# ALSA-2026:76761: Security update for 2 packages ALSA-2026:76761, released October 6, 2026, fixes 43 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-76761 - Platform: Linux - Released: Oct 6, 2026 - Priority: Urgent (Closes CVE-2026-100788, rated Critical) - CVEs: 43, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:76761 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | almalinux 9 | 140.17.0-1.el9_8.alma.1 | | [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | almalinux 9 | 140.17.0-1.el9_8.alma.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-100788](https://patchblox.com/security/data/cve/CVE-2026-100788.md) | Urgent | Invalid pointer in the JavaScript: WebAssembly component | 9.8 | 0.0042 | | | [CVE-2026-100775](https://patchblox.com/security/data/cve/CVE-2026-100775.md) | Urgent | Sandbox escape in the Graphics component | 9.6 | 0.0033 | | | [CVE-2026-100781](https://patchblox.com/security/data/cve/CVE-2026-100781.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 9.6 | 0.0033 | | | [CVE-2026-100794](https://patchblox.com/security/data/cve/CVE-2026-100794.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Internationalization component | 9.6 | 0.0032 | | | [CVE-2026-100762](https://patchblox.com/security/data/cve/CVE-2026-100762.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Content Processes component | 9.6 | 0.0032 | | | [CVE-2026-100770](https://patchblox.com/security/data/cve/CVE-2026-100770.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Content Processes component | 9.6 | 0.0032 | | | [CVE-2026-100778](https://patchblox.com/security/data/cve/CVE-2026-100778.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Core & HTML component | 9.6 | 0.0032 | | | [CVE-2026-100786](https://patchblox.com/security/data/cve/CVE-2026-100786.md) | Urgent | Sandbox escape due to use-after-free in the Graphics component | 9.6 | 0.0032 | | | [CVE-2026-100758](https://patchblox.com/security/data/cve/CVE-2026-100758.md) | Urgent | Sandbox escape in the DOM: Navigation component | 9.6 | 0.0030 | | | [CVE-2026-100811](https://patchblox.com/security/data/cve/CVE-2026-100811.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Core & HTML component | 9.6 | 0.0027 | | | [CVE-2026-100818](https://patchblox.com/security/data/cve/CVE-2026-100818.md) | Urgent | Sandbox escape due to use-after-free in the Widget: Gtk component | 9.6 | 0.0027 | | | [CVE-2026-100819](https://patchblox.com/security/data/cve/CVE-2026-100819.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the XPCOM component | 9.6 | 0.0026 | | | [CVE-2026-100773](https://patchblox.com/security/data/cve/CVE-2026-100773.md) | High | Use-after-free in the Storage: IndexedDB component | 8.8 | 0.0040 | | | [CVE-2026-100791](https://patchblox.com/security/data/cve/CVE-2026-100791.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0040 | | | [CVE-2026-100783](https://patchblox.com/security/data/cve/CVE-2026-100783.md) | High | Uninitialized memory in the Audio/Video component | 7.5 | 0.0035 | | | [CVE-2026-92035](https://patchblox.com/security/data/cve/CVE-2026-92035.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics component | 9.6 | 0.0033 | | | [CVE-2026-100767](https://patchblox.com/security/data/cve/CVE-2026-100767.md) | High | Use-after-free in the Networking: Cache component | 8.8 | 0.0033 | | | [CVE-2026-100779](https://patchblox.com/security/data/cve/CVE-2026-100779.md) | High | Use-after-free in the XSLT component | 8.8 | 0.0033 | | | [CVE-2026-100784](https://patchblox.com/security/data/cve/CVE-2026-100784.md) | High | Use-after-free in the Layout: Text and Fonts component | 8.8 | 0.0033 | | | [CVE-2026-100757](https://patchblox.com/security/data/cve/CVE-2026-100757.md) | High | Use-after-free in the Widget component | 8.8 | 0.0032 | | | [CVE-2026-100774](https://patchblox.com/security/data/cve/CVE-2026-100774.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | | | [CVE-2026-100777](https://patchblox.com/security/data/cve/CVE-2026-100777.md) | High | Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0032 | | | [CVE-2026-100780](https://patchblox.com/security/data/cve/CVE-2026-100780.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | | | [CVE-2026-100785](https://patchblox.com/security/data/cve/CVE-2026-100785.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | | | [CVE-2026-100789](https://patchblox.com/security/data/cve/CVE-2026-100789.md) | High | Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0032 | | | [CVE-2026-100790](https://patchblox.com/security/data/cve/CVE-2026-100790.md) | High | Use-after-free in the XSLT component | 8.8 | 0.0032 | | | [CVE-2026-100769](https://patchblox.com/security/data/cve/CVE-2026-100769.md) | High | Use-after-free in the JavaScript: WebAssembly component | 8.8 | 0.0032 | | | [CVE-2026-100772](https://patchblox.com/security/data/cve/CVE-2026-100772.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0031 | | | [CVE-2026-100776](https://patchblox.com/security/data/cve/CVE-2026-100776.md) | High | Use-after-free in the JavaScript: WebAssembly component | 8.8 | 0.0031 | | | [CVE-2026-100756](https://patchblox.com/security/data/cve/CVE-2026-100756.md) | High | Incorrect boundary conditions in the Audio/Video: Playback component | 8.1 | 0.0031 | | | [CVE-2026-100759](https://patchblox.com/security/data/cve/CVE-2026-100759.md) | High | Uninitialized memory in the Storage: Quota Manager component | 8.1 | 0.0031 | | | [CVE-2026-100771](https://patchblox.com/security/data/cve/CVE-2026-100771.md) | High | Undefined behavior in the DOM: Streams component | 8.1 | 0.0031 | | | [CVE-2026-100801](https://patchblox.com/security/data/cve/CVE-2026-100801.md) | High | Privilege escalation in the DLL Services component | 8.8 | 0.0028 | | | [CVE-2026-100792](https://patchblox.com/security/data/cve/CVE-2026-100792.md) | High | JIT miscompilation in the JavaScript: WebAssembly component | 8.8 | 0.0026 | | | [CVE-2026-100782](https://patchblox.com/security/data/cve/CVE-2026-100782.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics component | 8.8 | 0.0026 | | | [CVE-2026-100797](https://patchblox.com/security/data/cve/CVE-2026-100797.md) | High | Privilege escalation due to use-after-free in the Graphics: WebRender component | 8.8 | 0.0025 | | | [CVE-2026-100766](https://patchblox.com/security/data/cve/CVE-2026-100766.md) | High | Information disclosure in the Networking: JAR component | 7.5 | 0.0025 | | | [CVE-2026-100832](https://patchblox.com/security/data/cve/CVE-2026-100832.md) | High | Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0025 | | | [CVE-2026-96869](https://patchblox.com/security/data/cve/CVE-2026-96869.md) | High | Information disclosure in the Networking component | 7.5 | 0.0024 | | | [CVE-2026-100820](https://patchblox.com/security/data/cve/CVE-2026-100820.md) | High | Privilege escalation in the Address Bar component | 8.8 | 0.0024 | | | [CVE-2026-100807](https://patchblox.com/security/data/cve/CVE-2026-100807.md) | High | Privilege escalation in the DOM: Service Workers component | 8.8 | 0.0023 | | | [CVE-2026-100803](https://patchblox.com/security/data/cve/CVE-2026-100803.md) | High | Same-origin policy bypass in the WebExtensions component | 8.1 | 0.0017 | | | [CVE-2026-100821](https://patchblox.com/security/data/cve/CVE-2026-100821.md) | High | Site isolation issue in the Panning and Zooming component | 7.5 | 0.0014 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo