Skip to content
OpenAdvisories
High ALSA-2026:98100 10 CVEs

Important: kernel-rt security update

Published Nov 11, 2026 · Updated Nov 13, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
* kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
* kernel: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)
* kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)
* kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)
* kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)
* kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)
* kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.185.1.rt7.526.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.185.1.rt7.526.el8_10

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-68123

    openvswitch: fix GSO userspace truncation underflow

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-99153

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46330

    Revert "net/smc: Introduce TCP ULP support"

    In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68398 Public exploit

    ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

    In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74510

    Bluetooth: mgmt: fix UAF in pair command cancellation

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-90207

    ALSA: seq: midi: Serialize input teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98116

    ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

    In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-99152

    scsi: libiscsi: Validate the task named by a management response

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80842

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98403

    s390/boot: Avoid IPL parameter append past command line

    In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-46330
  • report
    https://access.redhat.com/security/cve/CVE-2026-68123
  • report
    https://access.redhat.com/security/cve/CVE-2026-68398
  • report
    https://access.redhat.com/security/cve/CVE-2026-74510
  • report
    https://access.redhat.com/security/cve/CVE-2026-80842
  • report
    https://access.redhat.com/security/cve/CVE-2026-90207
  • report
    https://access.redhat.com/security/cve/CVE-2026-98116
  • report
    https://access.redhat.com/security/cve/CVE-2026-98403
  • report
    https://access.redhat.com/security/cve/CVE-2026-99152
  • report
    https://access.redhat.com/security/cve/CVE-2026-99153
  • report
    https://bugzilla.redhat.com/2486999
  • report
    https://bugzilla.redhat.com/2513188
  • report
    https://bugzilla.redhat.com/2513451
  • report
    https://bugzilla.redhat.com/2516970
  • report
    https://bugzilla.redhat.com/2528639
  • report
    https://bugzilla.redhat.com/2536701
  • report
    https://bugzilla.redhat.com/2541360
  • report
    https://bugzilla.redhat.com/2552209
  • report
    https://bugzilla.redhat.com/2562697
  • report
    https://bugzilla.redhat.com/2562706
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-98100.html