Skip to content
OpenAdvisories
High ALSA-2026:68570 31 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
* kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
* kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

* gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540)
* The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544)
* gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986)
* [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217)
* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.49.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.49.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.49.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.49.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.49.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.49.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.49.1.el9_8

Vulnerabilities 31

  • Critical 9.8
    CVE-2026-53176

    IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68159

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68426

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46043

    RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63917

    ip6: vti: Use ip6_tnl.net in vti6_changelink().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63919

    xfrm: input: hold netns during deferred transport reinjection

    In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63921

    ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

    In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68128

    ice: reject out-of-range ptype in ice_parser_profile_init

    In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-72003

    wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-23172

    net: wwan: t7xx: fix potential skb->frags overflow in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-72243

    selinux: check connect-related permissions on TCP Fast Open

    In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are ch…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-72298

    net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-63913

    netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-64176

    wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31663

    xfrm: hold dev ref until after transport_finish NF_HOOK

    In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45910

    RDMA/rxe: Fix race condition in QP timer handlers

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swappe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-52971

    net: ena: PHC: Fix potential use-after-free in get_timestamp

    In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53192

    ALSA: timer: Fix UAF at snd_timer_user_params()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53193

    ALSA: timer: Forcibly close timer instances at closing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53239

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64029

    ALSA: seq: Serialize UMP output teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64582

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68200

    ALSA: timer: don't re-enter an instance callback that is still running

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-72102

    dm_early_create: fix freeing used table on dm_resume failure

    In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.6
    CVE-2026-63869

    wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-46114

    RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)paylo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-46133

    RDMA/rxe: Reject unknown opcodes before ICRC processing

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-64175

    wifi: iwlwifi: mld: stop TX during firmware restart

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.8
    CVE-2026-53196

    USB: serial: io_ti: fix heap overflow in get_manuf_info()

    In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-64174

    wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MB…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68363

    wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-23172
  • report
    https://access.redhat.com/security/cve/CVE-2026-31663
  • report
    https://access.redhat.com/security/cve/CVE-2026-45910
  • report
    https://access.redhat.com/security/cve/CVE-2026-46043
  • report
    https://access.redhat.com/security/cve/CVE-2026-46114
  • report
    https://access.redhat.com/security/cve/CVE-2026-46133
  • report
    https://access.redhat.com/security/cve/CVE-2026-52971
  • report
    https://access.redhat.com/security/cve/CVE-2026-53176
  • report
    https://access.redhat.com/security/cve/CVE-2026-53192
  • report
    https://access.redhat.com/security/cve/CVE-2026-53193
  • report
    https://access.redhat.com/security/cve/CVE-2026-53196
  • report
    https://access.redhat.com/security/cve/CVE-2026-53239
  • report
    https://access.redhat.com/security/cve/CVE-2026-63869
  • report
    https://access.redhat.com/security/cve/CVE-2026-63913
  • report
    https://access.redhat.com/security/cve/CVE-2026-63917
  • report
    https://access.redhat.com/security/cve/CVE-2026-63919
  • report
    https://access.redhat.com/security/cve/CVE-2026-63921
  • report
    https://access.redhat.com/security/cve/CVE-2026-64029
  • report
    https://access.redhat.com/security/cve/CVE-2026-64174
  • report
    https://access.redhat.com/security/cve/CVE-2026-64175
  • report
    https://access.redhat.com/security/cve/CVE-2026-64176
  • report
    https://access.redhat.com/security/cve/CVE-2026-64582
  • report
    https://access.redhat.com/security/cve/CVE-2026-68128
  • report
    https://access.redhat.com/security/cve/CVE-2026-68159
  • report
    https://access.redhat.com/security/cve/CVE-2026-68200
  • report
    https://access.redhat.com/security/cve/CVE-2026-68363
  • report
    https://access.redhat.com/security/cve/CVE-2026-68426
  • report
    https://access.redhat.com/security/cve/CVE-2026-72003
  • report
    https://access.redhat.com/security/cve/CVE-2026-72102
  • report
    https://access.redhat.com/security/cve/CVE-2026-72243
  • report
    https://access.redhat.com/security/cve/CVE-2026-72298
  • report
    https://bugzilla.redhat.com/2439924
  • report
    https://bugzilla.redhat.com/2461462
  • report
    https://bugzilla.redhat.com/2482098
  • report
    https://bugzilla.redhat.com/2482127
  • report
    https://bugzilla.redhat.com/2482550
  • report
    https://bugzilla.redhat.com/2482618
  • report
    https://bugzilla.redhat.com/2492436
  • report
    https://bugzilla.redhat.com/2492741