [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [almalinux-9.8.z] (JIRA:AlmaLinux-245333)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.42.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.42.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.42.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.42.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.42.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.42.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.42.1.el9_8

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-52924 Public exploit

    sctp: purge outqueue on stale COOKIE-ECHO handling

    In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74581

    net: ipv6: clear suppressed fib6 rule result

    In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule sup…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-43114

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.4
    CVE-2026-53131

    netfilter: require Ethernet MAC header before using eth_hdr()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-52920

    netfilter: xt_policy: fix strict mode inbound policy matching

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-53268

    netfilter: conntrack_irc: fix possible out-of-bounds read

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53185

    zram: fix use-after-free in zram_bvec_write_partial()

    In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64189

    netfilter: ipset: fix race between dump and ip_set_list resize

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64191

    i2c: stub: Reject I2C block transfers with invalid length

    In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64276

    Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

    In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64277

    Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

    In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-23003 Public exploit

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68211

    ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

    In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-68211
  • report
    https://access.redhat.com/security/cve/CVE-2026-23003
  • report
    https://access.redhat.com/security/cve/CVE-2026-43114
  • report
    https://access.redhat.com/security/cve/CVE-2026-52920
  • report
    https://access.redhat.com/security/cve/CVE-2026-52924
  • report
    https://access.redhat.com/security/cve/CVE-2026-53131
  • report
    https://access.redhat.com/security/cve/CVE-2026-53185
  • report
    https://access.redhat.com/security/cve/CVE-2026-53268
  • report
    https://access.redhat.com/security/cve/CVE-2026-64189
  • report
    https://access.redhat.com/security/cve/CVE-2026-64191
  • report
    https://access.redhat.com/security/cve/CVE-2026-64276
  • report
    https://access.redhat.com/security/cve/CVE-2026-64277
  • report
    https://access.redhat.com/security/cve/CVE-2026-74581
  • report
    https://bugzilla.redhat.com/2422696
  • report
    https://bugzilla.redhat.com/2432681
  • report
    https://bugzilla.redhat.com/2466994
  • report
    https://bugzilla.redhat.com/2492095
  • report
    https://bugzilla.redhat.com/2492112
  • report
    https://bugzilla.redhat.com/2492735
  • report
    https://bugzilla.redhat.com/2492747
  • report
    https://bugzilla.redhat.com/2492770
  • report
    https://bugzilla.redhat.com/2502872
  • report
    https://bugzilla.redhat.com/2502889
  • report
    https://bugzilla.redhat.com/2507290
  • report
    https://bugzilla.redhat.com/2507301
  • report
    https://bugzilla.redhat.com/2520980
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-59723.html