AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787935638)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787935638 advisory. - In the Linux kernel, the following vulnerability has been resolved: fs/mountsetattr: always cleanup mountkattr Make sure that...

CVE-2026-97993

A flaw was found in the Linux kernel's vhost-vdpa subsystem. A local attacker can cause a Denial of Service DoS by exploiting a race condition when updating interrupt configurations with an invalid file descriptor. Because the kernel temporarily installs an unvalidated error pointer into the devi...

CVE-2026-97994

A flaw was found in the Linux kernel's vhost-vDPA virtio Data Path Acceleration subsystem. A local user with access to a vhost-vDPA device can configure a queue size that exceeds the device's maximum supported capacity due to insufficient boundary validation. This improper validation can lead to ...

CVE-2026-97992

A flaw was found in the Linux kernel's vhost-vdpa driver. A race condition between device configuration updates and event notifications allows a context structure to be freed while still being accessed by an active callback. A local user with access to the device interface can exploit this...

CVE-2026-97991

A flaw was found in the Linux kernel's vDPA vHost Data Path Acceleration block simulator driver. Due to improper input validation, the driver logs out-of-range starting sector requests but fails to reject them, causing an arithmetic underflow and an invalid buffer offset. An attacker with access ...

CVE-2026-97989

A flaw was found in the Linux kernel's vDPA Device in Userspace VDUSE subsystem. The driver does not properly validate virtqueue alignment parameters during device configuration, allowing invalid or zero alignment values to pass into internal queue creation routines. A local user could exploit th...

CVE-2026-97990

A flaw was found in the Linux kernel's vHost Data Path Acceleration vDPA network simulator driver. When a packet transmission pull operation fails, a negative error code is improperly treated as an unsigned value, resulting in an excessively large buffer length during receive processing. A local...

CVE-2026-97607

A flaw was found in the Linux kernel's IFCVF vDPA vhost Data Path Acceleration driver. When provisioning a device with unsupported features, the driver returns an error without routing through the cleanup path to free allocated device structures. A local privileged user could exploit this flaw by...

AZL-104217 CVE-2026-97994 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

DEBIAN-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

DEBIAN-CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

AZL-104819 CVE-2026-97992 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

DEBIAN-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

AZL-104534 CVE-2026-97993 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

DEBIAN-CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

AZL-104330 CVE-2026-97607 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

UBUNTU-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...