Skip to content
OpenAdvisories
High ALSA-2026:66180 17 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 9, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

* KSM to deduplicate only zero pages [almalinux-9.8.z] (JIRA:AlmaLinux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.46.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.46.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.46.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.46.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.46.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.46.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.46.1.el9_8

Vulnerabilities 17

  • Critical 9.8
    CVE-2026-43493

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests

    In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-53002

    netfilter: conntrack: remove sprintf usage

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-64597

    smb: client: fix double-free in SMB2_close() replay

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cle…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-72129

    nvmet-rdma: handle inline data with a nonzero offset

    In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74480

    net: bridge: stop fast-leave after deleting a port group

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, contin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-64034

    net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-46266

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

    In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-53275

    ipv6: mcast: Fix use-after-free when processing MLD queries

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.9
    CVE-2026-43133

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43339

    ipv6: prevent possible UaF in addrconf_permanent_addr()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46015

    tcp: call sk_data_ready() after listener migration

    In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46330

    Revert "net/smc: Introduce TCP ULP support"

    In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53366

    ipv4: account for fraggap on the paged allocation path

    In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + trans…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64563 Public exploit

    rhashtable: clear stale iter->p on table restart

    In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-46306

    flow_dissector: do not dissect PPPoE PFC frames

    In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46149

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-53223

    net: guard timestamp cmsgs to real error queue skbs

    In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-43133
  • report
    https://access.redhat.com/security/cve/CVE-2026-43339
  • report
    https://access.redhat.com/security/cve/CVE-2026-43493
  • report
    https://access.redhat.com/security/cve/CVE-2026-46015
  • report
    https://access.redhat.com/security/cve/CVE-2026-46149
  • report
    https://access.redhat.com/security/cve/CVE-2026-46266
  • report
    https://access.redhat.com/security/cve/CVE-2026-46306
  • report
    https://access.redhat.com/security/cve/CVE-2026-46330
  • report
    https://access.redhat.com/security/cve/CVE-2026-53002
  • report
    https://access.redhat.com/security/cve/CVE-2026-53223
  • report
    https://access.redhat.com/security/cve/CVE-2026-53275
  • report
    https://access.redhat.com/security/cve/CVE-2026-53366
  • report
    https://access.redhat.com/security/cve/CVE-2026-64034
  • report
    https://access.redhat.com/security/cve/CVE-2026-64563
  • report
    https://access.redhat.com/security/cve/CVE-2026-64597
  • report
    https://access.redhat.com/security/cve/CVE-2026-72129
  • report
    https://access.redhat.com/security/cve/CVE-2026-74480
  • report
    https://bugzilla.redhat.com/2467065
  • report
    https://bugzilla.redhat.com/2468102
  • report
    https://bugzilla.redhat.com/2479812
  • report
    https://bugzilla.redhat.com/2481936
  • report
    https://bugzilla.redhat.com/2482566
  • report
    https://bugzilla.redhat.com/2484456
  • report
    https://bugzilla.redhat.com/2486463
  • report
    https://bugzilla.redhat.com/2486999
  • report
    https://bugzilla.redhat.com/2492329
  • report
    https://bugzilla.redhat.com/2492811
  • report
    https://bugzilla.redhat.com/2492841
  • report
    https://bugzilla.redhat.com/2501252
  • report
    https://bugzilla.redhat.com/2502394
  • report
    https://bugzilla.redhat.com/2510892
  • report
    https://bugzilla.redhat.com/2511932
  • report
    https://bugzilla.redhat.com/2516731
  • report
    https://bugzilla.redhat.com/2517046
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-66180.html