Linux · Security advisory · November 7, 2026
ALSA-2026:81522: Security update for 7 packages
ALSA-2026:81522, released November 7, 2026, fixes 7 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0043
36th percentile
Priority of the 7 CVEs
Patch now 0
Urgent 0
High 7
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| pcre2 | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-devel | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-static | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-syntax | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-tools | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-utf16 | almalinux 10 | 10.44-1.5.el10_2 |
| pcre2-utf32 | almalinux 10 | 10.44-1.5.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-86145 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). | 8.2 | 0.0043 | None reported | |
| High | CVE-2026-89157 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | 8.2 | 0.0035 | None reported | |
| High | CVE-2026-89156 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. | 8.2 | 0.0029 | None reported | |
| High | CVE-2026-103111 | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. | 8.2 | 0.0027 | None reported | |
| High | CVE-2026-89160 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. | 8.2 | 0.0027 | None reported | |
| High | CVE-2026-89158 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | 8.2 | 0.0025 | None reported | |
| High | CVE-2026-89161 | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. | 8.2 | 0.0013 | None reported |
Showing 1 to 7 of 7
1