Skip to content
OpenAdvisories
High ALSA-2026:75746 29 CVEs

Important: kernel-rt security, bug fix, and enhancement update

Published Oct 5, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
* kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
* kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
* kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
* kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
* kernel: gfs2: add some missing log locking (CVE-2026-53049)
* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
* kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
* kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
* kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
* kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
* kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
* kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
* kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
* kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
* kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

* AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
* AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
* [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.171.1.rt7.512.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.171.1.rt7.512.el8_10

Vulnerabilities 29

  • Critical 9.8
    CVE-2026-53049

    gfs2: add some missing log locking

    In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-63994

    tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

    In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-74569

    netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74669

    ipvs: clear IPv4 options after rebasing tunnel ICMP errors

    In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74744

    ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74746

    netfilter: flowtable: publish GC-visible tuple last

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89972

    nvme: add missing SRCU grace period in error path

    In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-63992

    tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

    In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-63829

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-68432

    vxlan: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-72052

    net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-80921

    KVM: s390: vsie: zero stale crypto bits

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-53230

    net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. Whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-74516

    KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a sep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50756

    nvme-pci: fix mempool alloc size

    In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-54048

    RDMA/bnxt_re: Prevent handling any completions after qp destroy

    In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23105

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

    In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-45861

    gfs2: Fix slab-use-after-free in qd_put

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46319

    net/sched: act_ct: Only release RCU read lock after ct_ft

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-53270

    ipvs: clear the svc scheduler ptr early on edit

    In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-72255

    netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-90227

    nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

    In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-89481

    nvme-tcp: fix host memory disclosure on R2T for a read command

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-97417

    netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2025-39994

    media: tuner: xc5000: Fix use-after-free in xc5000_release

    In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep ha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-45856

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

    In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2025-40242

    gfs2: Fix unlikely race in gdlm_put_lock

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that wi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2026-52972

    crypto: af_alg - Cap AEAD AD length to 0x80000000

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-63794

    KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-50756
  • report
    https://access.redhat.com/security/cve/CVE-2023-54048
  • report
    https://access.redhat.com/security/cve/CVE-2025-39994
  • report
    https://access.redhat.com/security/cve/CVE-2025-40242
  • report
    https://access.redhat.com/security/cve/CVE-2026-23105
  • report
    https://access.redhat.com/security/cve/CVE-2026-45856
  • report
    https://access.redhat.com/security/cve/CVE-2026-45861
  • report
    https://access.redhat.com/security/cve/CVE-2026-46319
  • report
    https://access.redhat.com/security/cve/CVE-2026-52972
  • report
    https://access.redhat.com/security/cve/CVE-2026-53049
  • report
    https://access.redhat.com/security/cve/CVE-2026-53230
  • report
    https://access.redhat.com/security/cve/CVE-2026-53270
  • report
    https://access.redhat.com/security/cve/CVE-2026-63794
  • report
    https://access.redhat.com/security/cve/CVE-2026-63829
  • report
    https://access.redhat.com/security/cve/CVE-2026-63992
  • report
    https://access.redhat.com/security/cve/CVE-2026-63994
  • report
    https://access.redhat.com/security/cve/CVE-2026-68432
  • report
    https://access.redhat.com/security/cve/CVE-2026-72052
  • report
    https://access.redhat.com/security/cve/CVE-2026-72255
  • report
    https://access.redhat.com/security/cve/CVE-2026-74516
  • report
    https://access.redhat.com/security/cve/CVE-2026-74569
  • report
    https://access.redhat.com/security/cve/CVE-2026-74669
  • report
    https://access.redhat.com/security/cve/CVE-2026-74744
  • report
    https://access.redhat.com/security/cve/CVE-2026-74746
  • report
    https://access.redhat.com/security/cve/CVE-2026-80921
  • report
    https://access.redhat.com/security/cve/CVE-2026-89481
  • report
    https://access.redhat.com/security/cve/CVE-2026-89972
  • report
    https://access.redhat.com/security/cve/CVE-2026-90227
  • report
    https://access.redhat.com/security/cve/CVE-2026-97417
  • report
    https://bugzilla.redhat.com/2404123
  • report
    https://bugzilla.redhat.com/2418819
  • report
    https://bugzilla.redhat.com/2425013
  • report
    https://bugzilla.redhat.com/2425209
  • report
    https://bugzilla.redhat.com/2436789
  • report
    https://bugzilla.redhat.com/2482129
  • report
    https://bugzilla.redhat.com/2482143
  • report
    https://bugzilla.redhat.com/2486979
  • report
    https://bugzilla.redhat.com/2492276
  • report
    https://bugzilla.redhat.com/2492364