Important: kernel security, bug fix, and enhancement update

Summary

Fixed packages 62

Vulnerabilities 12

• High 7.8
  CVE-2025-39964 Exploited Public exploit

  crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

  In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 13, 2025

  KEV Sep 18, 2026
• Critical 9.8
  CVE-2026-64534

  nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 27, 2026
• Critical 9.8
  CVE-2026-68159

  libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

  In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• High 7.8
  CVE-2026-45894

  iommu/vt-d: Clear Present bit before tearing down PASID entry

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 27, 2026
• High 7.8
  CVE-2026-45959

  crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` at…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 27, 2026
• High 7.8
  CVE-2026-53062

  dm cache policy smq: fix missing locks in invalidating cache blocks

  In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 24, 2026
• High 7.8
  CVE-2026-63823

  keys: Pin request_key_auth payload in instantiate paths

  In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 19, 2026
• High 7.8
  CVE-2026-68391

  Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.8
  CVE-2026-74518

  mm/hugetlb: fix list corruption in allocate_file_region_entries()

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 15, 2026
• High 7.5
  CVE-2026-68155

  libceph: Reject monmaps advertising zero monitors

  In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026
• High 7.1
  CVE-2026-68293

  net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 10, 2026
• Unscored —
  CVE-2026-68188

  Bluetooth: RFCOMM: Fix session UAF in set_termios

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 10, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2025-39964
• report
  https://access.redhat.com/security/cve/CVE-2026-45894
• report
  https://access.redhat.com/security/cve/CVE-2026-45959
• report
  https://access.redhat.com/security/cve/CVE-2026-53062
• report
  https://access.redhat.com/security/cve/CVE-2026-63823
• report
  https://access.redhat.com/security/cve/CVE-2026-64534
• report
  https://access.redhat.com/security/cve/CVE-2026-68155
• report
  https://access.redhat.com/security/cve/CVE-2026-68159
• report
  https://access.redhat.com/security/cve/CVE-2026-68188
• report
  https://access.redhat.com/security/cve/CVE-2026-68293
• report
  https://access.redhat.com/security/cve/CVE-2026-68391
• report
  https://access.redhat.com/security/cve/CVE-2026-74518
• report
  https://bugzilla.redhat.com/2403545
• report
  https://bugzilla.redhat.com/2481940
• report
  https://bugzilla.redhat.com/2481948
• report
  https://bugzilla.redhat.com/2492278
• report
  https://bugzilla.redhat.com/2502218
• report
  https://bugzilla.redhat.com/2507399
• report
  https://bugzilla.redhat.com/2513150
• report
  https://bugzilla.redhat.com/2513165
• report
  https://bugzilla.redhat.com/2513222
• report
  https://bugzilla.redhat.com/2513295
• report
  https://bugzilla.redhat.com/2513453
• report
  https://bugzilla.redhat.com/2517004
• advisory
  https://errata.almalinux.org/10/ALSA-2026-70498.html