Back to Security Advisories

Kernel Security Update — AlmaLinux 9 (ALSA-2026:86033)

ALSA-2026:86033 updates the AlmaLinux 9 kernel (kernel-rt variants included, 5.14.0-687.59.1.el9_8) with a broad batch of fixes — openvswitch tunnel netdev_put deferred to RCU release (CVE-2026-31678), xfrm espintcp reuse handling, and further networking/filesystem corrections. Update and reboot: dnf update kernel, then restart into the new build.

High 7.8 CVSS
AlmaLinux 9

What this means under a SharedLicense license

Networking and encryption-path kernel flaws (openvswitch, xfrm espintcp) are remotely reachable states — unpatched, they expose the host to crashes and escalation attempts from network-triggered code paths.

  1. Ubuntu Security Notices

  2. USN-8952-2

Publication date

6 November 2026

Overview

USN-8952-1 introduced a regression in Tornado

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS

Packages

Details

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due
to an incomplete fix for CVE-2026-103263, which broke static file
serving for applications that subclass Tornado’s StaticFileHandler,
such as Jupyter, and could introduce a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262,

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due
to an incomplete fix for CVE-2026-103263, which broke static file
serving for applications that subclass Tornado’s StaticFileHandler,
such as Jupyter, and could introduce a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)

Show more
Show less

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 python3-tornado – 

6.5.5-5ubuntu1.2
26.04

LTS resolute

 python3-tornado – 

6.5.4-0.1ubuntu0.3
24.04

LTS noble

 python3-tornado – 

6.4.0-1ubuntu0.7
22.04

LTS jammy

 python3-tornado – 

6.1.0-3ubuntu0.1~esm7

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

20.04

LTS focal

 python3-tornado – 

6.0.3+really5.1.1-3ubuntu0.1~esm8

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

18.04

LTS bionic

 python3-tornado – 

4.5.3-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

16.04

LTS xenial

 python3-tornado – 

4.2.1-1ubuntu3.1+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.

References

Related notices

Frequently Asked Questions

What is ALSA-2026:86033?
It is AlmaLinux's kernel erratum for AlmaLinux 9, updating kernel and kernel-rt to 5.14.0-687.59.1.el9_8 with fixes including CVE-2026-31678 (openvswitch: defer tunnel netdev_put to RCU release) and the xfrm espintcp reuse handling correction, among others.
Who should apply it?
Every AlmaLinux 9 server — with priority on hosts using OpenVSwitch tunnels, IPsec espintcp transports, or running the RT kernel variant, which ships in the same erratum.
How do I apply the fix?
Run dnf update kernel kernel-rt (as installed) and reboot; verify with uname -r reporting 5.14.0-687.59.1.el9_8. KernelCare users can live-patch and confirm coverage.
Why do OpenVSwitch and xfrm flaws matter for hosting?
Both are network-transport paths — tunnels and encrypted transports process attacker-influenceable traffic. Flaws there are remotely triggerable crash/escalation vectors on the server's primary network interfaces.

References

Security Advisories

Related Advisories

Kernel Security Update — AlmaLinux 9 (ALSA-2026:93412)

2026-11-09

Fence-Agents Security Update — AlmaLinux 9 (ALSA-2026:94500)

2026-11-04

Cockpit Security Update — AlmaLinux 9 (ALSA-2026:94533)

2026-11-04

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System