Moderate Kernel Security Update for AlmaLinux: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:2720: Moderate: kernel security update. Affects bpftool versions < 4.18.0-553.105.1.el8_10. Fixed in 4.18.0-553.105.1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel package is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel is critical for system stability and security, making it a prime target for vulnerabilities that could compromise the entire operating system.
Vulnerability Detail
This vulnerability report highlights several security issues within the kernel packages of AlmaLinux. The vulnerabilities include a use-after-free condition in Bluetooth connection handling (CVE-2023-53762), which could lead to denial of service; an out-of-bounds write in fbdev (CVE-2025-40304), potentially allowing privilege escalation or information disclosure; and a flaw in the SMC protocol (CVE-2025-40168) that could affect network communication. These vulnerabilities pose significant risks, including system crashes, unauthorized access, and data leaks.
How To Fix
Minimum fixed version
4.18.0-553.105.1.el8_10
This is the first release that contains the fix.
sudo dnf update bpftoolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling Bluetooth functionality if it is not required, to mitigate the risk associated with the Bluetooth vulnerability until the system is updated.
Conclusion
In summary, the kernel security update for AlmaLinux addresses critical vulnerabilities that could impact system stability and security. It is crucial for users to update their systems to the patched version to protect against potential exploits. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for bpftool →
FAQ
CVE-2023-53762 is a vulnerability in the Linux kernel's Bluetooth stack that allows for a denial of service due to a use-after-free error in connection handling.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
Failure to address these vulnerabilities can lead to system crashes, unauthorized access, and potential data breaches, compromising the integrity and security of your system.
Yes, temporarily disabling Bluetooth functionality can help mitigate risks associated with the Bluetooth vulnerability until the system is updated.
For more details, refer to the CVE pages linked in the vulnerability report or visit the Vulert website for additional resources on monitoring vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bpftool.
