Critical Security Update for Kernel Package: Denial of Service and Privilege Escalation Vulnerabilities
Summary
ALSA-2026:13566: Important: kernel security update. Affects kernel versions < 6.12.0-124.55.1.el10_1. Fixed in 6.12.0-124.55.1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel package is a fundamental component of the AlmaLinux operating system, serving as the core interface between the hardware and software. It manages system resources and facilitates communication between various software applications and hardware components. Given its critical role, vulnerabilities within the kernel can have severe implications, potentially allowing unauthorized access or system instability.
Vulnerability Detail
This vulnerability arises from a use-after-free condition in the traffic control (act_ct) subsystem, which can lead to denial of service or privilege escalation. Additionally, a heap overflow in the NFSv4.0 LOCK replay cache and another use-after-free in the bonding driver further exacerbate the security risks. These vulnerabilities can be exploited by malicious actors to disrupt system operations or gain elevated privileges, posing a significant threat to system integrity and security.
How To Fix
Minimum fixed version
6.12.0-124.55.1.el10_1
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected services or disable the traffic control features until the patch is applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
In summary, the kernel package in AlmaLinux has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with denial of service and privilege escalation. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for kernel →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check if your application is affected by this vulnerability.
The impacts include denial of service, where the system may become unresponsive, and privilege escalation, where unauthorized users could gain elevated access to the system.
Yes, you can limit access to the affected services or disable certain features temporarily until the patch is applied.
For more details, refer to the CVE pages linked in the advisory or visit the Vulert website for comprehensive vulnerability management.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
