# ALSA-2026:94500: Security update for 37 packages

ALSA-2026:94500, released November 7, 2026, fixes 5 CVEs across 37 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-94500
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-102268, rated Critical)
- CVEs: 5, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:94500

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [fence-agents-aliyun](https://patchblox.com/security/data/product/linux/fence-agents-aliyun.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-all](https://patchblox.com/security/data/product/linux/fence-agents-all.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-amt-ws](https://patchblox.com/security/data/product/linux/fence-agents-amt-ws.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-apc](https://patchblox.com/security/data/product/linux/fence-agents-apc.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-apc-snmp](https://patchblox.com/security/data/product/linux/fence-agents-apc-snmp.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-aws](https://patchblox.com/security/data/product/linux/fence-agents-aws.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-azure-arm](https://patchblox.com/security/data/product/linux/fence-agents-azure-arm.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-bladecenter](https://patchblox.com/security/data/product/linux/fence-agents-bladecenter.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-cisco-ucs](https://patchblox.com/security/data/product/linux/fence-agents-cisco-ucs.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-common](https://patchblox.com/security/data/product/linux/fence-agents-common.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-compute](https://patchblox.com/security/data/product/linux/fence-agents-compute.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-drac5](https://patchblox.com/security/data/product/linux/fence-agents-drac5.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-gce](https://patchblox.com/security/data/product/linux/fence-agents-gce.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-hpblade](https://patchblox.com/security/data/product/linux/fence-agents-hpblade.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ibm-powervs](https://patchblox.com/security/data/product/linux/fence-agents-ibm-powervs.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ibm-vpc](https://patchblox.com/security/data/product/linux/fence-agents-ibm-vpc.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ibmblade](https://patchblox.com/security/data/product/linux/fence-agents-ibmblade.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ifmib](https://patchblox.com/security/data/product/linux/fence-agents-ifmib.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ilo-moonshot](https://patchblox.com/security/data/product/linux/fence-agents-ilo-moonshot.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-ilo-mp](https://patchblox.com/security/data/product/linux/fence-agents-ilo-mp.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-kdump](https://patchblox.com/security/data/product/linux/fence-agents-kdump.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-kubevirt](https://patchblox.com/security/data/product/linux/fence-agents-kubevirt.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-lpar](https://patchblox.com/security/data/product/linux/fence-agents-lpar.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-mpath](https://patchblox.com/security/data/product/linux/fence-agents-mpath.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-nutanix-ahv](https://patchblox.com/security/data/product/linux/fence-agents-nutanix-ahv.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-openstack](https://patchblox.com/security/data/product/linux/fence-agents-openstack.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-redfish](https://patchblox.com/security/data/product/linux/fence-agents-redfish.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-rhevm](https://patchblox.com/security/data/product/linux/fence-agents-rhevm.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-rsa](https://patchblox.com/security/data/product/linux/fence-agents-rsa.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-scsi](https://patchblox.com/security/data/product/linux/fence-agents-scsi.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-virsh](https://patchblox.com/security/data/product/linux/fence-agents-virsh.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-agents-vmware-rest](https://patchblox.com/security/data/product/linux/fence-agents-vmware-rest.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-virt](https://patchblox.com/security/data/product/linux/fence-virt.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-virtd-libvirt](https://patchblox.com/security/data/product/linux/fence-virtd-libvirt.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-virtd-multicast](https://patchblox.com/security/data/product/linux/fence-virtd-multicast.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [fence-virtd-serial](https://patchblox.com/security/data/product/linux/fence-virtd-serial.md) | almalinux 9 | 4.10.0-110.el9_8.8 |
| [ha-cloud-support](https://patchblox.com/security/data/product/linux/ha-cloud-support.md) | almalinux 9 | 4.10.0-110.el9_8.8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-102268](https://patchblox.com/security/data/cve/CVE-2026-102268.md) | Urgent | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard | 9.1 | 0.0024 |  |
| [CVE-2026-102266](https://patchblox.com/security/data/cve/CVE-2026-102266.md) | High | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 9.1 | 0.0023 |  |
| [CVE-2026-102272](https://patchblox.com/security/data/cve/CVE-2026-102272.md) | High | PyJWT BOM Bypass | 9.1 | 0.0022 |  |
| [CVE-2026-102271](https://patchblox.com/security/data/cve/CVE-2026-102271.md) | High | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 9.1 | 0.0022 |  |
| [CVE-2026-102267](https://patchblox.com/security/data/cve/CVE-2026-102267.md) | High | PyJWT: PyJWKClient follows redirects when fetching JWKS | 9.1 | 0.0016 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo