ALSA-2026:75747
Vulnerability from osv_almalinux – Published: 2026-10-05 00:00 – Updated: 2026-10-06 10:17 – Source website
VLAI
Summary
Important: kernel security, bug fix, and enhancement update
Details
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
- kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
- kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
- kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
- kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
- kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
- kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
- kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
- kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
- kernel: gfs2: add some missing log locking (CVE-2026-53049)
- kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
- kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
- kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
- kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
- kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
- kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
- kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
- kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
- kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
- kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
- kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
- kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
- kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
- kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
- kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
- kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
- kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
- kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
- kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
- kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
Bug Fix(es) and Enhancement(s):
- AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
- AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
- [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "bpftool"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-abi-stablelists"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-cross-headers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-debug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-debug-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-debug-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-debug-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-debug-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-headers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-tools-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-tools-libs-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-zfcpdump"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-zfcpdump-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-zfcpdump-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-zfcpdump-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-zfcpdump-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "perf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "python3-perf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.171.1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The kernel packages contain the Linux kernel, the core of any Linux operating system. \n\nSecurity Fix(es): \n\n * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)\n * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)\n * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)\n * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)\n * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)\n * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)\n * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)\n * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)\n * kernel: gfs2: add some missing log locking (CVE-2026-53049)\n * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)\n * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)\n * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)\n * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)\n * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)\n * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)\n * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)\n * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)\n * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)\n * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)\n * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)\n * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)\n * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)\n * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)\n * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)\n * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)\n * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)\n * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)\n * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)\n * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)\n\n\nBug Fix(es) and Enhancement(s): \n\n * AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)\n * AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)\n * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:75747",
"modified": "2026-10-06T10:17:39Z",
"published": "2026-10-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:75747"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-50756"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-54048"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-39994"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-40242"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-23105"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-45856"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-45861"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-46319"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-52972"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53049"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53230"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53270"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63794"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63829"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63992"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63994"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68432"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-72052"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-72255"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74516"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74569"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74669"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74744"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74746"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-80921"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-89481"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-89972"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-90227"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-97417"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2404123"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2418819"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425013"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425209"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2436789"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2482129"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2482143"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2486979"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492276"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492364"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492728"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492853"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502230"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502241"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502431"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502444"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2514441"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516306"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516717"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516998"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2517052"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2521375"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2524431"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2524483"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2531066"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2532184"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2535140"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2536346"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2540479"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-75747.html"
}
],
"related": [
"CVE-2025-39994",
"CVE-2025-40242",
"CVE-2023-54048",
"CVE-2022-50756",
"CVE-2026-23105",
"CVE-2026-45856",
"CVE-2026-45861",
"CVE-2026-46319",
"CVE-2026-53049",
"CVE-2026-52972",
"CVE-2026-53230",
"CVE-2026-53270",
"CVE-2026-63829",
"CVE-2026-63794",
"CVE-2026-63992",
"CVE-2026-63994",
"CVE-2026-68432",
"CVE-2026-72052",
"CVE-2026-72255",
"CVE-2026-74516",
"CVE-2026-74569",
"CVE-2026-74669",
"CVE-2026-74744",
"CVE-2026-74746",
"CVE-2026-80921",
"CVE-2026-89481",
"CVE-2026-89972",
"CVE-2026-90227",
"CVE-2026-97417"
],
"summary": "Important: kernel security, bug fix, and enhancement update"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…