Skip to content
OpenAdvisories
High ALSA-2026:87805 8 CVEs

Important: kernel security, bug fix, and enhancement update

Published Oct 22, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
* kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
* kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
* kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)
* kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

* RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-cross-headers 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-devel-matched 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-doc 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-headers 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-tools 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-tools-libs 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-uki-virt 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-687.60.1.el9_8
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-687.60.1.el9_8
AlmaLinux · 9 libperf 5.14.0-687.60.1.el9_8
AlmaLinux · 9 perf 5.14.0-687.60.1.el9_8
AlmaLinux · 9 python3-perf 5.14.0-687.60.1.el9_8
AlmaLinux · 9 rtla 5.14.0-687.60.1.el9_8
AlmaLinux · 9 rv 5.14.0-687.60.1.el9_8

Vulnerabilities 8

  • High 8.4
    CVE-2026-80536

    xfs: bounds-check buffer log item's dirty bitmap

    In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64481

    ALSA: hda/cs35l41: Fix firmware load work teardown

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68202

    ALSA: seq: close a re-opened queue timer in the destructor

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68299

    vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

    In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-80530

    xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22063

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

    In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38147

    calipso: Don't call calipso functions for AF_INET sk.

    In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68448

    ovl: check access to copy_file_range source with src mounter creds

    In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-22063
  • report
    https://access.redhat.com/security/cve/CVE-2025-38147
  • report
    https://access.redhat.com/security/cve/CVE-2026-64481
  • report
    https://access.redhat.com/security/cve/CVE-2026-68202
  • report
    https://access.redhat.com/security/cve/CVE-2026-68299
  • report
    https://access.redhat.com/security/cve/CVE-2026-68448
  • report
    https://access.redhat.com/security/cve/CVE-2026-80530
  • report
    https://access.redhat.com/security/cve/CVE-2026-80536
  • report
    https://bugzilla.redhat.com/2360273
  • report
    https://bugzilla.redhat.com/2376106
  • report
    https://bugzilla.redhat.com/2507038
  • report
    https://bugzilla.redhat.com/2513245
  • report
    https://bugzilla.redhat.com/2513356
  • report
    https://bugzilla.redhat.com/2514462
  • report
    https://bugzilla.redhat.com/2524492
  • report
    https://bugzilla.redhat.com/2524501
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-87805.html