ALSA-2026:99031: Moderate: kernel-rt security, bug fix, and enhancement update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events (CVE-2026-74446) kernel: drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422) kernel: drm/amd/pm: bound ppdpmsetpptable() memcpy (CVE-2026-97427) kernel: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid (CVE-2026-97497) kernel: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw (CVE-2026-97494) kernel: drm/amdkfd: Check bounds on allocatedoorbell (CVE-2026-97495) kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493) kernel: drm/amdgpu: fix buffer overflow during vBIOS update (CVE-2026-97425) kernel: net/smc: protect clcsock lifetime in smcgetname (CVE-2026-99032) kernel: kernel: Denial of Service via use-after-free race condition in SCSI tape driver (CVE-2026-99156)
Bug Fix(es) and Enhancement(s):
soft lockup occurs during iomapfinishioends (JIRA:RHEL-258946) gfs2: BUG during withdraw [AlmaLinux-8] (JIRA:RHEL-298310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/kernel-rtto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-coreto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-debugto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-debug-coreto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-debug-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-debug-modulesto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-debug-modules-extrato a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-develto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-modulesto a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10 - Upgrade
Upgrade
almalinux/kernel-rt-modules-extrato a version that resolves this vulnerability.Fixed in 4.18.0-553.186.1.rt7.527.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which environments should prioritize this update?
Systems running the kernel-rt packages should prioritize it, particularly where AMD GPU/KFD functionality, AMDGPU firmware or VBIOS handling, SMC networking, or SCSI tape devices are in use. The advisory does not state which configurations enable these components by default.
Does the advisory include an availability-impacting issue?
Yes. CVE-2026-99156 is described as a denial-of-service issue caused by a use-after-free race condition in the SCSI tape driver.
Are non-security fixes included in this update?
Yes. It also includes fixes for a soft lockup during iomap_finish_ioends and a GFS2 BUG during withdraw.