Linux · 
Rocky Linux · Security advisory · September 24, 2026
Rocky Linux · Security advisory · September 24, 2026RLSA-2026:70498: kernel security update
RLSA-2026:70498, released September 24, 2026, fixes 12 CVEs in kernel (version 0:6.12.0-211.58.1.el10_2). One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
12
3 rated Critical
Exploited
1
CVE-2025-39964
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0161
76th percentile
Priority of the 12 CVEs
Patch now 1
Urgent 3
High 8
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| kernel | rocky 10 | 0:6.12.0-211.58.1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2025-39964 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 8.8 | 0.0161 | KEVExploited |
| Urgent | CVE-2026-64534 | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un... | 9.8 | 0.0032 | None reported |
| Urgent | CVE-2026-68391 | Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds | 9.8 | 0.0013 | None reported |
| Urgent | CVE-2026-53062 | dm cache policy smq: fix missing locks in invalidating cache blocks | 9.8 | 0.0010 | None reported |
| High | CVE-2026-68159 | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 | None reported |
| High | CVE-2026-68155 | libceph: Reject monmaps advertising zero monitors | 8.8 | 0.0070 | None reported |
| High | CVE-2026-68188 | Bluetooth: RFCOMM: Fix session UAF in set_termios | 8.8 | 0.0022 | None reported |
| High | CVE-2026-63823 | keys: Pin request_key_auth payload in instantiate paths | 8.8 | 0.0016 | None reported |
| High | CVE-2026-68293 | net/mlx5: Fix MCIA register buffer overflow on 32 dword reads | 8.8 | 0.0014 | None reported |
| High | CVE-2026-45894 | iommu/vt-d: Clear Present bit before tearing down PASID entry | 8.8 | 0.0013 | None reported |
| High | CVE-2026-45959 | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanu... | 8.8 | 0.0013 | None reported |
| High | CVE-2026-74518 | mm/hugetlb: fix list corruption in allocate_file_region_entries() | 8.8 | 0.0013 | None reported |
Showing 1 to 12 of 12
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.