Skip to content
OpenAdvisories
High RLSA-2026:87805 8 CVEs

Important: kernel security, bug fix, and enhancement update

Published Oct 24, 2026 · Updated Oct 24, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)

* kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

* kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

* kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

* kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

* kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)

* kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

* RTLA segfaults on freed memory access on double SIGINT [rhel-9.8.z] (JIRA:Rocky Linux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 kernel 0:5.14.0-687.60.1.el9_8

Vulnerabilities 8

  • High 8.4
    CVE-2026-80536

    xfs: bounds-check buffer log item's dirty bitmap

    In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64481

    ALSA: hda/cs35l41: Fix firmware load work teardown

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68202

    ALSA: seq: close a re-opened queue timer in the destructor

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-68299

    vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

    In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-80530

    xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22063

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

    In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38147

    calipso: Don't call calipso functions for AF_INET sk.

    In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68448

    ovl: check access to copy_file_range source with src mounter creds

    In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360273
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376106
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507038
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513245
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513356
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524492
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524501
  • advisory
    https://access.redhat.com/errata/RHSA-2026:87805