Skip to content
OpenAdvisories
High ALSA-2026:95100 6 CVEs

Important: kernel-rt security, bug fix, and enhancement update

Published Nov 4, 2026 · Updated Nov 4, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
* kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)
* kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
* kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

Bug Fix(es) and Enhancement(s):

* AlmaLinux8.10 - s390/smp: Remove conditional emergency signal usage (JIRA:RHEL-298849)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.184.1.rt7.525.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.184.1.rt7.525.el8_10

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-64541

    net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-74586 Public exploit

    sctp: clear new_transport when removing a peer

    In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been proce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-89488

    openvswitch: Fix CT limit teardown use-after-free

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither remo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-52929

    sctp: stream: fully roll back denied add-stream state

    In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80863

    RDMA/rxe: Fix OOB in free_rd_atomic_resources()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80864

    RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-52929
  • report
    https://access.redhat.com/security/cve/CVE-2026-64541
  • report
    https://access.redhat.com/security/cve/CVE-2026-74586
  • report
    https://access.redhat.com/security/cve/CVE-2026-80863
  • report
    https://access.redhat.com/security/cve/CVE-2026-80864
  • report
    https://access.redhat.com/security/cve/CVE-2026-89488
  • report
    https://bugzilla.redhat.com/2492108
  • report
    https://bugzilla.redhat.com/2507721
  • report
    https://bugzilla.redhat.com/2521419
  • report
    https://bugzilla.redhat.com/2528646
  • report
    https://bugzilla.redhat.com/2528665
  • report
    https://bugzilla.redhat.com/2532407
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-95100.html