Linux · 
AlmaLinux · Security advisory · September 24, 2026
AlmaLinux · Security advisory · September 24, 2026ALSA-2026:71233: Security update for 14 packages
ALSA-2026:71233, released September 24, 2026, fixes 14 CVEs across 14 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
14
2 rated Critical
Exploited
1
CVE-2026-53266
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0147
73rd percentile
Priority of the 14 CVEs
Patch now 1
Urgent 2
High 11
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| kernel-64k-debug-devel | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-64k-debug-devel-matched | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-64k-devel | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-64k-devel-matched | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-debug-devel | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-debug-devel-matched | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-devel | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-devel-matched | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-doc | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-headers | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-zfcpdump-devel | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| kernel-zfcpdump-devel-matched | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| perf | almalinux 10 | 6.12.0-211.59.1.el10_2 |
| python3-perf | almalinux 10 | 6.12.0-211.59.1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-53266 | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | KEVExploited |
| Urgent | CVE-2026-64564 | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 | None reported |
| Urgent | CVE-2026-89846 | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB s... | 9.1 | 0.0071 | None reported |
| High | CVE-2026-74469 | sctp: prevent peer transport count overflow | 8.8 | 0.0147 | None reported |
| High | CVE-2026-64383 | smb: client: fix double-free in SMB2_flush() replay | 9.8 | 0.0046 | None reported |
| High | CVE-2026-80844 | xfrm: ah6: validate routing header segments_left | 8.3 | 0.0043 | None reported |
| High | CVE-2026-74569 | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 | None reported |
| High | CVE-2026-81000 | linux: In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user()... | 8.3 | 0.0036 | None reported |
| High | CVE-2026-63831 | mac802154: llsec: add skb_cow_data() before in-place crypto | 8.8 | 0.0031 | None reported |
| High | CVE-2026-23007 | kernel: In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buff... | 8.3 | 0.0020 | None reported |
| High | CVE-2026-68201 | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its... | 8.3 | 0.0017 | None reported |
| High | CVE-2026-72243 | linux: In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TC... | 8.8 | 0.0017 | None reported |
| High | CVE-2026-64053 | kernel-64k-debug-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.3 | 0.0013 | None reported |
| High | CVE-2026-63802 | blk-cgroup: fix UAF in __blkcg_rstat_flush() | 8.3 | 0.0010 | None reported |
Showing 1 to 14 of 14
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.