# ALSA-2026:75747: Security update for 25 packages ALSA-2026:75747, released October 5, 2026, fixes 29 CVEs across 25 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-75747 - Platform: Linux - Released: Oct 5, 2026 - Priority: Urgent (Closes CVE-2026-89972, rated Critical) - CVEs: 29, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:75747 ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-abi-stablelists](https://patchblox.com/security/data/product/linux/kernel-abi-stablelists.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-core](https://patchblox.com/security/data/product/linux/kernel-core.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-cross-headers](https://patchblox.com/security/data/product/linux/kernel-cross-headers.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-debug](https://patchblox.com/security/data/product/linux/kernel-debug.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-debug-core](https://patchblox.com/security/data/product/linux/kernel-debug-core.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-debug-devel](https://patchblox.com/security/data/product/linux/kernel-debug-devel.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-debug-modules](https://patchblox.com/security/data/product/linux/kernel-debug-modules.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-debug-modules-extra.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-doc](https://patchblox.com/security/data/product/linux/kernel-doc.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-modules](https://patchblox.com/security/data/product/linux/kernel-modules.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-tools-libs](https://patchblox.com/security/data/product/linux/kernel-tools-libs.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-tools-libs-devel](https://patchblox.com/security/data/product/linux/kernel-tools-libs-devel.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-zfcpdump-core](https://patchblox.com/security/data/product/linux/kernel-zfcpdump-core.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-zfcpdump-devel](https://patchblox.com/security/data/product/linux/kernel-zfcpdump-devel.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-zfcpdump-modules](https://patchblox.com/security/data/product/linux/kernel-zfcpdump-modules.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [kernel-zfcpdump-modules-extra](https://patchblox.com/security/data/product/linux/kernel-zfcpdump-modules-extra.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | almalinux 8 | 4.18.0-553.171.1.el8_10 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-89972](https://patchblox.com/security/data/cve/CVE-2026-89972.md) | Urgent | nvme: add missing SRCU grace period in error path | 9.8 | 0.0071 | | | [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 | | | [CVE-2025-40242](https://patchblox.com/security/data/cve/CVE-2025-40242.md) | Urgent | gfs2: Fix unlikely race in gdlm_put_lock | 9.8 | 0.0016 | | | [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 | | | [CVE-2026-63994](https://patchblox.com/security/data/cve/CVE-2026-63994.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0051 | | | [CVE-2026-74669](https://patchblox.com/security/data/cve/CVE-2026-74669.md) | High | ipvs: clear IPv4 options after rebasing tunnel ICMP errors | 9.8 | 0.0051 | | | [CVE-2026-63992](https://patchblox.com/security/data/cve/CVE-2026-63992.md) | High | kernel-rt-64k-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.1 | 0.0051 | | | [CVE-2026-74744](https://patchblox.com/security/data/cve/CVE-2026-74744.md) | High | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev | 9.8 | 0.0051 | | | [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 | | | [CVE-2026-89481](https://patchblox.com/security/data/cve/CVE-2026-89481.md) | High | nvme-tcp: fix host memory disclosure on R2T for a read command | 8.8 | 0.0043 | | | [CVE-2026-53049](https://patchblox.com/security/data/cve/CVE-2026-53049.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t... | 9.8 | 0.0039 | | | [CVE-2026-74569](https://patchblox.com/security/data/cve/CVE-2026-74569.md) | High | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 | | | [CVE-2022-50756](https://patchblox.com/security/data/cve/CVE-2022-50756.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the ma... | 8.8 | 0.0020 | | | [CVE-2023-54048](https://patchblox.com/security/data/cve/CVE-2023-54048.md) | High | kernel-default: The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues wer... | 8.8 | 0.0020 | | | [CVE-2026-45856](https://patchblox.com/security/data/cve/CVE-2026-45856.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it i... | 8.8 | 0.0019 | | | [CVE-2026-45861](https://patchblox.com/security/data/cve/CVE-2026-45861.md) | High | gfs2: Fix slab-use-after-free in qd_put | 8.8 | 0.0019 | | | [CVE-2026-72255](https://patchblox.com/security/data/cve/CVE-2026-72255.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t... | 8.8 | 0.0018 | | | [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 | | | [CVE-2026-53270](https://patchblox.com/security/data/cve/CVE-2026-53270.md) | High | ipvs: clear the svc scheduler ptr early on edit | 9.8 | 0.0016 | | | [CVE-2026-72052](https://patchblox.com/security/data/cve/CVE-2026-72052.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the devic... | 8.8 | 0.0015 | | | [CVE-2026-63829](https://patchblox.com/security/data/cve/CVE-2026-63829.md) | High | net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-68432](https://patchblox.com/security/data/cve/CVE-2026-68432.md) | High | vxlan: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-23105](https://patchblox.com/security/data/cve/CVE-2026-23105.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine wh... | 8.8 | 0.0015 | | | [CVE-2026-52972](https://patchblox.com/security/data/cve/CVE-2026-52972.md) | High | crypto: af_alg - Cap AEAD AD length to 0x80000000 | 8.8 | 0.0014 | | | [CVE-2026-63794](https://patchblox.com/security/data/cve/CVE-2026-63794.md) | High | KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path | 8.8 | 0.0014 | | | [CVE-2026-74516](https://patchblox.com/security/data/cve/CVE-2026-74516.md) | High | KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active | 8.8 | 0.0014 | | | [CVE-2026-53230](https://patchblox.com/security/data/cve/CVE-2026-53230.md) | High | net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list | 8.8 | 0.0013 | | | [CVE-2026-80921](https://patchblox.com/security/data/cve/CVE-2026-80921.md) | High | KVM: s390: vsie: zero stale crypto bits | 8.8 | 0.0013 | | | [CVE-2026-46319](https://patchblox.com/security/data/cve/CVE-2026-46319.md) | High | net/sched: act_ct: Only release RCU read lock after ct_ft | 8.8 | 0.0011 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo