Zurück zu den Sicherheitshinweisen

Kernel-Rt Security Update — AlmaLinux 8 (ALSA-2026:55765)

ALSA-2026:55765 updates the real-time kernel (kernel-rt) on AlmaLinux 8, fixing ten vulnerabilities (CVE-2025-39902, CVE-2026-43206, CVE-2026-53016, CVE-2026-53136, CVE-2026-53329, CVE-2026-53374, CVE-2026-63884, CVE-2026-63879, CVE-2026-64219, CVE-2026-17523) including NULL-pointer-dereference class flaws (CWE-476); aggregate CVSS 7.1. RT-kernel servers: dnf update kernel-rt and reboot.

High 7.1 CVSS
AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

NULL-pointer dereferences and memory-management flaws in the RT kernel let local users crash the host reliably, and occasionally escalate — on latency-sensitive nodes that run untrusted workloads, availability attacks are trivial.

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
* kernel: crypto: ccp – copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Bug Fix(es) and Enhancement(s):

* Backport “sched/deadline: Fix bandwidth reclaim equation in GRUB” to AlmaLinux 8.10 (JIRA:AlmaLinux-189997)
* vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z] (JIRA:AlmaLinux-224556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
x86_64 kernel-rt-modules-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm 0b4f253aed8cff9d193e1610367f35aca1c2949f05218466470b891513cd385e
x86_64 kernel-rt-devel-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm 50ea851350a81a3d23e3e5e915a185a2a9ab47e843d4f28ef04c44f9bb43dc4f
x86_64 kernel-rt-modules-extra-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm 68b7f557bf79a9165c1edf67503a6debf120e9abbba7f0258da8780e5398942c
x86_64 kernel-rt-debug-devel-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm 9cf4c2c5907eeeb1f8e231bf63be35d0b2b8b3acc60ebcbaa0ff81142f6ba02b
x86_64 kernel-rt-debug-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm a6c5f5d86329778355b9fe7dad3cf6488722b63d56aafad6970111396f08f22d
x86_64 kernel-rt-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm ad4fa720eb817110c6d832b9c5b9351a94283d61d8441a775ef2d3b7dbb0ef4b
x86_64 kernel-rt-debug-core-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm bb1b62a5c956196d3f98af73868eebc0152b0ed5f2e7beb6b2f46601dfd93571
x86_64 kernel-rt-core-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm cc27dc0d74e2f44090a4a6be94ff5a33bc5c1fb610420db83e04705d353a749e
x86_64 kernel-rt-debug-modules-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm d40dd403f66632664db8a30f08ce37aab9d5bb000f7a8129f14c0ef8d4b64b67
x86_64 kernel-rt-debug-modules-extra-4.18.0-553.156.1.rt7.497.el8_10.x86_64.rpm d8a7a4024c47d4f208a5f0e8212211d9952b0fde7b079a36966b1d84088cf466

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:55765?
It is AlmaLinux's erratum for the kernel-rt real-time kernel on AlmaLinux 8, fixing ten CVEs (CVE-2025-39902, CVE-2026-43206, CVE-2026-53016, CVE-2026-53136, CVE-2026-53329, CVE-2026-53374, CVE-2026-63884, CVE-2026-63879, CVE-2026-64219, CVE-2026-17523) at aggregate CVSS 7.1, including NULL-pointer dereference (CWE-476) and mm/slub memory-metadata issues.
Do standard-kernel servers need this?
No — kernel-rt packages serve real-time workloads. Standard kernel servers receive the equivalent core fixes through the regular kernel errata (such as ALSA-2026:19666).
How do I apply the fix?
Run dnf update kernel-rt* and reboot into the updated RT kernel; verify the running version with uname -a before returning the node to production.
What does the mm/slub fix address?
The SLUB allocator's metadata-handling flaw could be reached through kernel object operations — the class of bug that underlies many local privilege escalations, which is why allocator hardening fixes ride along in kernel errata.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen