Skip to content
OpenAdvisories
High ALSA-2026:81552 13 CVEs

Important: kernel security update

Published Oct 12, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
* kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 18

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.57.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.57.1.el9_8

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-68123

    openvswitch: fix GSO userspace truncation underflow

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-89970

    nvmet-auth: Synchronize timeout work during SQ teardown

    In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-72318

    cifs: validate DFS referral string offsets

    In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offse…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-89811

    drm/amdkfd: Add TLB flush after MES queue eviction/suspension

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this au…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-63925

    macsec: fix replay protection at XPN lower-PN wrap

    In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68236

    drm/amd/display: set new_stream to NULL after release

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a l…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68245

    drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-89894

    media: cx231xx: reject geometry changes while the VBI queue is busy

    In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-46309

    drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cache…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-64507 Public exploit

    x86/bugs: Enable IBPB flush on BPF JIT allocation

    In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64508

    bpf: Support for hardening against JIT spraying

    In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68278

    drm/dp/mst: fix buffer overflows in sideband chunk accumulation

    In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length cur…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-80887

    drm/vmwgfx: use check_add_overflow for shader size+offset bound

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-46309
  • report
    https://access.redhat.com/security/cve/CVE-2026-63925
  • report
    https://access.redhat.com/security/cve/CVE-2026-64507
  • report
    https://access.redhat.com/security/cve/CVE-2026-64508
  • report
    https://access.redhat.com/security/cve/CVE-2026-68123
  • report
    https://access.redhat.com/security/cve/CVE-2026-68236
  • report
    https://access.redhat.com/security/cve/CVE-2026-68245
  • report
    https://access.redhat.com/security/cve/CVE-2026-68278
  • report
    https://access.redhat.com/security/cve/CVE-2026-72318
  • report
    https://access.redhat.com/security/cve/CVE-2026-80887
  • report
    https://access.redhat.com/security/cve/CVE-2026-89811
  • report
    https://access.redhat.com/security/cve/CVE-2026-89894
  • report
    https://access.redhat.com/security/cve/CVE-2026-89970
  • report
    https://bugzilla.redhat.com/2486468
  • report
    https://bugzilla.redhat.com/2502397
  • report
    https://bugzilla.redhat.com/2507153
  • report
    https://bugzilla.redhat.com/2507218
  • report
    https://bugzilla.redhat.com/2513148
  • report
    https://bugzilla.redhat.com/2513287
  • report
    https://bugzilla.redhat.com/2513430
  • report
    https://bugzilla.redhat.com/2513451
  • report
    https://bugzilla.redhat.com/2516396
  • report
    https://bugzilla.redhat.com/2528788
  • report
    https://bugzilla.redhat.com/2535265
  • report
    https://bugzilla.redhat.com/2535309
  • report
    https://bugzilla.redhat.com/2535338
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-81552.html