# ALSA-2026:69914: Security update for 18 packages ALSA-2026:69914, released September 22, 2026, fixes 16 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-69914 - Platform: Linux - Released: Sep 22, 2026 - Priority: High (Closes CVE-2026-16239, high severity) - CVEs: 16, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:69914 ## Applies to | Product | Release | Fixed in | |---|---|---| | [pg_repack](https://patchblox.com/security/data/product/linux/pg-repack.md) | almalinux 9 | 1.4.8-2.module_el9.5.0+119+18833d03 | | [pgaudit](https://patchblox.com/security/data/product/linux/pgaudit.md) | almalinux 9 | 1.7.0-1.module_el9.3.0+52+21733919 | | [postgres-decoderbufs](https://patchblox.com/security/data/product/linux/postgres-decoderbufs.md) | almalinux 9 | 1.9.7-1.Final.module_el9.3.0+52+21733919 | | [postgresql](https://patchblox.com/security/data/product/linux/postgresql.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-contrib](https://patchblox.com/security/data/product/linux/postgresql-contrib.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-docs](https://patchblox.com/security/data/product/linux/postgresql-docs.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-plperl](https://patchblox.com/security/data/product/linux/postgresql-plperl.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-plpython3](https://patchblox.com/security/data/product/linux/postgresql-plpython3.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-pltcl](https://patchblox.com/security/data/product/linux/postgresql-pltcl.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-private-devel](https://patchblox.com/security/data/product/linux/postgresql-private-devel.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-private-libs](https://patchblox.com/security/data/product/linux/postgresql-private-libs.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-server](https://patchblox.com/security/data/product/linux/postgresql-server.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-server-devel](https://patchblox.com/security/data/product/linux/postgresql-server-devel.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-static](https://patchblox.com/security/data/product/linux/postgresql-static.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-test](https://patchblox.com/security/data/product/linux/postgresql-test.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-test-rpm-macros](https://patchblox.com/security/data/product/linux/postgresql-test-rpm-macros.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-upgrade](https://patchblox.com/security/data/product/linux/postgresql-upgrade.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | | [postgresql-upgrade-devel](https://patchblox.com/security/data/product/linux/postgresql-upgrade-devel.md) | almalinux 9 | 15.19-1.module_el9.8.0+318+764e137c | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-16239](https://patchblox.com/security/data/cve/CVE-2026-16239.md) | High | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | | | [CVE-2026-14669](https://patchblox.com/security/data/cve/CVE-2026-14669.md) | High | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 | | | [CVE-2026-15742](https://patchblox.com/security/data/cve/CVE-2026-15742.md) | High | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | | | [CVE-2026-6471](https://patchblox.com/security/data/cve/CVE-2026-6471.md) | High | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | | | [CVE-2026-14662](https://patchblox.com/security/data/cve/CVE-2026-14662.md) | High | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | | | [CVE-2026-14664](https://patchblox.com/security/data/cve/CVE-2026-14664.md) | High | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-14670](https://patchblox.com/security/data/cve/CVE-2026-14670.md) | High | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-15741](https://patchblox.com/security/data/cve/CVE-2026-15741.md) | High | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 | | | [CVE-2026-19385](https://patchblox.com/security/data/cve/CVE-2026-19385.md) | High | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | | | [CVE-2026-14671](https://patchblox.com/security/data/cve/CVE-2026-14671.md) | High | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | | | [CVE-2026-14680](https://patchblox.com/security/data/cve/CVE-2026-14680.md) | High | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | | | [CVE-2026-14677](https://patchblox.com/security/data/cve/CVE-2026-14677.md) | High | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | | | [CVE-2026-6464](https://patchblox.com/security/data/cve/CVE-2026-6464.md) | High | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | | | [CVE-2026-18408](https://patchblox.com/security/data/cve/CVE-2026-18408.md) | High | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 | | | [CVE-2026-14668](https://patchblox.com/security/data/cve/CVE-2026-14668.md) | High | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | | | [CVE-2026-14679](https://patchblox.com/security/data/cve/CVE-2026-14679.md) | High | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo