Critical Kernel Vulnerabilities in AlmaLinux 10: Security Update Required
Summary
ALSA-2026:36541: Important: kernel security, bug fix, and enhancement update. Affects kernel versions < 6.12.0-211.31.1.el10_2. Fixed in 6.12.0-211.31.1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of any Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. AlmaLinux 10 utilizes a specific version of the Linux kernel, which is critical for system stability and security. Recent vulnerabilities have been identified that could potentially compromise the integrity and confidentiality of systems running this kernel version.
Vulnerability Detail
The vulnerabilities identified in the kernel packages include issues such as a double destroy_workqueue on service rescan PCI path (CVE-2026-43276), an out-of-bounds read in smb2_compound_op() (CVE-2026-46155), and a user-after-free (UAF) condition in ep_remove struct eventpoll (CVE-2026-46242). These vulnerabilities can lead to unauthorized access, system crashes, or data leaks, posing significant risks to affected systems.
How To Fix
Minimum fixed version
6.12.0-211.31.1.el10_2
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected services or disable specific functionalities that utilize the vulnerable components until the system is updated. However, this is not a permanent solution and should only be considered until the patch is applied.
Conclusion
The kernel vulnerabilities identified in AlmaLinux 10 pose serious risks to system security and integrity. It is crucial for users to update their kernel packages to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure systems remain secure.
See every vulnerability recorded for kernel →
FAQ
The update addresses several vulnerabilities, including issues with eventpoll management, out-of-bounds reads in SMB operations, and improper memory handling that could lead to security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider implementing workarounds such as restricting access to vulnerable services or disabling certain functionalities until the update can be applied.
Continuing to use an unpatched system poses significant security risks, including potential unauthorized access and data breaches. It is highly recommended to apply the update as soon as possible.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, as well as through security bulletins from AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
