Linux · Security advisory · November 7, 2026
ALSA-2026:84799: Security update for 15 packages
ALSA-2026:84799, released November 7, 2026, fixes 3 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0043
36th percentile
Priority of the 3 CVEs
Patch now 0
Urgent 0
High 3
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| mariadb11.8 | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-backup | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-client-utils | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-common | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-devel | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-embedded | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-embedded-devel | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-errmsg | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-gssapi-server | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-oqgraph-engine | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-pam | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-server | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-server-galera | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-server-utils | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
| mariadb11.8-test | almalinux 10 | 3:11.8.8-2.el10_2.alma.2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-86145 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). | 8.2 | 0.0043 | None reported | |
| High | CVE-2026-103111 | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data. | 8.2 | 0.0027 | None reported | |
| High | CVE-2026-89161 | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. | 8.2 | 0.0013 | None reported |
Showing 1 to 3 of 3
1