Skip to content
OpenAdvisories
High 1 exploited CVE ALSA-2026:70459 13 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 22, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)
* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)
* kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

* [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003)
* AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-9.8.z] (JIRA:AlmaLinux-254108)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.50.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.50.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.50.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.50.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.50.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.50.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.50.1.el9_8

Vulnerabilities 13

  • High 7.8
    CVE-2025-39964 Exploited Public exploit

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-68156

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

    In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-45894

    iommu/vt-d: Clear Present bit before tearing down PASID entry

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45959

    crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` at…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-53062

    dm cache policy smq: fix missing locks in invalidating cache blocks

    In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63823

    keys: Pin request_key_auth payload in instantiate paths

    In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68391

    Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-72072

    net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74518

    mm/hugetlb: fix list corruption in allocate_file_region_entries()

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-68155

    libceph: Reject monmaps advertising zero monitors

    In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68157

    libceph: guard missing CRUSH type name lookup

    In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_imme…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-68293

    net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68188

    Bluetooth: RFCOMM: Fix session UAF in set_termios

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-39964
  • report
    https://access.redhat.com/security/cve/CVE-2026-45894
  • report
    https://access.redhat.com/security/cve/CVE-2026-45959
  • report
    https://access.redhat.com/security/cve/CVE-2026-53062
  • report
    https://access.redhat.com/security/cve/CVE-2026-63823
  • report
    https://access.redhat.com/security/cve/CVE-2026-68155
  • report
    https://access.redhat.com/security/cve/CVE-2026-68156
  • report
    https://access.redhat.com/security/cve/CVE-2026-68157
  • report
    https://access.redhat.com/security/cve/CVE-2026-68188
  • report
    https://access.redhat.com/security/cve/CVE-2026-68293
  • report
    https://access.redhat.com/security/cve/CVE-2026-68391
  • report
    https://access.redhat.com/security/cve/CVE-2026-72072
  • report
    https://access.redhat.com/security/cve/CVE-2026-74518
  • report
    https://bugzilla.redhat.com/2403545
  • report
    https://bugzilla.redhat.com/2481940
  • report
    https://bugzilla.redhat.com/2481948
  • report
    https://bugzilla.redhat.com/2492278
  • report
    https://bugzilla.redhat.com/2502218
  • report
    https://bugzilla.redhat.com/2513150
  • report
    https://bugzilla.redhat.com/2513212
  • report
    https://bugzilla.redhat.com/2513222
  • report
    https://bugzilla.redhat.com/2513232
  • report
    https://bugzilla.redhat.com/2513295
  • report
    https://bugzilla.redhat.com/2513453
  • report
    https://bugzilla.redhat.com/2516523
  • report
    https://bugzilla.redhat.com/2517004
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-70459.html