Skip to content
OpenAdvisories
High ALSA-2026:72624 10 CVEs

Important: kernel security, bug fix, and enhancement update

Published Sep 28, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)
* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
* kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

Bug Fix(es) and Enhancement(s):

* KVM: s390: Limit adapter indicator access to mapped page [almalinux-10.2.z] (JIRA:AlmaLinux-188661)
* crypto: xxhash64 should not be fips approved [almalinux-10.2.z] (JIRA:AlmaLinux-254943)
* kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:AlmaLinux-260402)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.61.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.61.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.61.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.61.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.61.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.61.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.61.1.el10_2

Vulnerabilities 10

  • Critical 9.3
    CVE-2026-89775

    KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-46317

    KVM: arm64: Reassign nested_mmus array behind mmu_lock

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unma…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.9
    CVE-2026-46076

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1

    In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45942

    ext4: fix e4b bitmap inconsistency reports

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53341

    fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

    In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that means the mount can concurrently be unmounted, and the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64556

    perf/core: Detach event groups during remove_on_exec

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the conte…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-74753

    perf: Reject exited events as group leaders

    In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-80522

    crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

    In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The cu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68299

    vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

    In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-89480

    nvme-tcp: reject a read that transferred too few bytes

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received again…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-45942
  • report
    https://access.redhat.com/security/cve/CVE-2026-46076
  • report
    https://access.redhat.com/security/cve/CVE-2026-46317
  • report
    https://access.redhat.com/security/cve/CVE-2026-53341
  • report
    https://access.redhat.com/security/cve/CVE-2026-64556
  • report
    https://access.redhat.com/security/cve/CVE-2026-68299
  • report
    https://access.redhat.com/security/cve/CVE-2026-74753
  • report
    https://access.redhat.com/security/cve/CVE-2026-80522
  • report
    https://access.redhat.com/security/cve/CVE-2026-89480
  • report
    https://access.redhat.com/security/cve/CVE-2026-89775
  • report
    https://bugzilla.redhat.com/2481992
  • report
    https://bugzilla.redhat.com/2482104
  • report
    https://bugzilla.redhat.com/2486976
  • report
    https://bugzilla.redhat.com/2495938
  • report
    https://bugzilla.redhat.com/2508319
  • report
    https://bugzilla.redhat.com/2513356
  • report
    https://bugzilla.redhat.com/2524423
  • report
    https://bugzilla.redhat.com/2524434
  • report
    https://bugzilla.redhat.com/2532095
  • report
    https://bugzilla.redhat.com/2535049
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-72624.html