Linux · AlmaLinux · Security advisory · September 22, 2026

ALSA-2026:70403: Security update for 10 packages

ALSA-2026:70403, released September 22, 2026, fixes 19 CVEs across 10 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
19
3 rated Critical
Exploited
1
CVE-2025-39964
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0161
76th percentile

Priority of the 19 CVEs

Patch now 1 Urgent 3 High 15 Routine 0

Fixed package versions

ProductReleaseFixed in
kernel-rtalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-corealmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-debugalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-debug-corealmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-debug-develalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-debug-modulesalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-debug-modules-extraalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-develalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-modulesalmalinux 84.18.0-553.166.1.rt7.507.el8_10
kernel-rt-modules-extraalmalinux 84.18.0-553.166.1.rt7.507.el8_10

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2025-39964 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg8.8 0.0161 KEVExploited
Urgent CVE-2026-64534 linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un...9.8 0.0032 None reported
Urgent CVE-2026-53053 iommu/amd: Fix clone_alias() to use the original device's devid9.8 0.0013 None reported
Urgent CVE-2026-53062 dm cache policy smq: fix missing locks in invalidating cache blocks9.8 0.0010 None reported
High CVE-2026-46133 RDMA/rxe: Reject unknown opcodes before ICRC processing8.8 0.0057 None reported
High CVE-2026-46043 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv9.1 0.0051 None reported
High CVE-2026-63947 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system8.8 0.0035 None reported
High CVE-2023-54120 linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_th...8.8 0.0031 None reported
High CVE-2023-54214 linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free...8.8 0.0030 None reported
High CVE-2026-43334 kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements...8.8 0.0028 None reported
High CVE-2026-53254 Bluetooth: RFCOMM: validate skb length in MCC handlers8.1 0.0028 None reported
High CVE-2026-63975 kernel-rt-64k-debug-core: The kernel packages contain the Linux kernel, the core of any Linux operating system8.8 0.0027 None reported
High CVE-2026-53256 kernel-rt-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system8.1 0.0026 None reported
High CVE-2026-52918 Bluetooth: serialize accept_q access8.8 0.0022 None reported
High CVE-2026-68188 Bluetooth: RFCOMM: Fix session UAF in set_termios8.8 0.0022 None reported
High CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap8.8 0.0017 None reported
High CVE-2025-71082 Bluetooth: btusb: revert use of devm_kzalloc in btusb7.8 0.0015 None reported
High CVE-2026-68293 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads8.8 0.0014 None reported
High CVE-2026-45894 iommu/vt-d: Clear Present bit before tearing down PASID entry8.8 0.0013 None reported
Showing 1 to 19 of 19 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.