- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:89083: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-8.10.z] (JIRA:AlmaLinux-280584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89083.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89082: kernel-rt security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-8.10.z] (JIRA:AlmaLinux-280584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89082.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89745: bind security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89745.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89742: python3.9 security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89742.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89753: freeipmi security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89753.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89850: flatpak security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89850.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89749: xz security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89749.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89744: grafana security update (Critical)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-26 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89744.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89755: lrzsz security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fix(es): * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841) Bug Fix(es) and Enhancement(s): * lrzsz: segfault with -s [almalinux-9.8.z] (JIRA:AlmaLinux-282108) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89755.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:76761: firefox security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777) * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792) * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776) * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757) * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786) * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791) * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782) * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772) * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759) * firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758) * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774) * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785) * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788) * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790) * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780) * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756) * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-76761.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0