Skip to content
OpenAdvisories
High 1 exploited CVE ALSA-2026:71233 14 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 24, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
* kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266)
* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
* kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

Bug Fix(es) and Enhancement(s):

* kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298)
* sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247)
* [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283)
* RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

ReleasePackageFixed in
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.59.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.59.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.59.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.59.1.el10_2

Vulnerabilities 14

  • High 8.8
    CVE-2026-53266 Exploited Public exploit

    netfilter: bridge: make ebt_snat ARP rewrite writable

    In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2026-64383

    smb: client: fix double-free in SMB2_flush() replay

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-64564 Public exploit

    sctp: don't free the ASCONF's own transport in DEL-IP processing

    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74569

    netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-89846

    scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPAB…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-63831

    mac802154: llsec: add skb_cow_data() before in-place crypto

    In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cry…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-74469 Public exploit

    sctp: prevent peer transport count overflow

    In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-72243

    selinux: check connect-related permissions on TCP Fast Open

    In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are ch…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-63802

    blk-cgroup: fix UAF in __blkcg_rstat_flush()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64053

    block: don't overwrite bip_vcnt in bio_integrity_copy_user()

    In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68201

    ALSA: timer: drain a slave's callback before its master detaches it

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not it…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-81000 Public exploit

    net: tun: bound receive headroom

    In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23007 Public exploit

    block: zero non-PI portion of auto integrity buffer

    In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80844 Public exploit

    xfrm: ah6: validate routing header segments_left

    In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-23007
  • report
    https://access.redhat.com/security/cve/CVE-2026-53266
  • report
    https://access.redhat.com/security/cve/CVE-2026-63802
  • report
    https://access.redhat.com/security/cve/CVE-2026-63831
  • report
    https://access.redhat.com/security/cve/CVE-2026-64053
  • report
    https://access.redhat.com/security/cve/CVE-2026-64383
  • report
    https://access.redhat.com/security/cve/CVE-2026-64564
  • report
    https://access.redhat.com/security/cve/CVE-2026-68201
  • report
    https://access.redhat.com/security/cve/CVE-2026-72243
  • report
    https://access.redhat.com/security/cve/CVE-2026-74569
  • report
    https://access.redhat.com/security/cve/CVE-2026-80844
  • report
    https://access.redhat.com/security/cve/CVE-2026-81000
  • report
    https://access.redhat.com/security/cve/CVE-2026-89846
  • report
    https://bugzilla.redhat.com/2432674
  • report
    https://bugzilla.redhat.com/2485368
  • report
    https://bugzilla.redhat.com/2502243
  • report
    https://bugzilla.redhat.com/2502251
  • report
    https://bugzilla.redhat.com/2502498
  • report
    https://bugzilla.redhat.com/2507134
  • report
    https://bugzilla.redhat.com/2510890
  • report
    https://bugzilla.redhat.com/2513481
  • report
    https://bugzilla.redhat.com/2516684
  • report
    https://bugzilla.redhat.com/2517052
  • report
    https://bugzilla.redhat.com/2528676
  • report
    https://bugzilla.redhat.com/2532176
  • report
    https://bugzilla.redhat.com/2535391
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-71233.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-74469.html