Skip to content
OpenAdvisories
High ALSA-2026:67468 11 CVEs

Important: kernel security update

Published Sep 15, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
* kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
* kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
* kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
* kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.163.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.163.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.163.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.163.1.el8_10

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-72098

    dm-verity: fix buffer overflow in FEC calculation

    In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer overflow in FEC calculation There's a buffer overflow in dm-verity-fec: if (neras && *neras <= v->fec->roots) fio->erasures[(*neras)++] = i; This allows *neras to reach …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74556

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64117

    wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee802…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-63889

    scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.9
    CVE-2026-43133

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52947

    net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53182

    wifi: nl80211: reject oversized EMA RNR lists

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-63802

    blk-cgroup: fix UAF in __blkcg_rstat_flush()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-71127

    wifi: mac80211: Discard Beacon frames to non-broadcast address

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-53161

    EDAC/bluefield: Fix potential integer overflow

    In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-53161
  • report
    https://access.redhat.com/security/cve/CVE-2025-71127
  • report
    https://access.redhat.com/security/cve/CVE-2026-43133
  • report
    https://access.redhat.com/security/cve/CVE-2026-52947
  • report
    https://access.redhat.com/security/cve/CVE-2026-53182
  • report
    https://access.redhat.com/security/cve/CVE-2026-63802
  • report
    https://access.redhat.com/security/cve/CVE-2026-63889
  • report
    https://access.redhat.com/security/cve/CVE-2026-64117
  • report
    https://access.redhat.com/security/cve/CVE-2026-68363
  • report
    https://access.redhat.com/security/cve/CVE-2026-72098
  • report
    https://access.redhat.com/security/cve/CVE-2026-74556
  • report
    https://bugzilla.redhat.com/2333977
  • report
    https://bugzilla.redhat.com/2429587
  • report
    https://bugzilla.redhat.com/2467065
  • report
    https://bugzilla.redhat.com/2492432
  • report
    https://bugzilla.redhat.com/2492722
  • report
    https://bugzilla.redhat.com/2502251
  • report
    https://bugzilla.redhat.com/2502320
  • report
    https://bugzilla.redhat.com/2502477
  • report
    https://bugzilla.redhat.com/2513286
  • report
    https://bugzilla.redhat.com/2516501
  • report
    https://bugzilla.redhat.com/2517010
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-67468.html