Skip to content
OpenAdvisories
High ALSA-2026:68507 19 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)
* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
* kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
* kernel: netfilter: handle unreadable frags (CVE-2026-64414)
* kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)
* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

Bug Fix(es) and Enhancement(s):

* nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776)
* AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z] (JIRA:AlmaLinux-254105)
* RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225)
* RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516)
* RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518)
* RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.56.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.56.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.56.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.56.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.56.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.56.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.56.1.el10_2

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-53176

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63923

    octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68128

    ice: reject out-of-range ptype in ice_parser_profile_init

    In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68294

    net: qrtr: restrict socket creation to the initial network namespace

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-23172

    net: wwan: t7xx: fix potential skb->frags overflow in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-64176

    wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52971

    net: ena: PHC: Fix potential use-after-free in get_timestamp

    In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53192

    ALSA: timer: Fix UAF at snd_timer_user_params()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53193

    ALSA: timer: Forcibly close timer instances at closing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64029

    ALSA: seq: Serialize UMP output teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68143

    net: slip: serialize receive against buffer reallocation

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68200

    ALSA: timer: don't re-enter an instance callback that is still running

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-72102

    dm_early_create: fix freeing used table on dm_resume failure

    In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.7
    CVE-2026-64456

    hwrng: virtio: clamp device-reported used.len at copy_data()

    In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-63869

    wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-64175

    wifi: iwlwifi: mld: stop TX during firmware restart

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-64414

    netfilter: handle unreadable frags

    In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-58007

    soc: qcom: socinfo: Avoid out of bounds read of serial number

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-58007
  • report
    https://access.redhat.com/security/cve/CVE-2026-23172
  • report
    https://access.redhat.com/security/cve/CVE-2026-52971
  • report
    https://access.redhat.com/security/cve/CVE-2026-53176
  • report
    https://access.redhat.com/security/cve/CVE-2026-53192
  • report
    https://access.redhat.com/security/cve/CVE-2026-53193
  • report
    https://access.redhat.com/security/cve/CVE-2026-63869
  • report
    https://access.redhat.com/security/cve/CVE-2026-63923
  • report
    https://access.redhat.com/security/cve/CVE-2026-64029
  • report
    https://access.redhat.com/security/cve/CVE-2026-64175
  • report
    https://access.redhat.com/security/cve/CVE-2026-64176
  • report
    https://access.redhat.com/security/cve/CVE-2026-64414
  • report
    https://access.redhat.com/security/cve/CVE-2026-64456
  • report
    https://access.redhat.com/security/cve/CVE-2026-68128
  • report
    https://access.redhat.com/security/cve/CVE-2026-68143
  • report
    https://access.redhat.com/security/cve/CVE-2026-68200
  • report
    https://access.redhat.com/security/cve/CVE-2026-68294
  • report
    https://access.redhat.com/security/cve/CVE-2026-68363
  • report
    https://access.redhat.com/security/cve/CVE-2026-72102
  • report
    https://bugzilla.redhat.com/2348565
  • report
    https://bugzilla.redhat.com/2439924
  • report
    https://bugzilla.redhat.com/2492436
  • report
    https://bugzilla.redhat.com/2492741
  • report
    https://bugzilla.redhat.com/2492742
  • report
    https://bugzilla.redhat.com/2492792
  • report
    https://bugzilla.redhat.com/2502295
  • report
    https://bugzilla.redhat.com/2502347
  • report
    https://bugzilla.redhat.com/2502418
  • report
    https://bugzilla.redhat.com/2502575
  • report
    https://bugzilla.redhat.com/2502596
  • report
    https://bugzilla.redhat.com/2507102
  • report
    https://bugzilla.redhat.com/2507255
  • report
    https://bugzilla.redhat.com/2513171
  • report
    https://bugzilla.redhat.com/2513218
  • report
    https://bugzilla.redhat.com/2513271
  • report
    https://bugzilla.redhat.com/2513286
  • report
    https://bugzilla.redhat.com/2513353
  • report
    https://bugzilla.redhat.com/2516490
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-68507.html