Affected: AlmaLinux:8: kernel-rt, AlmaLinux:8: kernel-rt-core, AlmaLinux:8: kernel-rt-debug, AlmaLinux:8: kernel-rt-debug-core, AlmaLinux:8: kernel-rt-debug-devel, AlmaLinux:8: kernel-rt-debug-modules, AlmaLinux:8: kernel-rt-debug-modules-extra, AlmaLinux:8: kernel-rt-devel, AlmaLinux:8: kernel-rt-modules, AlmaLinux:8: kernel-rt-modules-extra

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994) * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242) * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048) * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756) * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861) * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: gfs2: add some missing log locking (CVE-2026-53049) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)…

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).

kernel: linux/dim: Fix divide by 0 in RDMA DIM kernel: ALSA: 6fire: fix use-after-free on disconnect kernel: sctp: purge outqueue on stale COOKIE-ECHO handling kernel: tipc: fix double-free in tipc_buf_append() kernel: netfilter: conntrack: remove sprintf usage kernel: dm log: fix out-of-bounds write due to region_count overflow kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp kernel: net: pull headers in qdisc_pkt_len_segs_init() kernel: zram: fix use-after-free in zram_bvec_write_partial() kernel: i2c: stub: Reject I2C block transfers with invalid length kernel: net: qrtr: restrict socket creation to the initial network namespace kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability kernel: dm-verity: fix buffer overflow in FEC calculation kernel: netfilter: flowtable: publish GC-visible tuple last

kernel: nvme-pci: fix mempool alloc size kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition kernel: gfs2: Fix unlikely race in gdlm_put_lock kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send kernel: gfs2: Fix slab-use-after-free in qd_put kernel: net/sched: act_ct: Only release RCU read lock after ct_ft kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 kernel: gfs2: add some missing log locking kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list kernel: ipvs: clear the svc scheduler ptr early on edit kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_…

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

* kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

* kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

* kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

* kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

* kernel: gfs2: add some missing log locking (CVE-2026-53049)

* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

* kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

* kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

* kernel: tunnels: l…

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 219 more

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).