Critical Kernel Vulnerability in AlmaLinux: Kernel Package Security Update
Summary
ALSA-2026:25191: Critical: kernel security update. Affects kernel versions < 6.12.0-211.22.1.el10_2. Fixed in 6.12.0-211.22.1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel package is a fundamental component of the AlmaLinux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. Given its core role, vulnerabilities in the kernel can lead to severe security risks, including system crashes and unauthorized access.
Vulnerability Detail
The vulnerability arises from multiple issues within the kernel, including a use-after-free condition in the bonding driver, which can lead to denial of service (CVE-2026-31419). Other vulnerabilities include a denial of service in the erofs filesystem (CVE-2026-31467), and various memory management issues that could allow unauthorized access or system instability. These vulnerabilities can be exploited by attackers to crash the system or gain elevated privileges, posing a significant risk to system integrity and security.
How To Fix
Minimum fixed version
6.12.0-211.22.1.el10_2
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected kernel features or disable specific drivers that are known to be vulnerable until the patch is applied. However, this is not a long-term solution and updating the kernel is strongly recommended.
Conclusion
The kernel vulnerabilities identified in AlmaLinux pose critical risks that can affect system stability and security. It is essential for users to update their kernel packages to the latest patched version to mitigate these risks effectively. Regular monitoring and updates are crucial for maintaining system integrity.
See every vulnerability recorded for kernel →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check if your application is affected by this vulnerability.
Failure to address this vulnerability could result in system crashes, unauthorized access, and exploitation of sensitive data, leading to severe security breaches.
Yes, temporarily limiting access to the affected kernel features or disabling specific drivers can help mitigate risks until the patch is applied.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, as well as through security bulletins from AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
