Skip to content
OpenAdvisories
High ALSA-2026:81406 11 CVEs

Important: kernel security, bug fix, and enhancement update

Published Oct 12, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
* kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

Bug Fix(es) and Enhancement(s):

* net/tls backports for 10.2 (JIRA:AlmaLinux-275027)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 75

ReleasePackageFixed in
AlmaLinux · 10 kernel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-devel-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-debug-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-devel-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-64k-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-cross-headers 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-devel-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-debug-uki-virt 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-devel-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-doc 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-headers 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-modules-extra-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-debug-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-64k-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-debug-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-rt-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-tools 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-tools-libs 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-tools-libs-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-uki-virt 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-uki-virt-addons 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-devel-matched 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-core 6.12.0-211.65.1.el10_2
AlmaLinux · 10 kernel-zfcpdump-modules-extra 6.12.0-211.65.1.el10_2
AlmaLinux · 10 libperf 6.12.0-211.65.1.el10_2
AlmaLinux · 10 perf 6.12.0-211.65.1.el10_2
AlmaLinux · 10 python3-perf 6.12.0-211.65.1.el10_2
AlmaLinux · 10 rtla 6.12.0-211.65.1.el10_2
AlmaLinux · 10 rv 6.12.0-211.65.1.el10_2

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-64385

    smb: client: fix double-free in SMB2_ioctl() replay

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-68123

    openvswitch: fix GSO userspace truncation underflow

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-89970

    nvmet-auth: Synchronize timeout work during SQ teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-72318

    cifs: validate DFS referral string offsets

    In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offse…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.3
    CVE-2026-72289

    KVM: arm64: vgic: Check the interrupt is still ours before migrating it

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-63925

    macsec: fix replay protection at XPN lower-PN wrap

    In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-43332

    thermal: core: Fix thermal zone device registration error path

    In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64191

    i2c: stub: Reject I2C block transfers with invalid length

    In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-80521 Public exploit

    af_unix: Unlink scc_entry in unix_del_edge().

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the followin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64507 Public exploit

    x86/bugs: Enable IBPB flush on BPF JIT allocation

    In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64508

    bpf: Support for hardening against JIT spraying

    In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-43332
  • report
    https://access.redhat.com/security/cve/CVE-2026-63925
  • report
    https://access.redhat.com/security/cve/CVE-2026-64191
  • report
    https://access.redhat.com/security/cve/CVE-2026-64385
  • report
    https://access.redhat.com/security/cve/CVE-2026-64507
  • report
    https://access.redhat.com/security/cve/CVE-2026-64508
  • report
    https://access.redhat.com/security/cve/CVE-2026-68123
  • report
    https://access.redhat.com/security/cve/CVE-2026-72289
  • report
    https://access.redhat.com/security/cve/CVE-2026-72318
  • report
    https://access.redhat.com/security/cve/CVE-2026-80521
  • report
    https://access.redhat.com/security/cve/CVE-2026-89970
  • report
    https://bugzilla.redhat.com/2468043
  • report
    https://bugzilla.redhat.com/2502397
  • report
    https://bugzilla.redhat.com/2502872
  • report
    https://bugzilla.redhat.com/2507035
  • report
    https://bugzilla.redhat.com/2507153
  • report
    https://bugzilla.redhat.com/2507218
  • report
    https://bugzilla.redhat.com/2513451
  • report
    https://bugzilla.redhat.com/2516396
  • report
    https://bugzilla.redhat.com/2516657
  • report
    https://bugzilla.redhat.com/2524478
  • report
    https://bugzilla.redhat.com/2535265
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-81406.html