Skip to content
OpenAdvisories
High ALSA-2026:61887 37 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 1, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)
* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
* kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)
* kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
* kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
* kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
* kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
* kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
* kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)
* kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
* kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
* kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
* kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
* kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
* kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
* kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
* kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
* kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
* kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
* kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)
* kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)
* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
* kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
* kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
* kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)
* kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
* kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
* kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)
* kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)
* kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

Bug Fix(es) and Enhancement(s):

* AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180)
* qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043)
* ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393)
* [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627)
* AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.50.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.50.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.50.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.50.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.50.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.50.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.50.1.el10_2

Vulnerabilities 37

  • Critical 9.8
    CVE-2026-53399

    nfsd: release layout stid on setlease failure

    In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-63800

    pNFS: Fix use-after-free in pnfs_update_layout()

    In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_pu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64136

    smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64384

    smb: client: fix change notify replay double-free

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, clea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-72069

    locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

    In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-72130

    nvmet-auth: reject short AUTH_RECEIVE buffers

    In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.3
    CVE-2026-64018

    net: mana: validate rx_req_idx to prevent out-of-bounds array access

    In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-S…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-64320

    nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

    In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-53053

    iommu/amd: Fix clone_alias() to use the original device's devid

    In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64438

    crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info)…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-64490

    ALSA: virtio: Validate control metadata from the device

    In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43408

    ceph: add a bunch of missing ceph_path_info initializers

    In the Linux kernel, the following vulnerability has been resolved: ceph: add a bunch of missing ceph_path_info initializers ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43454

    netfilter: nf_tables: Fix for duplicate device in netdev hooks

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix for duplicate device in netdev hooks When handling NETDEV_REGISTER notification, duplicate device registration must be avoided since the device may have been added b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45970

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down

    In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46120

    ip6_gre: Use cached t->net in ip6erspan_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53153

    mm/list_lru: drain before clearing xarray entry on reparent

    In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53185

    zram: fix use-after-free in zram_bvec_write_partial()

    In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53189

    mm/huge_memory: update file PMD counter before folio_put()

    In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64189

    netfilter: ipset: fix race between dump and ip_set_list resize

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64276

    Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

    In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64277

    Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

    In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64304

    crypto: qat - validate RSA CRT component lengths

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64418

    mm: shrinker: fix shrinker_info teardown race with expansion

    In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() ye…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-23003 Public exploit

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-53026

    NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

    In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access shou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-53391

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

    In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then imme…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-53392

    NFSv4/flexfiles: reject zero filehandle version count

    In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzal…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-53397

    nfsd: fix posix_acl leak on SETACL decode failure

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-64298

    NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

    In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regard…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-53196

    USB: serial: io_ti: fix heap overflow in get_manuf_info()

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-53685

    ceph: give up on paths longer than PATH_MAX

    In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, e…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-21834

    seccomp: passthrough uretprobe systemcall without filtering

    In the Linux kernel, the following vulnerability has been resolved: seccomp: passthrough uretprobe systemcall without filtering When attaching uretprobes to processes running inside docker, the attached process is segfaulted when encountering the retprobe. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43419

    ceph: fix memory leaks in ceph_mdsc_build_path()

    In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leaks in ceph_mdsc_build_path() Add __putname() calls to error code paths that did not free the "path" pointer obtained by __getname(). If ownership of this pointer is not pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-43450

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helpe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68086

    mm/khugepaged: write all dirty file folios when collapsing

    In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68166

    userfaultfd: prevent registration of special VMAs

    In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, disca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68480

    x86/bugs: Make Safe-RET robust against interrupt injection

    In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-21834
  • report
    https://access.redhat.com/security/cve/CVE-2026-23003
  • report
    https://access.redhat.com/security/cve/CVE-2026-43450
  • report
    https://access.redhat.com/security/cve/CVE-2026-43454
  • report
    https://access.redhat.com/security/cve/CVE-2026-45970
  • report
    https://access.redhat.com/security/cve/CVE-2026-46120
  • report
    https://access.redhat.com/security/cve/CVE-2026-53026
  • report
    https://access.redhat.com/security/cve/CVE-2026-53053
  • report
    https://access.redhat.com/security/cve/CVE-2026-53153
  • report
    https://access.redhat.com/security/cve/CVE-2026-53185
  • report
    https://access.redhat.com/security/cve/CVE-2026-53189
  • report
    https://access.redhat.com/security/cve/CVE-2026-53196
  • report
    https://access.redhat.com/security/cve/CVE-2026-53391
  • report
    https://access.redhat.com/security/cve/CVE-2026-53392
  • report
    https://access.redhat.com/security/cve/CVE-2026-53397
  • report
    https://access.redhat.com/security/cve/CVE-2026-53399
  • report
    https://access.redhat.com/security/cve/CVE-2026-63800
  • report
    https://access.redhat.com/security/cve/CVE-2026-64018
  • report
    https://access.redhat.com/security/cve/CVE-2026-64136
  • report
    https://access.redhat.com/security/cve/CVE-2026-64189
  • report
    https://access.redhat.com/security/cve/CVE-2026-64276
  • report
    https://access.redhat.com/security/cve/CVE-2026-64277
  • report
    https://access.redhat.com/security/cve/CVE-2026-64298
  • report
    https://access.redhat.com/security/cve/CVE-2026-64304
  • report
    https://access.redhat.com/security/cve/CVE-2026-64320
  • report
    https://access.redhat.com/security/cve/CVE-2026-64384
  • report
    https://access.redhat.com/security/cve/CVE-2026-64418
  • report
    https://access.redhat.com/security/cve/CVE-2026-64438
  • report
    https://access.redhat.com/security/cve/CVE-2026-64490
  • report
    https://access.redhat.com/security/cve/CVE-2026-68086
  • report
    https://access.redhat.com/security/cve/CVE-2026-68166
  • report
    https://access.redhat.com/security/cve/CVE-2026-68480
  • report
    https://access.redhat.com/security/cve/CVE-2026-72069
  • report
    https://access.redhat.com/security/cve/CVE-2026-72130
  • report
    https://bugzilla.redhat.com/2350398
  • report
    https://bugzilla.redhat.com/2432681
  • report
    https://bugzilla.redhat.com/2468145
  • report
    https://bugzilla.redhat.com/2468228
  • report
    https://bugzilla.redhat.com/2482006