Skip to content
OpenAdvisories
High ALSA-2026:71329 5 CVEs

Important: kernel security update

Published Sep 24, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
* kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
* kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
* kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.168.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.168.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.168.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.168.1.el8_10

Vulnerabilities 5

  • Critical 9.8
    CVE-2026-80714

    ipvs: do not propagate one-packet flag to synced conns

    In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-31566

    drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job com…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-52912

    netfilter: nf_queue: hold bridge skb->dev while queued

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only ho…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68121 Public exploit

    pppoe: reload header pointer after dev_hard_header()

    In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-89480

    nvme-tcp: reject a read that transferred too few bytes

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received again…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-31566
  • report
    https://access.redhat.com/security/cve/CVE-2026-52912
  • report
    https://access.redhat.com/security/cve/CVE-2026-68121
  • report
    https://access.redhat.com/security/cve/CVE-2026-80714
  • report
    https://access.redhat.com/security/cve/CVE-2026-89480
  • report
    https://bugzilla.redhat.com/2461451
  • report
    https://bugzilla.redhat.com/2492105
  • report
    https://bugzilla.redhat.com/2513233
  • report
    https://bugzilla.redhat.com/2532095
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-71329.html