Skip to content
OpenAdvisories
High ALSA-2026:68531 22 CVEs

Important: kernel security update

Published Sep 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.164.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.164.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.164.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.164.1.el8_10

Vulnerabilities 22

  • Critical 9.8
    CVE-2026-53176

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-53228

    ipv6: sit: reload inner IPv6 header after GSO offloads

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68426

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-53131

    netfilter: require Ethernet MAC header before using eth_hdr()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46266

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

    In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-53075 Public exploit

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

    In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-53275

    ipv6: mcast: Fix use-after-free when processing MLD queries

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63917

    ip6: vti: Use ip6_tnl.net in vti6_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63919

    xfrm: input: hold netns during deferred transport reinjection

    In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63921

    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.3
    CVE-2026-52920

    netfilter: xt_policy: fix strict mode inbound policy matching

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-43233

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-53268

    netfilter: conntrack_irc: fix possible out-of-bounds read

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23103

    ipvlan: Make the addrs_lock be per port

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31663

    xfrm: hold dev ref until after transport_finish NF_HOOK

    In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43339

    ipv6: prevent possible UaF in addrconf_permanent_addr()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53192

    ALSA: timer: Fix UAF at snd_timer_user_params()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53239

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64002

    ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68143

    net: slip: serialize receive against buffer reallocation

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46306

    flow_dissector: do not dissect PPPoE PFC frames

    In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-53223

    net: guard timestamp cmsgs to real error queue skbs

    In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-23103
  • report
    https://access.redhat.com/security/cve/CVE-2026-31663
  • report
    https://access.redhat.com/security/cve/CVE-2026-43233
  • report
    https://access.redhat.com/security/cve/CVE-2026-43339
  • report
    https://access.redhat.com/security/cve/CVE-2026-46266
  • report
    https://access.redhat.com/security/cve/CVE-2026-46306
  • report
    https://access.redhat.com/security/cve/CVE-2026-52920
  • report
    https://access.redhat.com/security/cve/CVE-2026-53075
  • report
    https://access.redhat.com/security/cve/CVE-2026-53131
  • report
    https://access.redhat.com/security/cve/CVE-2026-53176
  • report
    https://access.redhat.com/security/cve/CVE-2026-53192
  • report
    https://access.redhat.com/security/cve/CVE-2026-53223
  • report
    https://access.redhat.com/security/cve/CVE-2026-53228
  • report
    https://access.redhat.com/security/cve/CVE-2026-53239
  • report
    https://access.redhat.com/security/cve/CVE-2026-53268
  • report
    https://access.redhat.com/security/cve/CVE-2026-53275
  • report
    https://access.redhat.com/security/cve/CVE-2026-63917
  • report
    https://access.redhat.com/security/cve/CVE-2026-63919
  • report
    https://access.redhat.com/security/cve/CVE-2026-63921
  • report
    https://access.redhat.com/security/cve/CVE-2026-64002
  • report
    https://access.redhat.com/security/cve/CVE-2026-68143
  • report
    https://access.redhat.com/security/cve/CVE-2026-68426
  • report
    https://bugzilla.redhat.com/2436771
  • report
    https://bugzilla.redhat.com/2461462
  • report
    https://bugzilla.redhat.com/2467135
  • report
    https://bugzilla.redhat.com/2468102
  • report
    https://bugzilla.redhat.com/2484456
  • report
    https://bugzilla.redhat.com/2486463
  • report
    https://bugzilla.redhat.com/2492112
  • report
    https://bugzilla.redhat.com/2492295
  • report
    https://bugzilla.redhat.com/2492733
  • report
    https://bugzilla.redhat.com/2492741
  • report
    https://bugzilla.redhat.com/2492747
  • report
    https://bugzilla.redhat.com/2492770
  • report
    https://bugzilla.redhat.com/2492779
  • report
    https://bugzilla.redhat.com/2492792
  • report
    https://bugzilla.redhat.com/2492811
  • report
    https://bugzilla.redhat.com/2492841
  • report
    https://bugzilla.redhat.com/2502363