Skip to content
OpenAdvisories
High ALSA-2026:64770 7 CVEs

Important: kernel-rt security update

Published Sep 8, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.160.1.rt7.501.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.160.1.rt7.501.el8_10

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-43493

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests

    In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-53002

    netfilter: conntrack: remove sprintf usage

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64007

    netfilter: synproxy: refresh tcphdr after skb_ensure_writable

    In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-72129

    nvmet-rdma: handle inline data with a nonzero offset

    In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74480

    net: bridge: stop fast-leave after deleting a port group

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, contin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-68343

    smb: client: validate DFS referral PathConsumed

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. Ho…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64563 Public exploit

    rhashtable: clear stale iter->p on table restart

    In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-43493
  • report
    https://access.redhat.com/security/cve/CVE-2026-53002
  • report
    https://access.redhat.com/security/cve/CVE-2026-64007
  • report
    https://access.redhat.com/security/cve/CVE-2026-64563
  • report
    https://access.redhat.com/security/cve/CVE-2026-68343
  • report
    https://access.redhat.com/security/cve/CVE-2026-72129
  • report
    https://access.redhat.com/security/cve/CVE-2026-74480
  • report
    https://bugzilla.redhat.com/2479812
  • report
    https://bugzilla.redhat.com/2492329
  • report
    https://bugzilla.redhat.com/2502361
  • report
    https://bugzilla.redhat.com/2510892
  • report
    https://bugzilla.redhat.com/2513373
  • report
    https://bugzilla.redhat.com/2516731
  • report
    https://bugzilla.redhat.com/2517046
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-64770.html