Linux · Security advisory · November 7, 2026
ALSA-2026:81613: Security update for 5 packages
ALSA-2026:81613, released November 7, 2026, fixes 4 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0043
36th percentile
Priority of the 4 CVEs
Patch now 0
Urgent 0
High 4
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| pcre2 | almalinux 8 | 10.32-4.el8_10 |
| pcre2-devel | almalinux 8 | 10.32-4.el8_10 |
| pcre2-tools | almalinux 8 | 10.32-4.el8_10 |
| pcre2-utf16 | almalinux 8 | 10.32-4.el8_10 |
| pcre2-utf32 | almalinux 8 | 10.32-4.el8_10 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-86145 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). | 8.2 | 0.0043 | None reported | |
| High | CVE-2026-89157 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | 8.2 | 0.0035 | None reported | |
| High | CVE-2026-103111 | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. | 8.2 | 0.0027 | None reported | |
| High | CVE-2026-89158 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | 8.2 | 0.0025 | None reported |
Showing 1 to 4 of 4
1