Kernel Security Update — AlmaLinux 10 (ALSA-2026:76738)

The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
  * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
  * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
  * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
  * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
  * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
  * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
  * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
  * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
  * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
  * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
  * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
  * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
  * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
  * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
  * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
  * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
  * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
  * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
  * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
  * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
  * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
  * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
  * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
  * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
  * kernel: packet: use consistent hard_header_len in non-ring send paths ()
  * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
  * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
  * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
  * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
  * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
  * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
  * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
  * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
  * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
  * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)


Bug Fix(es) and Enhancement(s):  

  * wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
  * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.