# ALSA-2026:67848: Security update for 24 packages ALSA-2026:67848, released September 16, 2026, fixes 20 CVEs across 24 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-67848 - Platform: Linux - Released: Sep 16, 2026 - Priority: High (Closes CVE-2026-16239, high severity) - CVEs: 20, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:67848 ## Applies to | Product | Release | Fixed in | |---|---|---| | [pg_repack](https://patchblox.com/security/data/product/linux/pg-repack.md) | almalinux 9 | 1.5.3-1.module_el9.8.0+234+5456f35d | | [pgaudit](https://patchblox.com/security/data/product/linux/pgaudit.md) | almalinux 9 | 18.0-1.module_el9.8.0+234+5456f35d | | [pgvector](https://patchblox.com/security/data/product/linux/pgvector.md) | almalinux 9 | 0.8.1-1.module_el9.8.0+234+5456f35d | | [postgis](https://patchblox.com/security/data/product/linux/postgis.md) | almalinux 9 | 3.6.1-4.module_el9.8.0+310+22372bcc | | [postgis-client](https://patchblox.com/security/data/product/linux/postgis-client.md) | almalinux 9 | 3.6.1-4.module_el9.8.0+310+22372bcc | | [postgis-docs](https://patchblox.com/security/data/product/linux/postgis-docs.md) | almalinux 9 | 3.6.1-4.module_el9.8.0+310+22372bcc | | [postgis-upgrade](https://patchblox.com/security/data/product/linux/postgis-upgrade.md) | almalinux 9 | 3.6.1-4.module_el9.8.0+310+22372bcc | | [postgis-utils](https://patchblox.com/security/data/product/linux/postgis-utils.md) | almalinux 9 | 3.6.1-4.module_el9.8.0+310+22372bcc | | [postgres-decoderbufs](https://patchblox.com/security/data/product/linux/postgres-decoderbufs.md) | almalinux 9 | 3.3.1-1.Final.module_el9.8.0+234+5456f35d | | [postgresql](https://patchblox.com/security/data/product/linux/postgresql.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-contrib](https://patchblox.com/security/data/product/linux/postgresql-contrib.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-docs](https://patchblox.com/security/data/product/linux/postgresql-docs.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-plperl](https://patchblox.com/security/data/product/linux/postgresql-plperl.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-plpython3](https://patchblox.com/security/data/product/linux/postgresql-plpython3.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-pltcl](https://patchblox.com/security/data/product/linux/postgresql-pltcl.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-private-devel](https://patchblox.com/security/data/product/linux/postgresql-private-devel.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-private-libs](https://patchblox.com/security/data/product/linux/postgresql-private-libs.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-server](https://patchblox.com/security/data/product/linux/postgresql-server.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-server-devel](https://patchblox.com/security/data/product/linux/postgresql-server-devel.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-static](https://patchblox.com/security/data/product/linux/postgresql-static.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-test](https://patchblox.com/security/data/product/linux/postgresql-test.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-test-rpm-macros](https://patchblox.com/security/data/product/linux/postgresql-test-rpm-macros.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-upgrade](https://patchblox.com/security/data/product/linux/postgresql-upgrade.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | | [postgresql-upgrade-devel](https://patchblox.com/security/data/product/linux/postgresql-upgrade-devel.md) | almalinux 9 | 18.6-1.module_el9.8.0+310+22372bcc | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-16239](https://patchblox.com/security/data/cve/CVE-2026-16239.md) | High | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | | | [CVE-2026-14669](https://patchblox.com/security/data/cve/CVE-2026-14669.md) | High | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 | | | [CVE-2026-15742](https://patchblox.com/security/data/cve/CVE-2026-15742.md) | High | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | | | [CVE-2026-73515](https://patchblox.com/security/data/cve/CVE-2026-73515.md) | High | postgresql16-postgis: PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosu... | 8.8 | 0.0057 | | | [CVE-2026-6471](https://patchblox.com/security/data/cve/CVE-2026-6471.md) | High | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | | | [CVE-2026-14662](https://patchblox.com/security/data/cve/CVE-2026-14662.md) | High | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | | | [CVE-2026-14664](https://patchblox.com/security/data/cve/CVE-2026-14664.md) | High | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-14670](https://patchblox.com/security/data/cve/CVE-2026-14670.md) | High | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-14676](https://patchblox.com/security/data/cve/CVE-2026-14676.md) | High | postgresql-18: Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operat... | 8.8 | 0.0044 | | | [CVE-2026-15741](https://patchblox.com/security/data/cve/CVE-2026-15741.md) | High | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 | | | [CVE-2026-19385](https://patchblox.com/security/data/cve/CVE-2026-19385.md) | High | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | | | [CVE-2026-14671](https://patchblox.com/security/data/cve/CVE-2026-14671.md) | High | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | | | [CVE-2026-14680](https://patchblox.com/security/data/cve/CVE-2026-14680.md) | High | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | | | [CVE-2026-14677](https://patchblox.com/security/data/cve/CVE-2026-14677.md) | High | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | | | [CVE-2026-16238](https://patchblox.com/security/data/cve/CVE-2026-16238.md) | High | PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code | 8.8 | 0.0041 | | | [CVE-2026-6464](https://patchblox.com/security/data/cve/CVE-2026-6464.md) | High | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | | | [CVE-2026-18408](https://patchblox.com/security/data/cve/CVE-2026-18408.md) | High | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 | | | [CVE-2026-14668](https://patchblox.com/security/data/cve/CVE-2026-14668.md) | High | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | | | [CVE-2026-14679](https://patchblox.com/security/data/cve/CVE-2026-14679.md) | High | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 | | | [CVE-2026-6476](https://patchblox.com/security/data/cve/CVE-2026-6476.md) | High | pgaudit: PostgreSQL is an advanced object-relational database management system (DBMS) | 8.8 | 0.0029 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo