Linux · Security advisory · November 7, 2026

ALSA-2026:92209: Security update for 25 packages

ALSA-2026:92209, released November 7, 2026, fixes 4 CVEs across 25 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

2 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0084

58th percentile

Priority of the 4 CVEs

Patch now 0
                                Urgent 2
                                High 2
                                Routine 0

Fixed package versions

Product	Release	Fixed in
bpftool	almalinux 8	4.18.0-553.180.1.el8_10
kernel	almalinux 8	4.18.0-553.180.1.el8_10
kernel-abi-stablelists	almalinux 8	4.18.0-553.180.1.el8_10
kernel-core	almalinux 8	4.18.0-553.180.1.el8_10
kernel-cross-headers	almalinux 8	4.18.0-553.180.1.el8_10
kernel-debug	almalinux 8	4.18.0-553.180.1.el8_10
kernel-debug-core	almalinux 8	4.18.0-553.180.1.el8_10
kernel-debug-devel	almalinux 8	4.18.0-553.180.1.el8_10
kernel-debug-modules	almalinux 8	4.18.0-553.180.1.el8_10
kernel-debug-modules-extra	almalinux 8	4.18.0-553.180.1.el8_10
kernel-devel	almalinux 8	4.18.0-553.180.1.el8_10
kernel-doc	almalinux 8	4.18.0-553.180.1.el8_10
kernel-headers	almalinux 8	4.18.0-553.180.1.el8_10
kernel-modules	almalinux 8	4.18.0-553.180.1.el8_10
kernel-modules-extra	almalinux 8	4.18.0-553.180.1.el8_10
kernel-tools	almalinux 8	4.18.0-553.180.1.el8_10
kernel-tools-libs	almalinux 8	4.18.0-553.180.1.el8_10
kernel-tools-libs-devel	almalinux 8	4.18.0-553.180.1.el8_10
kernel-zfcpdump	almalinux 8	4.18.0-553.180.1.el8_10
kernel-zfcpdump-core	almalinux 8	4.18.0-553.180.1.el8_10
kernel-zfcpdump-devel	almalinux 8	4.18.0-553.180.1.el8_10
kernel-zfcpdump-modules	almalinux 8	4.18.0-553.180.1.el8_10
kernel-zfcpdump-modules-extra	almalinux 8	4.18.0-553.180.1.el8_10
perf	almalinux 8	4.18.0-553.180.1.el8_10
python3-perf	almalinux 8	4.18.0-553.180.1.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-72288	linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt...	9.3	0.0019	None reported
Urgent	CVE-2026-98222	KEYS: encrypted: fix integer overflow of datablob_len	9.8	0.0017	None reported
High	CVE-2026-90011	scsi: target: iscsi: Reserve a terminator byte for the login payload	9.8	0.0084	None reported
High	CVE-2026-72289	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t...	9.3	0.0019	None reported

Also fixes CVE-2026-72288

SUSE-SU-2026:4120-1
kernel-livepatch-SLE15-SP7-RT_Update_20 on sles 15.7
ALAS2023-2026-2143
bpftool, bpftool-debuginfo, kernel and 15 more on amzn 2023
OPENSUSE-SU-2026:21910-1
dtb-aarch64, kernel-64kb, kernel-azure and 10 more on opensuse-leap 16.0
SUSE-SU-2026:23902-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 16.0
SUSE-SU-2026:4254-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 15.7
SUSE-SU-2026:4369-1
kernel-default, kernel-default-base, kernel-docs and 4 more on sles 15.6
ELSA-2026-92209
bpftool, kernel, kernel-abi-stablelists and 17 more on ol 8
ALSA-2026:92208
kernel-rt, kernel-rt-core, kernel-rt-debug and 7 more on almalinux 8

Vendor advisory

https://osv.dev/vulnerability/ALSA-2026:92209

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo