Local Privilege Escalation and Information Disclosure in AlmaLinux Kernel Packages
Summary
ALSA-2026:3966: Moderate: kernel security update. Affects kernel versions < 5.14.0-611.38.1.el9_7. Fixed in 5.14.0-611.38.1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of any Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. AlmaLinux, a community-driven enterprise-grade Linux distribution, relies on the kernel for stability and performance. The kernel packages in AlmaLinux include various components such as kernel-debug, kernel-devel, and kernel-modules, each serving specific purposes for system operations and development. This vulnerability affects multiple kernel packages in AlmaLinux 9, highlighting the importance of maintaining up-to-date software to ensure system security.
Vulnerability Detail
The vulnerability identified as CVE-2025-38106 allows for local privilege escalation, information disclosure, or denial of service due to a use-after-free condition in the io_uring subsystem of the Linux kernel. This issue can be exploited by local users to gain elevated privileges or access sensitive information, potentially compromising the integrity and confidentiality of the system. Additionally, CVE-2026-23001 addresses a possible use-after-free in the macvlan_forward_source() function, which could also lead to similar security risks.
How To Fix
Minimum fixed version
5.14.0-611.38.1.el9_7
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected kernel features or restrict user permissions to mitigate the risk of exploitation until the system can be updated. However, the most effective solution is to apply the patch as soon as possible.
Conclusion
In summary, the vulnerabilities identified in the AlmaLinux kernel packages pose significant security risks that can lead to privilege escalation and information disclosure. It is crucial for users to update their systems to the patched version to mitigate these risks effectively. Utilizing tools like Vulert can assist in monitoring and managing open-source vulnerabilities in real-time.
See every vulnerability recorded for kernel →
FAQ
CVE-2025-38106 is a vulnerability in the Linux kernel's io_uring subsystem that can lead to local privilege escalation, information disclosure, or denial of service due to a use-after-free condition.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by this vulnerability.
If immediate updates are not possible, consider implementing access restrictions to the affected kernel features and limiting user permissions as a temporary workaround.
Failing to address this vulnerability can lead to unauthorized access, data breaches, and potential system compromise, putting sensitive information and system integrity at risk.
For more details, refer to the CVE pages associated with CVE-2025-38106 and CVE-2026-23001, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
