Linux · Security advisory · April 27, 2026

ALSA-2026:10704: Security update for 9 packages

ALSA-2026:10704, released April 27, 2026, fixes 6 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
6
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0067
52nd percentile

Priority of the 6 CVEs

Patch now 0 Urgent 2 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
delvealmalinux 81.25.2-1.module_el8.10.0+4074+24330916
go-toolsetalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golangalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-binalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-docsalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-miscalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-racealmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-srcalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd
golang-testsalmalinux 81.25.9-1.module_el8.10.0+4167+2e2e20dd

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go 9.8 0.0067 None reported
Urgent CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile 9.8 0.0055 None reported
High CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls 9.1 0.0063 None reported
High CVE-2026-32280 Unexpected work during chain building in crypto/x509 9.1 0.0063 None reported
High CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix 9.1 0.0030 None reported
High CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile 9.0 0.0027 None reported
Showing 1 to 6 of 6 1