- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:91565: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) Bug Fix(es) and Enhancement(s): * x86/microcode: Add platform mask to Intel microcode "old" list [AlmaLinux-10] [almalinux-10.2.z] (JIRA:AlmaLinux-212778) * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [almalinux-10.2.z] (JIRA:AlmaLinux-245489) * backport fixes for lockdep issues reported with rt-debug [almalinux-10.2.z] (JIRA:AlmaLinux-259937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91565.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90887: emacs security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90887.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91366: libX11 security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91366.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91612: libXtst security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: X.Org X11 libXtst runtime library Security Fix(es): * libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91612.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90522: xdg-dbus-proxy security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90522.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90523: xdg-dbus-proxy security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-27 Summary: xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90523.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90800: emacs security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90800.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90913: thunderbird security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777) * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792) * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776) * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757) * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786) * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791) * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782) * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772) * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759) * firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758) * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774) * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785) * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788) * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790) * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780) * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756) * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90913.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90365: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:AlmaLinux-257205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90365.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90449: brotli security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-27 Summary: Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90449.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0