ALSA-2026:98099: Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398) kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510) kernel: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842) kernel: ALSA: seq: midi: Serialize input teardown with eventinput (CVE-2026-90207) kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116) kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403) kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152) kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/bpftoolto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernelto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-abi-stableliststo a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-coreto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-cross-headersto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-debugto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-debug-coreto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-debug-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-debug-modulesto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-debug-modules-extrato a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-docto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-headersto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-modulesto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-modules-extrato a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-toolsto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-tools-libsto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-tools-libs-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-zfcpdumpto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-zfcpdump-coreto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-zfcpdump-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-zfcpdump-modulesto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/kernel-zfcpdump-modules-extrato a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/perfto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10 - Upgrade
Upgrade
almalinux/python3-perfto a version that resolves this vulnerability.Fixed in 4.18.0-553.185.1.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should be prioritized for review?
Systems running the listed AlmaLinux kernel-related packages should be reviewed, particularly where PPP over L2TP, Open vSwitch, Bluetooth management, bridge multicast, ALSA MIDI or PCM, iSCSI, SMC networking, or s390 boot functionality is in use.
Does the advisory identify whether default configurations are vulnerable or what access an attacker needs?
No. The advisory lists the corrected kernel issues but does not state exploit prerequisites, required privileges, network exposure, or whether default configurations enable the affected functionality.
How can I determine whether a system is already fixed?
The provided advisory data does not include fixed package versions. Verify the installed versions of the listed kernel packages against the package versions supplied by the relevant AlmaLinux security update.