ALSA-2026:18134 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267) * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275) * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210) * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257) * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.7.1.el10_2.ppc64le.rpm 29c2469b8db261ba91917d86912216fc2154256bb50157fd14badc295a650b24 kernel-devel-6.12.0-211.7.1.el10_2.ppc64le.rpm 742493592ab99a2c41cfb177a3984c48c91acd2ad81af2860a0b3a3610c3b237 python3-perf-6.12.0-211.7.1.el10_2.ppc64le.rpm 75f8673d10c5c03d88f823666a0cadcd67855e0f5667b31396301156e5c93ced kernel-doc-6.12.0-211.7.1.el10_2.noarch.rpm 78db96b63b180a526d27658a5f66bd367e0d516ce72b83b9aa8ec6f642d3b051 rtla-6.12.0-211.7.1.el10_2.ppc64le.rpm 860dee521723e9f521cf9e6a679cdc09e58f6f8bb5e0096e4e30454f02685d14 kernel-debug-devel-matched-6.12.0-211.7.1.el10_2.ppc64le.rpm 869b3c08a52099b5e8de751f4c1c8e48916ddf4241f825e8b00ef799fa8297ab kernel-devel-matched-6.12.0-211.7.1.el10_2.ppc64le.rpm 8cafc7973ae147ba05edd6c4dda1c3b73831893c636053754c27ac3c7c5617cb kernel-debug-devel-6.12.0-211.7.1.el10_2.ppc64le.rpm b6a18b8dbb1eae6da4e9c1a74666dd3bf5f4120e7753eb0e3debb2981604b36c perf-6.12.0-211.7.1.el10_2.ppc64le.rpm cacdfa215769bdeadd4ad8c2e137eb47df50cf3be8ff65a5c3a082f646d91b6b rv-6.12.0-211.7.1.el10_2.ppc64le.rpm e1d58ca4c92a8e9ba2d152a2f54f35a03ec7f3251a8f7df4b03caa7b56898905 ALSA-2026:18142 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default NetworkManager-config-connectivity-redhat-1.56.0-1.el10.noarch.rpm 3c3510b6b69347004ae5092b71485721e86928b812cdbbb21a7a13cf2a6cf1ec NetworkManager-ovs-1.56.0-1.el10.ppc64le.rpm 52fb304cd197d711f2cb1a12a92af39be5ad95ff52cd24be8aa2030203f2df21 NetworkManager-ppp-1.56.0-1.el10.ppc64le.rpm b838eec745cec3d8af27778a9bc29f74f8414f3a0b8fa603a7d00bfb7012924f NetworkManager-cloud-setup-1.56.0-1.el10.ppc64le.rpm feb68e2953d8afc6644631fc348c1257b5a9ea292cd7cd0d5451d571da1693e2 ALSA-2026:18143 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default p11-kit-server-0.26.2-1.el10.ppc64le.rpm 68bea1de41e221d5c65b9b7d31663fb4b6898a4f7649d8b66a6681ed92210ed8 p11-kit-devel-0.26.2-1.el10.ppc64le.rpm 8f55d6c78d012bbb7051faeb182f5392e0d08d75690b757433382db5e2830519 ALSA-2026:18160 Copyright 2026 AlmaLinux OS 0 1 Moderate

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966) * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964) * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965) * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967) * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libssh-devel-0.12.0-2.el10.ppc64le.rpm e48f9e05094958b88cdf60c71ad84947d8c308889a3fead29b92b16b0ecd3849 ALSA-2026:18326 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libvirt-daemon-driver-storage-disk-11.10.0-12.el10_2.alma.1.ppc64le.rpm 08ad86a267e0be2b61abad8dd46c57eb34dda3a1cd9831176660b5b8d428e453 libvirt-11.10.0-12.el10_2.alma.1.ppc64le.rpm 0966eecb76862d9bff1001a59591584a2a99b17fb04abda6b3096c1a5a193efd libvirt-daemon-proxy-11.10.0-12.el10_2.alma.1.ppc64le.rpm 09f24ed3049db82d13130a01e7fd7dcbcd5b6592c2f0bba0986baa0f6a3e8950 libvirt-client-11.10.0-12.el10_2.alma.1.ppc64le.rpm 0cad1ab79a830627665aaa62a12c47ba79a0f461c14081174d05063e1d1415b1 libvirt-daemon-driver-secret-11.10.0-12.el10_2.alma.1.ppc64le.rpm 1677211766f29dc528dd13ef09d70cab5671cc9c24e60f1e31a492d7bfae1b7d libvirt-daemon-driver-storage-11.10.0-12.el10_2.alma.1.ppc64le.rpm 31ae2b5735cec15f1e889cb56f01742c71195ccf72ec72ddb06e7f09d9339b03 libvirt-daemon-driver-network-11.10.0-12.el10_2.alma.1.ppc64le.rpm 52cf526b85a71cd7059e927190eb58e3be5fd398d5da6b2b6538318236550bca libvirt-daemon-driver-nwfilter-11.10.0-12.el10_2.alma.1.ppc64le.rpm 5882f0c188d5bf58190c4d052a3092858b2a671cbf8ff210086d7caa1de421ff libvirt-daemon-11.10.0-12.el10_2.alma.1.ppc64le.rpm 5b149f912bda4f0746bb73ce51605156e53eb23dffb6322f341a053f208f6d34 libvirt-daemon-plugin-lockd-11.10.0-12.el10_2.alma.1.ppc64le.rpm 5ee8e59c20a01e06de19839dd259ae15a470c92a3b71020a109e44fcd4873f88 libvirt-daemon-driver-storage-mpath-11.10.0-12.el10_2.alma.1.ppc64le.rpm 780e154f79e877fd73ddc2b37164562a7c48af9cb0b2ee3728fd362b6b2d710b libvirt-daemon-driver-storage-rbd-11.10.0-12.el10_2.alma.1.ppc64le.rpm 7cbf27aae3ee620df4115735e4c11d700005acba5e4645f11d008393a735e334 libvirt-daemon-config-network-11.10.0-12.el10_2.alma.1.ppc64le.rpm 8daaf740c73493381d5296d1bc74f7639edff8a75564b72c5c8c636a52f16927 libvirt-daemon-log-11.10.0-12.el10_2.alma.1.ppc64le.rpm 8ed3b6b27d19bdbf68a1b72c54db9b4b05be183cf7200cc0b032c530b1bd858d libvirt-daemon-config-nwfilter-11.10.0-12.el10_2.alma.1.ppc64le.rpm b71277ae1bc95d63257090ac03fcb6e5f529ce2916627d54b04f28271541efd9 libvirt-daemon-driver-interface-11.10.0-12.el10_2.alma.1.ppc64le.rpm bc1fef791e5da4c52c6e54e3bf7748fa6d422ace111c67d9478cf89fcec0d9cf libvirt-daemon-common-11.10.0-12.el10_2.alma.1.ppc64le.rpm bc93e2ca4cbf79b22964d841fba1bdab109485f82e5b65167de9cc5f7d48d350 libvirt-daemon-driver-storage-iscsi-11.10.0-12.el10_2.alma.1.ppc64le.rpm c438cb68159d41cf8dbd7c939bea61655073d6f11171c0aac249b05b5951caa1 libvirt-daemon-driver-storage-logical-11.10.0-12.el10_2.alma.1.ppc64le.rpm cdb0f5779facf148aa6b91cafdc4034930948d5eddf2e36547f30277f3aa2fc9 libvirt-daemon-lock-11.10.0-12.el10_2.alma.1.ppc64le.rpm d0b294ade96c2c398fa76da215ae99fa30cda544f135952a032ed9114e277096 libvirt-libs-11.10.0-12.el10_2.alma.1.ppc64le.rpm e43c22327c4a24505cefaf52bf515479ce292be3104e624ac7cd57519974962b libvirt-daemon-driver-storage-scsi-11.10.0-12.el10_2.alma.1.ppc64le.rpm ea631caac4ee0964749e6ff9aaea990c3e1fe51f9cb4257859befc084acc6725 libvirt-nss-11.10.0-12.el10_2.alma.1.ppc64le.rpm ee99479994137af5e0d76cf67a1ad7fd8e09530a820405d4e88942c799c3bbb8 libvirt-daemon-driver-nodedev-11.10.0-12.el10_2.alma.1.ppc64le.rpm f5062e917a131b18f8adbbdea2cb77ca35eac60fc3f582e355f21fd84d4ca70f libvirt-daemon-driver-storage-core-11.10.0-12.el10_2.alma.1.ppc64le.rpm feb6b8221ae26f64653f946f9f4accda2f18eb388e35fbb2aba32d951e713da0 ALSA-2026:18421 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default luksmeta-10-1.el10.ppc64le.rpm 1913ebc7f79aaf31f7abe3374b7421dc295f7ea976d7047322cb6e9005d7c70c libluksmeta-10-1.el10.ppc64le.rpm 20387a09b893ea34f05f4bd77d9b1727feb774b2d6f6d210c5a4f2668f1bc677 ALSA-2026:18479 Copyright 2026 AlmaLinux OS 0 1 Important

qemu-kvm security update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694) * firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696) * firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692) * firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699) * firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695) * firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default qemu-img-10.1.0-16.el10_2.alma.1.ppc64le.rpm 93e9077725cde55a5cbcd8cbcc528804b91999613450b31b0ef628e2545acf56 qemu-guest-agent-10.1.0-16.el10_2.alma.1.ppc64le.rpm a9bbc75c134a61583e3631bef10ffd869930c3e31bbd8908fd82fd23ec758fba ALSA-2026:18556 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default unbound-libs-1.24.2-7.el10.ppc64le.rpm 1ef902fa6ec69821a15a28b11f6b9c1ba7b196ada3e74c798c9935cc85e31f95 unbound-utils-1.24.2-7.el10.ppc64le.rpm 7f31d780fafbabfee1a3dae6d1e9e83bd9379ca45880c3bd4cb6404fb605b131 unbound-anchor-1.24.2-7.el10.ppc64le.rpm 9aac67275e7a6b8e5978202963eb668ae1deca8f44264b417a2b76430eba4819 python3-unbound-1.24.2-7.el10.ppc64le.rpm a66e022ae292e0957f6295a047e3c377dd8e490dd83852b811eefa4f4952a125 unbound-dracut-1.24.2-7.el10.ppc64le.rpm a958fa0eef9716d490db0b72b13dceb358ffe03df5cc7d52342978bc91c62c0f unbound-1.24.2-7.el10.ppc64le.rpm b9a75731e56466fcf2263851cc8d18610533e7848a600e75c3fc0f2f32174166 ALSA-2026:19009 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007) * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql18-plpython3-18.3-1.el10_2.ppc64le.rpm 0c046269335f00347215ba07b9cd5bdbf4d0bfc2eae788d1c4a5da3ff7ca5baa postgresql18-docs-18.3-1.el10_2.ppc64le.rpm 187ae48496e861385fa631e94a5780dd0fa67d794d09103358e390cd54ac76d6 postgresql18-plperl-18.3-1.el10_2.ppc64le.rpm 2ff874a573b5489fed3943fe0e107f5206be7acdf3b3ffe3c2b16506588ceca7 postgresql18-static-18.3-1.el10_2.ppc64le.rpm 43ce25991584a1a8588ebaf960570fa45efa5e154a567a94c84a41c6f770d8be postgresql18-private-devel-18.3-1.el10_2.ppc64le.rpm 4dc465e1ba75efecdb09e1524a8dd1112f068b6cfad653d5e8063accbcdaf418 postgresql18-upgrade-18.3-1.el10_2.ppc64le.rpm 5768e695a1f9fac6729d16086d32b110ec466dc1f1eff99fe7fdb9c1c0c1572a postgresql18-private-libs-18.3-1.el10_2.ppc64le.rpm 6a08b4039bdfebd3217196268607496ef6f1d08ed3f9ce620329b93c98ffa3f1 postgresql18-upgrade-devel-18.3-1.el10_2.ppc64le.rpm 8304e981d4478968bc4f61b2443afb1b610638f90492cade46245e3a55d66eb5 postgresql18-server-18.3-1.el10_2.ppc64le.rpm 8997a27f8d44b2414a924e7615248a2ac7081aba97927001eecac193bb476699 postgresql18-server-devel-18.3-1.el10_2.ppc64le.rpm 9f87a64eccbffc3cb072400543503c158e1ba282df87d0ded6527e3322072a74 postgresql18-contrib-18.3-1.el10_2.ppc64le.rpm c396359a378cecd2ffec3d1538456a444dcb0e4c9206678efc56e1ce8c3e2892 postgresql18-test-18.3-1.el10_2.ppc64le.rpm f816e319bbcfa3f387242c7b80792d36133ace7b9be144bbaa6ca4d10c8024d5 postgresql18-18.3-1.el10_2.ppc64le.rpm fd3c80d37e22f5d36f32a7bc47228106b3a6c28de749640f2a220d96bff46a91 ALSA-2026:19010 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003) * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql-16.13-1.el10_2.ppc64le.rpm 04ca578896937f665df2a735c64a73b49fab17f70b7fbf3aa02520a6af2ffab3 postgresql-server-devel-16.13-1.el10_2.ppc64le.rpm 0b81180c4dfab592be3067a534c6408a75cf8500c7f8f79b8a8e09747e2e0c4c postgresql-plperl-16.13-1.el10_2.ppc64le.rpm 454050bbb3352465ee4de10f9ee9c6bf331c02fb9bdf02f5af1b4eb53c562e6d postgresql-test-16.13-1.el10_2.ppc64le.rpm 6e023734b8fefa27d83c35017db3b635177fc33a8b6b8aa9c01617516d1afd49 postgresql-contrib-16.13-1.el10_2.ppc64le.rpm 9d97bb23fdb60734fa500d82f68ad9b9812efca0e5d4c9b43e8d22faccbd8b28 postgresql-upgrade-16.13-1.el10_2.ppc64le.rpm b1058c3fe25182b35b36ea4c8017eed8828a29c40b69d28f383727614c907566 postgresql-docs-16.13-1.el10_2.ppc64le.rpm b3aaa4dee99813c929c0939a986895476970631affa5d5cdab275fcc54541e02 postgresql-private-devel-16.13-1.el10_2.ppc64le.rpm caf8c3df805fce24c959e46c8495b6b8fb93a5af606f5617533fbc478215819a postgresql-private-libs-16.13-1.el10_2.ppc64le.rpm d1beda7e5332c2d30532671bd5c30841012765d91c9ec19272b0355340508aa5 postgresql-static-16.13-1.el10_2.ppc64le.rpm d7df61b2c09805c67278ce5d812b24b0603af9f93c7a4223ecd5c9600984a4c7 postgresql-upgrade-devel-16.13-1.el10_2.ppc64le.rpm d8a59b8b88ed4dfe58a6050bc421e9fb39238f71b6785a59a5b87ccd91058c2f postgresql-server-16.13-1.el10_2.ppc64le.rpm da681d096f7f52e9af0d1d5cd23249a3ca05148fdad237dea8f42bd18233a2ab postgresql-pltcl-16.13-1.el10_2.ppc64le.rpm e42a47d281edc236247c703934766edc7947aedca14f66084e3b7a403b50bece postgresql-plpython3-16.13-1.el10_2.ppc64le.rpm ecdb43d6d051fcbe03ac13120b99d2e35d40974eff7f0be6d1397c3fc2a2d1fa ALSA-2026:19013 Copyright 2026 AlmaLinux OS 0 1 Moderate

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default delve-1.26.1-1.el10_2.ppc64le.rpm fb62ab19c31d8c49237921e757afbc85e2da25ced1538c2846875d12769b2f3e ALSA-2026:19017 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default podman-docker-5.8.2-1.el10_2.alma.1.noarch.rpm 167be1b8d65574dac9045abe3e1e0b9208ed8e6c2c2c8b29b83d77c4173a468f podman-5.8.2-1.el10_2.alma.1.ppc64le.rpm 2195464c01b6e6ce01867704a0d5290ce994bb12afde20b26ee202f95044ef45 podman-remote-5.8.2-1.el10_2.alma.1.ppc64le.rpm dad261a103c55a8a03560ff5dda2114847d24de94e1a7b9924ff10d2014b25e5 ALSA-2026:19019 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-3.14.4-2.el10_2.ppc64le.rpm 0b2210b80b18826425d291a0670dc5e3d9caee56e82d4dc859fe9892003b71b2 python3.14-tkinter-3.14.4-2.el10_2.ppc64le.rpm 5a34545a4c6e8a04dca70f8bcee7c8ac805376f953a449ddf0b9f883f3ae4c7d python3.14-libs-3.14.4-2.el10_2.ppc64le.rpm 9547ce47daa6b693e1567846eaa5768619dc14766ca612bd61a15da4d689a0da python3.14-devel-3.14.4-2.el10_2.ppc64le.rpm a242e304ef96f5ada241c224666141b48b77e0bc8acbe22e38d37b7107b7f817 ALSA-2026:19020 Copyright 2026 AlmaLinux OS 0 1 Moderate

crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default crun-1.27-2.el10_2.ppc64le.rpm e3a4ae335747aefb08c16b0c045349913eea919543d0378a307f4a2daafa03aa ALSA-2026:19022 Copyright 2026 AlmaLinux OS 0 1 Important

golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default golang-bin-1.26.2-2.el10_2.alma.1.ppc64le.rpm 045936d0375af67cb8c234e59e4988221cd325d7e4cbf3498436bcce5acc8692 golang-tests-1.26.2-2.el10_2.alma.1.noarch.rpm 86ddbd7f00012fa580ea1c9edb33d9e5982eef71b38e0283ad2659fa61352095 go-toolset-1.26.2-2.el10_2.alma.1.ppc64le.rpm 9bf073ea86521ba79bc7347dbcdfbcab29a10b5dcf14d77a495fa4312180cdfe golang-docs-1.26.2-2.el10_2.alma.1.noarch.rpm a7b9810b608f99d1d4e8dc8771e6e1493f6f39113e88f56ae83bd92548afe904 golang-race-1.26.2-2.el10_2.alma.1.ppc64le.rpm af37500a222169a92b59fe9ccd49bfb0c2b5af3e0b7612e8bf7c07652c90030e golang-1.26.2-2.el10_2.alma.1.ppc64le.rpm d201699226d5a49efe4c5952556f51e9546d748fe9198f8b54bc834633168f95 golang-src-1.26.2-2.el10_2.alma.1.noarch.rpm dbf8e7996f83be39afa1954de0ab45d661a96b356a3e406a1960cd6be572a7bb golang-misc-1.26.2-2.el10_2.alma.1.noarch.rpm ff930bc6ddd8d4469f1e7d1cab514142b71eff36da84ce419045251ce79e3e17 ALSA-2026:19024 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.ppc64le.rpm 1ee6542b413e3e3ffa5f29ba03261c7ca3e68eb5be3d9d4294372c1d180acf1f gstreamer1-plugins-bad-free-1.26.7-2.el10_2.ppc64le.rpm 27cf78475e32c58d87e3157190177a6951d8e6159fd4bfffa5e56c1c15505530 gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.ppc64le.rpm 38da1a9fdf83ad9ebf92ad4318e9b8238a730326091f12ec190ccda7a7e15032 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.ppc64le.rpm 97d95e31be0bf619b6d5eb9dca8e91e8996c373ec0cde68d7c34f51c7fea706e gstreamer1-plugins-base-devel-1.26.7-2.el10_2.ppc64le.rpm a57a84cdf36d1c841d70c15f0d34ec472f983024a804c3562ba1bc305e1ad0a6 gstreamer1-plugins-base-1.26.7-2.el10_2.ppc64le.rpm b2255d5978d1380412c6ae4a9918a181153c2712f79bb7765cc873d89de97c31 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.ppc64le.rpm bdaef0b40450090a5804ae5c4552e873e7207d7e5f1c40a72062ee03eba892c0 gstreamer1-plugins-good-1.26.7-2.el10_2.ppc64le.rpm e9a4a0125ba46704a2810f4cc2a82da81f429061209baa894945b246477bb427 ALSA-2026:19031 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default skopeo-tests-1.22.2-1.el10_2.ppc64le.rpm 75a0150e8901eadbc83443b5c1f40accb03163b64a7981846f381f48f094e3e7 skopeo-1.22.2-1.el10_2.ppc64le.rpm e9fed1294ac7eb38995dfb1155474b62f5cf5976642d48cbbadb0e9806d1ff09 ALSA-2026:19032 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-tests-1.43.1-1.el10_2.ppc64le.rpm 547cd71b329a1a7ed97d26c3651fccb6b58fcac0af5be75f65bfd263e8ade025 buildah-1.43.1-1.el10_2.ppc64le.rpm f0e91585fdb8d08803c9ff6afcb3f8c08d21b703783130d9ce1fa2d5665397ee ALSA-2026:19034 Copyright 2026 AlmaLinux OS 0 1 Moderate

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-tornado-6.5.5-1.el10_2.ppc64le.rpm 1f4ef09f2e82403f66745bbf9a06ce10c68a5ccfebc6174b97cdedd5fb0d49f7 ALSA-2026:19042 Copyright 2026 AlmaLinux OS 0 1 Low

python-jwcrypto security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm db89aecbcd378aa983e05761a6b2cbca01c3a05e38a708730a9029e277498a12 ALSA-2026:19043 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.1.ppc64le.rpm b228db67e30930ff635ac5ac796909a9c71fe78b80bec0b2287dc0d347af600a ALSA-2026:19053 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freeipmi-1.6.17-1.el10_2.ppc64le.rpm 028689d66c705cc3577c8e4a72e3c029850d5db44a65f78282d8dc06f67e0140 freeipmi-ipmiseld-1.6.17-1.el10_2.ppc64le.rpm 3066f706634219bc74ed76bb3b62dca600f5903c859541aca62fec1474f294fb freeipmi-ipmidetectd-1.6.17-1.el10_2.ppc64le.rpm 9ca928763b54b187bdda59d5d52d88f4dcb259707c662bb025c8a052f453847b freeipmi-bmc-watchdog-1.6.17-1.el10_2.ppc64le.rpm e858b09133546197a99f2fb5e4254fb8a5ec69258e37819941c029b0f40a8ae0 ALSA-2026:19054 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 032f9dfd26c60d1d72b363ff2061d11662e957528f62a47531f5bbf5f865b387 tomcat-10.1.49-1.el10_2.1.alma.1.noarch.rpm 30074a00cdb2fd116e1a86d0dd4fde4c0ee1ad6c1d76871cede1af36c10ad784 tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm 910908c4cbeb19192b15b52ff7bcb553a79de45a9fd931d50fa458956364dc8c tomcat-el-5.0-api-10.1.49-1.el10_2.1.alma.1.noarch.rpm a4ea29cfcc7dc0b39309a55f0cb9f6825d1b6965da13f87f41af81d7293301e1 tomcat-lib-10.1.49-1.el10_2.1.alma.1.noarch.rpm bf8d00201d00c1d371bcb29fde0b79354efbec1bdd757baaebc03477a5d83d5c tomcat-docs-webapp-10.1.49-1.el10_2.1.alma.1.noarch.rpm cd1899698b4ef517e177bafdcbdb1e1542a1f0c867d8b7fefb87b3e46b4b54bf tomcat-admin-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm d5a2b5453e34039aa491637abe23194a845e0a52cb69be855ed09fbc360ed9f7 tomcat-webapps-10.1.49-1.el10_2.1.alma.1.noarch.rpm fdbfa914a61bc11297a055cca8ba8bb8c9d37d90b771583e8b8b87d3a7a388c7 ALSA-2026:19061 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-doc-2.39-121.el10_2.alma.1.noarch.rpm 8e5944044c77883ffcdf699a95b72c6bb5ec1b40fe769362ba84948c5c446f4b glibc-utils-2.39-121.el10_2.alma.1.ppc64le.rpm 9dfb3595ecfc926e61d7246b9415d1a6da57ca5481c0a1ddc976b062d85ec09e glibc-locale-source-2.39-121.el10_2.alma.1.ppc64le.rpm f25004abd7703110f0d6b39153df810477d15a82fc1b2191fde46db3b881adb0 glibc-devel-2.39-121.el10_2.alma.1.ppc64le.rpm f76567aadd0488e0b600c967887c85bdae015d8ce249597b6c44b490c3356b36 ALSA-2026:19064 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-devel-3.12.13-2.el10_2.ppc64le.rpm 2d28dc94876d78c720e134047e11d424c26b6bd5c677585ed09c5b7fa5386ca2 python-unversioned-command-3.12.13-2.el10_2.noarch.rpm e02dd9af1061d81e9eb4f3b2ab2cee1f8bcaa3917c0c834b9885fbcb4199da2e python3-tkinter-3.12.13-2.el10_2.ppc64le.rpm e052ba52ec287cbedb8f948677fd17e53f3b95a8bd4ed691434a1e0b3a5ea5a9 ALSA-2026:19066 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssl-devel-3.5.5-2.el10_2.alma.1.ppc64le.rpm 05b1acb9e1382c6f50afdc3ec819f9b31de846fc8545fa9e885feba19ca71e1f openssl-perl-3.5.5-2.el10_2.alma.1.ppc64le.rpm c720c14d8e969228dabc453be18feb596bbbd8a3f38eccc85b74f3bd96f7524c ALSA-2026:19067 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-4.p2.el10_2.ppc64le.rpm eb5fd5c8e6cb26d0ec7f5df12ef6560a85fb240ff9112667f9528d34ba5abef1 ALSA-2026:19068 Copyright 2026 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default systemd-devel-257-23.el10_2.1.alma.1.ppc64le.rpm 2a5ed060148b2229dbe25a3ac50380b585572e9aa78f2aff86f2f36f1f6fb106 systemd-journal-remote-257-23.el10_2.1.alma.1.ppc64le.rpm 5f6a70f27a47e7b8563af6b137e975141d942d9545ffd031e0fe84e0f3128f43 systemd-ukify-257-23.el10_2.1.alma.1.noarch.rpm b19a2e5d5ceb000880e9a0b2e332123c6cc5f6052003d8b27a6230bc528bca3a ALSA-2026:19069 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssh-keysign-9.9p1-23.el10_2.alma.1.ppc64le.rpm e75305f5b0f3fce5e0ac020a742035fec411694d83cb05fa6f07b8adfe3bed36 openssh-askpass-9.9p1-23.el10_2.alma.1.ppc64le.rpm f046f749d5228c8d63a08cacde564d425d821ac435c1d21e90d464081edbe3fa ALSA-2026:19073 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.2.ppc64le.rpm 27fb3c93436a58d0d7717095ff9c3b7acdfac9e93270acf0b12146dc60c62308 xxd-9.1.083-9.el10_2.2.ppc64le.rpm a5eef8bdc6210e3bef4fab4b3d60a2b79d970ce243eb041f421694cfcf0f2b9b vim-X11-9.1.083-9.el10_2.2.ppc64le.rpm bd53cbdadce11a38062cefbef8e34b58db5e195316014e8bb498f1984e39d43c vim-common-9.1.083-9.el10_2.2.ppc64le.rpm f1ec275a498be0f91d2b61a694ba52abdf7c02fd0da1b1eaf6d50730414df404 ALSA-2026:19074 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rtla-6.12.0-211.7.3.el10_2.ppc64le.rpm 107d82b56ced847fef35ffb0b4c6bfc2e3ed115500fbe3f77bf4ff18e8475261 kernel-devel-matched-6.12.0-211.7.3.el10_2.ppc64le.rpm 10800d2c450b6ed889d42acf08b374bc17def889e48f5e4910e642fcd98d343c perf-6.12.0-211.7.3.el10_2.ppc64le.rpm 236f9aa134013d39ffdcf4d543fb36ebcb9bf3bec4e2dbd611e2222b3aeda330 kernel-doc-6.12.0-211.7.3.el10_2.noarch.rpm 2a68239ba7e1ffded8f59859942aad0efdfdc10912c47834975a6dd22a799961 kernel-debug-devel-6.12.0-211.7.3.el10_2.ppc64le.rpm 6a0d930db9637f203fe846168b40b749c15344fd3c02a41e3d8c9d1f230e81cd python3-perf-6.12.0-211.7.3.el10_2.ppc64le.rpm 8396c253f674b68c73fc74b159902181ac74a3d06eb929c3e285c85861d6084d kernel-headers-6.12.0-211.7.3.el10_2.ppc64le.rpm 8e69d93b5623d333cc47bc9df707c1e2a3ef9e0cd267117aa6fedef2285342ac kernel-debug-devel-matched-6.12.0-211.7.3.el10_2.ppc64le.rpm 994ec82c4e8c510e83236bdd771c7346ca2ca5178f697478ed6a52c456a89340 rv-6.12.0-211.7.3.el10_2.ppc64le.rpm c0ed1d43e91b142a426e43d2e9aeeae0440f69a0a24914d00b3d1a7abf465caa kernel-devel-6.12.0-211.7.3.el10_2.ppc64le.rpm dfbc7bfec67d6a3dcae8d56ca1b814a4cf097907072070e73e63fd2244aa845a ALSA-2026:19125 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.ppc64le.rpm 5c03029832c21efad67ba9241fb563c0404a5ee4bd9dfe5407a39b117c864ea4 ALSA-2026:19126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-0.4.9-4.el10_2.ppc64le.rpm bd247ee31d66e84c57578bfac63888cbd257f84a134af1468b5a149cc8d33640 ALSA-2026:19127 Copyright 2026 AlmaLinux OS 0 1 Important

gdk-pixbuf2 security update

The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gdk-pixbuf2-2.42.12-4.el10_2.5.ppc64le.rpm 445355cd1b903c70672cb9a7862b23bfb6bc45600423c173e1ebf7f2b4bf7e7e gdk-pixbuf2-devel-2.42.12-4.el10_2.5.ppc64le.rpm 65557b72e662c871edaef899ea5952521cf17c5b378cc20a04f953109925f352 gdk-pixbuf2-modules-2.42.12-4.el10_2.5.ppc64le.rpm a5fd37021c43025412d4f20132c403d52426a89d9d49ddadabbc4c19b64d73a9 ALSA-2026:19128 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-6.el10_2.ppc64le.rpm ec8478e23af881e060b9a5363fc12ddf7db61923bbdc258b8ed4937fa86bccdb ALSA-2026:19130 Copyright 2026 AlmaLinux OS 0 1 Important

libcap security update

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libcap-devel-2.69-7.el10_2.1.ppc64le.rpm f13b011c21a11aa633fe6ee2cffd79cc270d49414d2ee051ce6877b91731d8ce ALSA-2026:19133 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default git-lfs-3.7.1-4.el10_2.ppc64le.rpm a5d19f601742c3499244af9f5221bbf94b6b102e85fb70cbbbb958b13bb58166 ALSA-2026:19134 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-selinux-10.2.6-26.el10_2.ppc64le.rpm d08126460020215759b3266badca53e7e3e54f9016a10a4bcd9c0a59daad2cb1 grafana-10.2.6-26.el10_2.ppc64le.rpm d60150c3dee80950a7494059645ee1e73a5471e94b0b5c5f2ffa1aa5590eb463 ALSA-2026:19135 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default opentelemetry-collector-0.144.0-2.el10_2.ppc64le.rpm 83bfd5bca60766d3286392d8ba633a8256f7db14796864a9995f8fd7c318b528 ALSA-2026:19136 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-pcp-5.3.0-5.el10_2.ppc64le.rpm 2c69adc1f25bcddf0ee0d395563a0ced4e3f2aec525f70f4fe56be5e997cb5fd ALSA-2026:19141 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default PackageKit-glib-1.2.8-8.el10_2.ppc64le.rpm 6ff17d2c42a9b26686486a17838ce9bcb7ec8e4f5d530d9540d1be1c4447d45a PackageKit-1.2.8-8.el10_2.ppc64le.rpm 74b84f11948e58c6648f8b92017978002dac1610e8c22157fc8d0a4107bb42bc PackageKit-command-not-found-1.2.8-8.el10_2.ppc64le.rpm 7f8bd990c954746b957d4a438619522beb55c33523f4cff125d6f9299031da46 PackageKit-gtk3-module-1.2.8-8.el10_2.ppc64le.rpm b10de9127d2113cb2e9f542dbc8d77cbb0c0003fa6f3618bd27403fdecb977ab PackageKit-gstreamer-plugin-1.2.8-8.el10_2.ppc64le.rpm ffacec0bb31c73792eeadc907829d0f7fd84b1ac4ca9d82dee3c980f29bd3090 ALSA-2026:19143 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271) * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.11.ppc64le.rpm 315a5c090efbc086af2aa37904d54d2626dbd0810cdc7066cfec63ca9b9d9a3b libsoup3-devel-3.6.5-3.el10_2.11.ppc64le.rpm 7fc4c61666831b4199e75cb2b029c96697b899e91f8b9ddadeaf878a79eccb42 ALSA-2026:19145 Copyright 2026 AlmaLinux OS 0 1 Important

krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read (CVE-2026-40356) * krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism (CVE-2026-40355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default krb5-devel-1.21.3-10.el10_2.ppc64le.rpm 418af39235397224d3a01cf3ff88a62c3181ac32c456a52ca32ff1ab0eab5c6b ALSA-2026:19146 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.2.ppc64le.rpm 1972627606db235cf1da5b2468e6a3c2fa4cc69e4e4221734c7f4c0a8b907d44 openexr-3.1.10-8.el10_2.2.ppc64le.rpm f97df335ee8ca60650ab19657f02440529863c815c39eb1d985e2e746bd551fc ALSA-2026:19148 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glib2-devel-2.80.4-12.el10_2.13.ppc64le.rpm 6e3d3f9cb5d46b081278f602aeee2935553e590fd42aca6f890077df9cfa7ac0 glib2-tests-2.80.4-12.el10_2.13.ppc64le.rpm d06fc0d3abc77ae77134a948fa923184e6532c591dff7334109a998c5e84edcf ALSA-2026:19149 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dovecot-2.3.21-19.el10_2.ppc64le.rpm 86dec3d3284dff48f9f9d5b48b2cda02af2ff1f95de8d0246efd2a6d80fed6d7 dovecot-mysql-2.3.21-19.el10_2.ppc64le.rpm b22b330e25271dbcafba4f65ac51b25380d550152a8e4307a50e686d949caaf4 dovecot-pigeonhole-2.3.21-19.el10_2.ppc64le.rpm cabf9e5bf440b5d41041ee7429452592d1e2fe99968ea94097112ca4240188b1 dovecot-pgsql-2.3.21-19.el10_2.ppc64le.rpm cd1837deca4627a473cacf4640f9864f076ea3543615e9efb249dca8648b9972 ALSA-2026:19150 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libtiff-4.6.0-8.el10_2.1.ppc64le.rpm 06c0143688543e4c7d80b1c17934fa6740556a97cb9287ac3e1ecd451210416f libtiff-devel-4.6.0-8.el10_2.1.ppc64le.rpm 209ec68a0fb85dc580511b9b97c53e807babdb1ac1067a69c52806ccbe305b91 ALSA-2026:19152 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsync-rrsync-3.4.1-6.el10_2.noarch.rpm 6ce73c87a6758941f9efbd47f3a5dd2a2ea31d8602fe86d9b50d137c2939e69a rsync-daemon-3.4.1-6.el10_2.noarch.rpm 9f76d6a1f61310d5e7fb2cad97fccf750d8a2777db08a53fec77160350cf917f ALSA-2026:19153 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.10.1-1.el10_2.alma.1.ppc64le.rpm 0065e1f6b7435ee9151de5ebd4c551d7d2e87c3713d81f1e7a51fd425e0f63e0 ALSA-2026:19154 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default giflib-5.2.1-24.el10_2.ppc64le.rpm 1fa17afcbb4c967661b137273b5964985d89aa61b3a3796f1990510ea9b1573d ALSA-2026:19157 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320) * firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322) * firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.10.1-1.el10_2.ppc64le.rpm e94edba7b38134efc1509c7b7ab29b2e1a501e8cfcf177793bb817fc239bb494 ALSA-2026:19158 Copyright 2026 AlmaLinux OS 0 1 Important

dnsmasq security update

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291) * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890) * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891) * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892) * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893) * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dnsmasq-utils-2.90-7.el10_2.ppc64le.rpm 954683c8e6289166abaeaa6bfff0f1a4049272c870432e8a1525d92c7cb56692 dnsmasq-2.90-7.el10_2.ppc64le.rpm f3856a206f2837c62009833e84868497ba83197b59bd51b7430142299e3c7e6d ALSA-2026:19159 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nginx-1.26.3-6.el10_2.3.ppc64le.rpm 1a98094644546f4f4aa87e755798f9289ee639f3daf36b72964146620ed2fb75 nginx-mod-http-image-filter-1.26.3-6.el10_2.3.ppc64le.rpm 1e6d9d2f97c0524dda40f7a552eefe3bf980a28a4fa55dadb2a0c13b4e574c99 nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm 3f0c16ba9b852a8917cd5d6999e2c127f547446efc3c0f2cf3c5eefc43e389c4 nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm 8890f406349040013ca50201c62964d631bbd50b288c439c5ab1bfd5bafc9330 nginx-mod-stream-1.26.3-6.el10_2.3.ppc64le.rpm 9658631a43548458240bc99d689931558bd951683048f48a2b6d886244c9a8b6 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.ppc64le.rpm 97aba0d0a849492a75675a7e0c5bba4edabe91c4d06224399b90cb3e3baef041 nginx-mod-mail-1.26.3-6.el10_2.3.ppc64le.rpm a969c5f77150df0953a78fda81fcff3dc5b0e4f7af9b4bea2f5fc7a6c0ee7f99 nginx-core-1.26.3-6.el10_2.3.ppc64le.rpm d5355e2791fc2f8d88f42870548354891b2dfcfe8b2138ec205c822a460874ec nginx-mod-http-perl-1.26.3-6.el10_2.3.ppc64le.rpm e8e69ac07b67a38e82dff87db8d75eb941bc48585228f29acf58a5cecd9f0ae8 ALSA-2026:19160 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Other issue in the WebRTC component (CVE-2026-8094) * firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092) * firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.10.2-1.el10_2.ppc64le.rpm 813d44ab6893793819494c647a726df26e86ca4620682e57cdf8ee994cedaf7c ALSA-2026:19560 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libsndfile-utils-1.2.2-6.el10_2.1.ppc64le.rpm 384a67220e45654b99746b494ca7ea12954ec29439d43325e2312daaac772230 libsndfile-1.2.2-6.el10_2.1.ppc64le.rpm 69e3b6c0c585f6d5a40152e2bbc3bb79cca984ada7456e757fe7ac5677c35f67 ALSA-2026:19569 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.16.1.el10_2.ppc64le.rpm 077f10b05f8120d04864b17d786090416eda20c56e967dcae742e875f292192d perf-6.12.0-211.16.1.el10_2.ppc64le.rpm 19c026b796d5e348354f0567fa95d8bf75595a7e06d599c80bf1a7b3368c34a6 kernel-debug-devel-matched-6.12.0-211.16.1.el10_2.ppc64le.rpm 2064ebdd81310f8e8cbfdc0123d6a579a087992170629652b258a86d11b40178 rtla-6.12.0-211.16.1.el10_2.ppc64le.rpm 419fce12f149b5ff5e32e4e88df3eed652b1c4ecc0fcca4004ba8ac83c448c76 rv-6.12.0-211.16.1.el10_2.ppc64le.rpm 660b50d99587997857e77763d70a4de8fbb741ee719358ccbed2e78caa1658d0 kernel-devel-matched-6.12.0-211.16.1.el10_2.ppc64le.rpm 71e48fcd70c67bf3fd2251c1be3dde13df13003f926d48703675df8e20691e49 kernel-doc-6.12.0-211.16.1.el10_2.noarch.rpm a30d005f590aa010563453b7942bdd2cfa63cee5945427cf1bda74dd421aed6b kernel-devel-6.12.0-211.16.1.el10_2.ppc64le.rpm a8df0a01188282468539e6d7ac059e4730248f9f5bb72ebba39c3275cf6fafbe kernel-debug-devel-6.12.0-211.16.1.el10_2.ppc64le.rpm c17ed329aee7c02ebfe869fab74f6d2c9029bbcc5056f96d4876e02b12328693 python3-perf-6.12.0-211.16.1.el10_2.ppc64le.rpm c30c1a618f4827e41d019c5f6c90f709a7d43e9226a9a821ec0cc1ab91c476cb ALSA-2026:20594 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-devel-2.39-124.el10_2.alma.1.ppc64le.rpm 5606d42b9aa600c1851addf099c76297fd6340219cfd226029b8eba1da43c707 glibc-locale-source-2.39-124.el10_2.alma.1.ppc64le.rpm 96036fc6c33990becff04e4a3df0eb23a61d505ba010f52db5af0a9db8cb597e glibc-doc-2.39-124.el10_2.alma.1.noarch.rpm c589ecc76ade948f7fc3324ba9ed3bd004cb7f413e99688e10998fd997695708 glibc-utils-2.39-124.el10_2.alma.1.ppc64le.rpm e0aaf2d9f1cc6ffc83fc2e29657f6a01126668f7599845bc5c4126ae26e05b70 ALSA-2026:20600 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default wireshark-4.4.2-10.el10_2.ppc64le.rpm 44d4fe805032cd90b1992cebecf6e9891d42dd0baa33186ebc43eb6f6a1f3738 wireshark-cli-4.4.2-10.el10_2.ppc64le.rpm e01ada89068c958759fc833d164f6ad1c6ccedc6a23d2110c33eb48e5d0238c6 ALSA-2026:20606 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.ppc64le.rpm 668b4f32e4acc427b4dfa6e2bf55cd6ede81f51d22d7cb8d13c8d0989ed1efd8 ruby4.0-rubygem-pg-1.6.3-34.el10_2.ppc64le.rpm 670bffc43f632f650ba46ed7ede66f3b2ea470a61023aafe8b4a2612637fef06 ruby4.0-devel-4.0.3-34.el10_2.ppc64le.rpm 8d6187608c7f9a6138f513fc083c25792b799bb0f9d5276e4c8993f9ae92f455 ruby4.0-4.0.3-34.el10_2.ppc64le.rpm 9d6e38f327b2ce7c2b57fafc339aaf3ed8cabac7981bb7555cb763a5ef6f0280 ALSA-2026:20613 Copyright 2026 AlmaLinux OS 0 1 Important

gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gnutls-dane-3.8.10-4.el10_2.ppc64le.rpm 56110f356e07afb95458397a1ca0b9b815e9651eed80f65f09859b0004ec389c gnutls-devel-3.8.10-4.el10_2.ppc64le.rpm 762828269076aceeed537792f4d4490e33968444a427b13b937e6876fa64643f gnutls-c++-3.8.10-4.el10_2.ppc64le.rpm a3d751fe1f9b5001215934de50a7fbd17d21ed3e5645b4834fb38f7c6a754a0e gnutls-utils-3.8.10-4.el10_2.ppc64le.rpm ae05704c952a9e262eed3be4ca928ac157063be937d714f0d4067697e2a9ffc0 gnutls-fips-3.8.10-4.el10_2.ppc64le.rpm e6fc492f0fe20934cd02026cbc5d062da0de75b8e88c83fbc991cf8110ef93ce ALSA-2026:20693 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mysql8.4-common-8.4.9-1.el10_2.alma.1.noarch.rpm 0d7ccc94e1089ffb6b3fbcd721eec0fed9e1f3494a20fd6d6458a4b6df88a845 mysql8.4-errmsg-8.4.9-1.el10_2.alma.1.noarch.rpm 1be911010c4913a85c01b874457f48ba4933cb9701ec3fe5760128223f810f45 mysql8.4-libs-8.4.9-1.el10_2.alma.1.ppc64le.rpm 6859a438437923ec3dc351d402823df700e2aadaa08bd80d54dbb834e9919195 mysql8.4-8.4.9-1.el10_2.alma.1.ppc64le.rpm beb4e582cddcb29fa9a526e8ca81bb5edac429f44a223dfae499e87ec195f24a mysql8.4-server-8.4.9-1.el10_2.alma.1.ppc64le.rpm fba7c603a4557109ab0d471adc895de6a881b1771d4c39e965da5bc2608f6a52 ALSA-2026:21286 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.ppc64le.rpm 2ac546a69bb24efb2e0a02a727dea14c60f0710dfa871f4fc577fd0622ef2f21 dotnet-hostfxr-8.0-8.0.27-1.el10_2.ppc64le.rpm 2bcc404ec035566667032032a0fcb597eff13d64b0abca03cf58f268e9f8eaab dotnet-sdk-8.0-8.0.127-1.el10_2.ppc64le.rpm 3f6760c8d73e731da6c72ca43620af75de5e2b111ed1040ae265cf93b0b74fe8 dotnet-apphost-pack-8.0-8.0.27-1.el10_2.ppc64le.rpm 6f33cab5bb765f6f88ebc087d6302203ca87529fe5e4c740e7b08a324f173c26 aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.ppc64le.rpm 8a72a2e0a40b7f06b8f537d5f243b52cc805a9c5c12c4b08ceb1efd0777b1a88 aspnetcore-runtime-8.0-8.0.27-1.el10_2.ppc64le.rpm 9d9c900fd114dcf5fa4c52e5fdc8837550e3f3ec15a14692bf2717771042b0b8 dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.ppc64le.rpm aa067e8b06b18bb8c1e5947f4b21c6fda857b72317f7a086d239a1eeb68c3140 dotnet-targeting-pack-8.0-8.0.27-1.el10_2.ppc64le.rpm aa0c9553b0806cb68b5a9b09c2e7a52ec71fc021625f0fb1bfb5e645753e5422 dotnet-templates-8.0-8.0.127-1.el10_2.ppc64le.rpm af5e410aec9cf96cf882894ed05e2139dc79e95b29507e7e9ceb9dad700a03bd dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.ppc64le.rpm e5ddae9140451f332de80efd63de5c2eac224fe7bdaf8b3d760017bc114c59a8 dotnet-runtime-8.0-8.0.27-1.el10_2.ppc64le.rpm ff5a4ea41b47fdf812b1c4e01d0c24086fc37ab658d5ae2e3797b51163a06de2 ALSA-2026:21380 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.11.0-1.el10_2.ppc64le.rpm 9d9d3d2674237751b332421413fa6b26e6307eb47ecfa993d0a103b7ff4cba37 ALSA-2026:21433 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default httpd-core-2.4.63-13.el10_2.1.ppc64le.rpm 23a52858a4748a4208e89cf5a2826f1a769587e8e0fd1f23c914731d5198a0ba mod_proxy_html-2.4.63-13.el10_2.1.ppc64le.rpm 271badfadb69a241ea3ebc24388a0e3103b1b63daedf479cf24d845116ab8b42 mod_lua-2.4.63-13.el10_2.1.ppc64le.rpm 2c8cde9149ad404e6ccc36c7a2f7a1aeeacf870b107678959d6f464bbfd75041 mod_ssl-2.4.63-13.el10_2.1.ppc64le.rpm 59c1215a0b451b9cea7c6f8a5abf03a00dabf66fc3171938ba314e67d1f7a61c httpd-2.4.63-13.el10_2.1.ppc64le.rpm 7bfd4ca746dae74de0b95f7853b31e734e035a5ac205230c63cad9d3ff6857e2 mod_session-2.4.63-13.el10_2.1.ppc64le.rpm 82819633edc7f1acadd44e17840a2df4667d97b5d66101dbdc2223bf74cf1c5d httpd-devel-2.4.63-13.el10_2.1.ppc64le.rpm ab8219a747010d6b34bf1c50054cb3aaba634cbdc1fad6f63e331a06f0585384 mod_ldap-2.4.63-13.el10_2.1.ppc64le.rpm c1bb1a4295df01df26bb44427a3d66273fd1725066daf0c39fbd715079b8fb1f httpd-tools-2.4.63-13.el10_2.1.ppc64le.rpm c52caee7c70ac5346d2f0ebc6bff6e0e56134330ea6cfa10f3dc7149a899489d httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm e031b93501860443509180fc94ca9fd2f55bb1e5c48013833c3648cf8b45ea9f httpd-manual-2.4.63-13.el10_2.1.noarch.rpm e3cfbdbc5fcf4512653e1a0be2d6396861efc9b9c15498e4543c0fcbc556c07a ALSA-2026:21557 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-6.12.0-211.18.1.el10_2.ppc64le.rpm 04ce09fa8696fb4f7221a7addf486acd3d4defdc9b5b4cb4e4f6a7313bd80684 kernel-devel-matched-6.12.0-211.18.1.el10_2.ppc64le.rpm 3c72fc5ead747c537792c1b1f414c8b2eda202f1a0d6ac68bcd43cfc20a90fb3 kernel-debug-devel-matched-6.12.0-211.18.1.el10_2.ppc64le.rpm 42fc55bf6771d3fce9525a6d674c2e7a253f6b1aa04c27ba65d001db80133f1a kernel-debug-devel-6.12.0-211.18.1.el10_2.ppc64le.rpm 84940e3bec7b25ba8e39ee72f28233869df6b9030a0cab93c677330384285075 perf-6.12.0-211.18.1.el10_2.ppc64le.rpm 9317b2e5cfeb61264fe43c13346365afad1b73d6747b74a5fafe004a5d37efc8 python3-perf-6.12.0-211.18.1.el10_2.ppc64le.rpm 9c32c8700cc6c8bb13281c74e9f0de0f59d2dee5195e33943d30b485b639a6c5 kernel-headers-6.12.0-211.18.1.el10_2.ppc64le.rpm a63fabdcb40eadd05d79fe62e4c5fadb6526c23589e0d8101495049ed2a262c6 rtla-6.12.0-211.18.1.el10_2.ppc64le.rpm bef2c137662ec5f52a0cb82cae06b98594b5079971030039daedfb39479e4d87 rv-6.12.0-211.18.1.el10_2.ppc64le.rpm d44177aae541cc478fe8e195884b7184651a6b17b413c1f9150bb6d81842c259 kernel-doc-6.12.0-211.18.1.el10_2.noarch.rpm d65ef7f528d990c65a6b7fb8ffc6e3ded25ceee509be5fa08d627d0c203045e9 ALSA-2026:21676 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cockpit-packagekit-356.2-1.el10_2.noarch.rpm 29bea62d6da80ffe7185c0a5c07130c9f8bdd8cf3db5e6956ab11f4675ba353b cockpit-storaged-356.2-1.el10_2.noarch.rpm db2a2a221c93a54b55c9d8c46acdea7e845e9d978c1572d583e9113742dd59f2 ALSA-2026:21754 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default netstandard-targeting-pack-2.1-9.0.117-1.el10_2.ppc64le.rpm 032b073ab9aa0782c7a9c7244da109b22acf1556342fd4985b24c2270252be42 aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.ppc64le.rpm 174e008f332abbfe1df947c5997a4a97d5fac99c2971bfa2e6390eb50a409de4 dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.ppc64le.rpm 19f9126915152819f258ea099c91d9f08cc2077ff52d82155a2567cc3153ddcc dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.ppc64le.rpm 2631fd2ae9b64c74cbfdb1665dd7bdc11e3bbfe469fab27211ad566deca38225 dotnet-runtime-9.0-9.0.16-1.el10_2.ppc64le.rpm 51ddbe2412db6094511936c9844c6e5324b8177c7069e074bb3078f60b7d76ad dotnet-templates-9.0-9.0.117-1.el10_2.ppc64le.rpm 9cf2b8c920bf23ea657a6ac8b3795454d5f21f3571509078911eb44c9768aa17 aspnetcore-runtime-9.0-9.0.16-1.el10_2.ppc64le.rpm c4b5b0a18d72f326cac7d893456c0c0566c0a9dd03e136a0cffafc3d426e0ab9 aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.ppc64le.rpm c95830382ed71a79ecb4940e3fc448e3c414c8e3c0588293b4345b5417529c2e dotnet-sdk-9.0-9.0.117-1.el10_2.ppc64le.rpm d5e19aef1d20221bfd5cb4e126b8fe499ae9edc5fe86d76824592edc49292960 dotnet-apphost-pack-9.0-9.0.16-1.el10_2.ppc64le.rpm da52aa011b6101e7bc68539e175b2a84e9d2d341a4018228dcf00b173e8f8603 dotnet-targeting-pack-9.0-9.0.16-1.el10_2.ppc64le.rpm ef82ef0c11735d0de19196e1ec4fb52d8573b05f71f9d08ea1d416505806a467 dotnet-hostfxr-9.0-9.0.16-1.el10_2.ppc64le.rpm fe3d181d3d79a9f41f59a1d51a02ccc12ffabe30b56ddecd97c9c77ae81077c4 ALSA-2026:21757 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm 22949ff4b832a5fbaf79d354cfc73af59a6746d662dcf4d0c294b24dcd69a9c7 flatpak-1.16.0-9.el10_2.1.ppc64le.rpm 57f2e34cc174f28edf4bee191b53740716ef5d70b73e90085258b2226953cfd4 flatpak-libs-1.16.0-9.el10_2.1.ppc64le.rpm 76672873c92cee5d9db4a3b67861b77559f6faa2ebb0f0331a39af2682e9d36b flatpak-session-helper-1.16.0-9.el10_2.1.ppc64le.rpm 9292ba48312745ae7940a94ef6f685e1aea408a6deb3044c8d31bdc1a581086d ALSA-2026:22141 Copyright 2026 AlmaLinux OS 0 1 Moderate

go-fdo-client and go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm 2f5a8bd1401f47c152f97edd4dcc2bcfe5b02e9edea564cd3f27e4152facb328 go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm 843e6a44fb5ab7ca974b5dc823978d86e2f4d3d2a91a9aef3292f97beafc75f3 go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm b1739b5cbc00a312407f39f5c8b72d26a9a88f099f93f00e1d68db826a024bb9 ALSA-2026:22145 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-runtime-10.0-10.0.8-1.el10_2.ppc64le.rpm 01df0038d0312ac07c3225895579d5ed23a31e53efd794e6346075797c368c6d dotnet-apphost-pack-10.0-10.0.8-1.el10_2.ppc64le.rpm 2b63230d92fa2bdaaa475b9862ca5346e7ae3578423842cb93d5c72a4a404a36 dotnet-targeting-pack-10.0-10.0.8-1.el10_2.ppc64le.rpm 30fc17a5a0b45fb6f2cd77cd6dfdd7266896f470940aa2465717014cd008f11b dotnet-hostfxr-10.0-10.0.8-1.el10_2.ppc64le.rpm 33c3a7ec495672715b2fdfa5e40104016b53e87b6e19cfd8f64fb610bf98293d aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.ppc64le.rpm 6f0a67796efc3c9cb0f0f15c57abdb2ca2372a4c7d2c1391d081a8d5b69218fc dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.ppc64le.rpm 8abc0f4cc749d28d960d662e28df1d270227b29838ed72ac3f9da470af69733d aspnetcore-runtime-10.0-10.0.8-1.el10_2.ppc64le.rpm 8deaf94eed1a44ccfb8006d08b1db9c88706d85e07a7354fda09db78bea12a42 dotnet-templates-10.0-10.0.108-1.el10_2.ppc64le.rpm 999561ecf276f3a12b5b7e97c5c7fab577020b9efb9706b027ebff02be287289 dotnet-host-10.0.8-1.el10_2.ppc64le.rpm a249db1564142ae20e603f1ec1ec509f0e7dd3335a5a2d4c07625d531e47625a dotnet-sdk-10.0-10.0.108-1.el10_2.ppc64le.rpm b7a9e5b7296e0bb569df9e79554b65443634d66ac1e810ecb7c905fb76355d7f dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.ppc64le.rpm cad689b89d1b76939d2e50a12c99e21e982ded678a46c4090e48d302908f52d4 aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.ppc64le.rpm ed975a875ea34db31baeedb4dfb869e8cb635ce0c9efe4c07f95fedec4a75b13 ALSA-2026:22314 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssl-devel-3.5.5-3.el10_2.alma.1.ppc64le.rpm d200196d94efb14763326abeedbdd928369efc14bc729713cc917503132480ed openssl-perl-3.5.5-3.el10_2.alma.1.ppc64le.rpm fcf50f12b70e172b1b2c0dc84ddb852b01701c752e683f6072ea857d33262e4e ALSA-2026:22325 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.11.0-1.el10_2.alma.1.ppc64le.rpm cf71536ff1eab56b20bf5be0d13e6967db8e2ee7e839665c76b90df0d30eb841 ALSA-2026:22528 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.ppc64le.rpm cc782e8df1f77d59b488d0b7e90960658780184f867c1630bd500b794cc6bb46 ALSA-2026:22529 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libexif-0.6.24-9.el10_2.1.ppc64le.rpm 6cbd1330c121908ca2d19a1140ac2e5cdb7b40a81d752f155de8631549eb2320 ALSA-2026:22649 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) * php: denial of service via DOMNode::C14N() (CVE-2026-7263) * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php8.4-opcache-8.4.21-1.el10_2.ppc64le.rpm 00e4c27369077ca654c62889ad8fa9b1d0ba7d4cabb30e6df6adcf37d2ca91ff php8.4-ldap-8.4.21-1.el10_2.ppc64le.rpm 0854b223a565c91aa8510179ce29729f8f6c8f55b4eb543d4e2f13f588b0c3ae php8.4-odbc-8.4.21-1.el10_2.ppc64le.rpm 0e15bd07943553c339ea95bf02f8718cb3c4e67cca44546ab613efcb92aeb55f php8.4-8.4.21-1.el10_2.ppc64le.rpm 23a67d3d42309219518a9f27d2afee3e83d1f093cd0d6a074600628c3b1a908a php8.4-gd-8.4.21-1.el10_2.ppc64le.rpm 2e41ca930a79688d6b71424e03f28aa9aef2fc34536843a14827e95e1a6c34c9 php8.4-dba-8.4.21-1.el10_2.ppc64le.rpm 4823632df4dd65c549d17d4ccdfe51571ac0d5e050afb6025011f51955646e0f php8.4-devel-8.4.21-1.el10_2.ppc64le.rpm 49b26f40c9bf31d58352dcfbc5340d462e71fa226dc8004cb3cee2c00aeadd66 php8.4-fpm-8.4.21-1.el10_2.ppc64le.rpm 5f067352782029b4505dc51ac64965b58a130bfd02c5926e92632be3d6bbf37a php8.4-embedded-8.4.21-1.el10_2.ppc64le.rpm 61816fcabfc3e7cb4bc6d0aa912dcd7ffe152b12c362adf0a607dd810491fb91 php8.4-intl-8.4.21-1.el10_2.ppc64le.rpm 649e7230a9ec93663832a12378f7ec0e4a69c708dd158a9218fdff86707c9be7 php8.4-mysqlnd-8.4.21-1.el10_2.ppc64le.rpm 77b00176d0695f1fa3c5fb36144f8692be9948dc0b29073952569337780ddc73 php8.4-process-8.4.21-1.el10_2.ppc64le.rpm 7a78398de0beced9626a24773cbb0b39960ed766f739c6595e8e7969ba90b23b php8.4-dbg-8.4.21-1.el10_2.ppc64le.rpm 8745281b0db6f66ebd4e846cadbc8820fee1013379706422ada2b6288488f6c7 php8.4-gmp-8.4.21-1.el10_2.ppc64le.rpm 995735c178f1e09bacd6ef0aca8763946a64cddf4eb9ac1682c9321122e8d56e php8.4-pdo-8.4.21-1.el10_2.ppc64le.rpm b0adeeccca747057edf52fed1e96e3eb0cd31af2873a14e09cdd8f2f58e7cc67 php8.4-ffi-8.4.21-1.el10_2.ppc64le.rpm b3a86f37443c8104478c366dc9996a7211f39d5b2770395f122dc8934501a3ae php8.4-snmp-8.4.21-1.el10_2.ppc64le.rpm ca44f7ea77dc33a4c4c8f55055ef8ef5a039ddf2605e5ad1b902cd57ec68130a php8.4-pgsql-8.4.21-1.el10_2.ppc64le.rpm cda8e638111208131b9eb214be5d9084c27159345fec81e5eeb7de7d6cef322f php8.4-bcmath-8.4.21-1.el10_2.ppc64le.rpm dd03635463e01b113afc1cdd079c0ac85ea1c2cad98c74e8d265a9b5082126c8 php8.4-mbstring-8.4.21-1.el10_2.ppc64le.rpm de25d3f845cdd8ce146915805e519bd7530a13ca682b149d9dfb2ce3ca7deabd php8.4-xml-8.4.21-1.el10_2.ppc64le.rpm de88f0364af6f93507902e760339c6184304b9b875b7d9f63620c15b6e437c87 php8.4-cli-8.4.21-1.el10_2.ppc64le.rpm e29be86eea9e952d352487a7bec3824ec43407ace865775b7965ac23fd63378a php8.4-common-8.4.21-1.el10_2.ppc64le.rpm f2655bed742c117fb0fa219fdf331be4e5cdd6608d1086e17bda09014a680a93 php8.4-enchant-8.4.21-1.el10_2.ppc64le.rpm f5e2d12ef77951269b63111decc1b5d2075d2225a686599fcf67b4539a55af9f php8.4-soap-8.4.21-1.el10_2.ppc64le.rpm f8742abb03292b6ff9f672a405b1e88fb45beed8f35b0393b0d1c35c67b0f4fc ALSA-2026:22711 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.3.ppc64le.rpm 2462696ae231c5686b024957b8c3bae446899e4053b6b0fead7431e62497e462 vim-X11-9.1.083-9.el10_2.3.ppc64le.rpm 266e2bcfad6eca1fb42e1eaf34deeb291ed3aab79c9af3a57a7a44410e387236 vim-common-9.1.083-9.el10_2.3.ppc64le.rpm 47b9e6ea605738a2708b68930f09c1b96b62a8426655378f8ddba1bc7e81951c xxd-9.1.083-9.el10_2.3.ppc64le.rpm d57b61c675f42c24fafe2475648edbda4c937d27deacfce542b1a1c52de83406 ALSA-2026:22715 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.1.ppc64le.rpm 16c19533fa9b54372fb1971a8bc839d6e33e41575d07639c745d1092fb22d11f ALSA-2026:22963 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default samba-gpupdate-4.23.5-109.el10_2.noarch.rpm 02ab33c4186fb468d4de6cffac56cd285836279fe4e2d03245fef1dcf26dd611 samba-krb5-printing-4.23.5-109.el10_2.ppc64le.rpm 3dd7ebee68e8674aedec8c4deaedc3434b83f2a40cfae6ccc22bd8db66c7aea9 samba-winbind-clients-4.23.5-109.el10_2.ppc64le.rpm 667ada636f315c868b6e14b3a9992a87c7036c5b13c90cd1c2293ec7aa9bfe6d samba-vfs-iouring-4.23.5-109.el10_2.ppc64le.rpm a664d3400645a7df926955137b0abaa90ef6fabdc1cc2afcac89e168e798c25a samba-client-4.23.5-109.el10_2.ppc64le.rpm ab8041bc7bc1ca5dcc30f5134ac6c2e520033f78a561696166107034298156a6 samba-winbind-krb5-locator-4.23.5-109.el10_2.ppc64le.rpm def5abc102840759e0cb8c909513375147af63b552188447b0acbc1edc134efa ALSA-2026:23102 Copyright 2026 AlmaLinux OS 0 1 Important

delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default delve-1.26.1-2.el10_2.ppc64le.rpm 1fa1038376e0038a1096b43b3b56c9e2340fe35eeefb955e6c19668d02549dbb ALSA-2026:23231 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default unbound-1.24.2-7.el10_2.1.ppc64le.rpm 079d4cc5c8bf5ca10040bcf8f69a4dc12bac9639099d3362979a6a8dffa9990a unbound-anchor-1.24.2-7.el10_2.1.ppc64le.rpm 2d8eb701d59b99a9fcf0fbe89214c1f45e97e9af09196390442ea0e14ccf7ab7 unbound-dracut-1.24.2-7.el10_2.1.ppc64le.rpm 384cfa63d6a5ad3f9929d4d1f342df0360931239f3569b3ad623580b5f14a0ac unbound-utils-1.24.2-7.el10_2.1.ppc64le.rpm 3ccce960b10ea22715d0d091bd850209b15e2118993b6df444585eac187d45a6 python3-unbound-1.24.2-7.el10_2.1.ppc64le.rpm 8a435f7d8e80aac6dc893eb8329b6d4481e605bf8b3a90f516ae1b297d922d7b unbound-libs-1.24.2-7.el10_2.1.ppc64le.rpm f48577474cf0b098b3c478e1e1d0ed2ae908c19a62180e8d3871b89c8019e49f ALSA-2026:23329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perf-6.12.0-211.20.1.el10_2.ppc64le.rpm 0198c2186e1a9b7e24af759a65194c0bcea7e02a22944581b7e98fd3c18eeca8 rtla-6.12.0-211.20.1.el10_2.ppc64le.rpm 164084bb02125f66363571d720e77bbc4777041f3f3098396a1eaa16d39911a7 kernel-devel-matched-6.12.0-211.20.1.el10_2.ppc64le.rpm 283dff24a856a4c963fafa46e171b6155620c47dc9d6912e2ca16c2cec650166 python3-perf-6.12.0-211.20.1.el10_2.ppc64le.rpm 4f97e74b87accac8f97af9810409b8a2b409d9300ecd49a4111dab18f8e11b86 kernel-debug-devel-6.12.0-211.20.1.el10_2.ppc64le.rpm 52190b48e9e04a7729714bbc3319020e6aa33d02039c7b53cc2642272041715b kernel-debug-devel-matched-6.12.0-211.20.1.el10_2.ppc64le.rpm 58ae25a99489e14168038800e5c445b6318d57a8dc794acfd88c3cbbe3ba3d7e kernel-doc-6.12.0-211.20.1.el10_2.noarch.rpm a836026e76d4d01a4cd956f4ff3470e96d192b18c9b27f6d4d5b5e46c6aa8694 kernel-headers-6.12.0-211.20.1.el10_2.ppc64le.rpm b39f749d72643a616dceb73abd5c3c4386ec3385719dc6c68bf2e20d26465063 kernel-devel-6.12.0-211.20.1.el10_2.ppc64le.rpm bb2c3a0c722d272deead42255611f221243f0049111f440fc36f7d76f9b7af76 rv-6.12.0-211.20.1.el10_2.ppc64le.rpm bbb4c70cdaf86d32a1f65a6ebf3f9d5a957ef3aaa8e0b4fbb1025661fdbdbe16 ALSA-2026:23388 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php-enchant-8.3.31-1.el10_2.ppc64le.rpm 0092272e9cb56a22858b187728c47bf887e2b2171b858bdf60e5d98f25c632ef php-odbc-8.3.31-1.el10_2.ppc64le.rpm 0951c0fc0353686c1efb5728c56d3f3d94c95d8cd07493a7c6f587bf3fac941e php-cli-8.3.31-1.el10_2.ppc64le.rpm 1e2ab806de8899b17509c919cea5135f3a56f17bd4ae38b188ded45f90c786a9 php-mbstring-8.3.31-1.el10_2.ppc64le.rpm 1eb62a753fdc440a97907c7a3a72e075f21026205a793d9c93a6b2e74055ca46 php-mysqlnd-8.3.31-1.el10_2.ppc64le.rpm 34bed8d72c5f8d0950603feaa97a859354401b80a921e5e738283434fcf3e6f6 php-opcache-8.3.31-1.el10_2.ppc64le.rpm 35d14483d4dc4b06903facbc6c8503a0cc6d1bf46965f9a9e4edbf644f2d152c php-process-8.3.31-1.el10_2.ppc64le.rpm 504d22b93662988c1c42d165483cb60dd3f590cd84a2ecc872259153c2e2f602 php-8.3.31-1.el10_2.ppc64le.rpm 69dc3fcf98dfe290ee1f0a93c14a81fd5e80537f341ec715292245fc2edc94a1 php-fpm-8.3.31-1.el10_2.ppc64le.rpm 6a234f601fb77632bde85e640c25431d63f36acdb61edfad2b3ba5fe43164fec php-bcmath-8.3.31-1.el10_2.ppc64le.rpm 6f835f350bc58401164064e5e2595ffb9b09510103c4d14c551b004a609c6796 php-intl-8.3.31-1.el10_2.ppc64le.rpm 6fa62c573302cd7a2518ecf60356d63f8c6c287c9f14a00df3fd9c6927ed7008 php-gd-8.3.31-1.el10_2.ppc64le.rpm 729e58ec8b48713ffc0ba613b209db8ff510100290f5707b6c52afe5f554bbb5 php-snmp-8.3.31-1.el10_2.ppc64le.rpm 756c20f6f64f067793f9647da2f60cdb6688f7768ad27e2b7f08f9133b11c02c php-xml-8.3.31-1.el10_2.ppc64le.rpm 86cccef65ee172a2c08bc8bf639296c39adca4da2facc836b680a2af75ad1fe2 php-ffi-8.3.31-1.el10_2.ppc64le.rpm 8940f0cb085a46cd75e9308e8dd371f6f44630c3a1e0beaaa3a390ccd64e5576 php-soap-8.3.31-1.el10_2.ppc64le.rpm 8bf7912bcc1700fbf2442d4c9e52a5b5d006ea0426ecb2c5c1eb161520725359 php-dbg-8.3.31-1.el10_2.ppc64le.rpm 8e5ccad9e6d992ec4e7f81bd7801e925eae9be793d4d94bce6226710d8120f5f php-devel-8.3.31-1.el10_2.ppc64le.rpm 94fa4e99fb6008569f48c51417443f3de65cd1fc06fc1b67b18502c2e353275a php-embedded-8.3.31-1.el10_2.ppc64le.rpm 99ace55da0d1fd3833c241bf9f69ed39848f2a1038371ff1baba1648becb8981 php-pgsql-8.3.31-1.el10_2.ppc64le.rpm bcb7b3098d38f08485dd5eb89db5de650ba09b87f16c1ee10dc61e0dce8159d6 php-pdo-8.3.31-1.el10_2.ppc64le.rpm cd10dff4b435fafe2f84ca6b6aeb358b186e12d2e965522a0bd7199ecc924299 php-common-8.3.31-1.el10_2.ppc64le.rpm d45e439f7910c1d58e2da947997552d04c2cd638c78564e107ec9f162a0b052d php-gmp-8.3.31-1.el10_2.ppc64le.rpm d555a40a58e29a7322d5c793c51af88a7822e1acff1ed8302c0cede678f47d92 php-dba-8.3.31-1.el10_2.ppc64le.rpm e3971b5b103a45799b4f06c09e20c7defac9c9188f0a9d9fcc16ab9bd386bfda php-ldap-8.3.31-1.el10_2.ppc64le.rpm f459f67f053f80793546bb0f8780806370842fea3d2e544ea6d3a92a67731a6a ALSA-2026:24338 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default bind-libs-9.18.33-15.el10_2.2.ppc64le.rpm 14732d59da681c1f942347dae901707dbdd2f8a82182f4007d44b5c7d31ddfa1 bind-license-9.18.33-15.el10_2.2.noarch.rpm 25696570fcae21d95d2b7b7d02efd735482defa1142c62286c36eabb4f6c2997 bind-9.18.33-15.el10_2.2.ppc64le.rpm 30a59dba6531f6cbed298254d28e7a4b776c35453906f50b2f5146d51fb201d5 bind-chroot-9.18.33-15.el10_2.2.ppc64le.rpm 5c863a19acab6ef54f90173179f417fe848d6f3927830454a7bd7b8be099b4b6 bind-utils-9.18.33-15.el10_2.2.ppc64le.rpm 8c187d534ec5d51151ea30c23b43928d78760f672bfa11890145d2c53b30a666 bind-dnssec-utils-9.18.33-15.el10_2.2.ppc64le.rpm 9874c74d9550408bf18f8af2cbbea5838eb1ba5c60460e8cdb8df7b65cb5a2ba ALSA-2026:24347 Copyright 2026 AlmaLinux OS 0 1 Important

frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default frr-10.4.4-1.el10_2.ppc64le.rpm 22b4c2be070dc364181191375b5f3a5b78f4b499e66eab4a78253c6685ef481f frr-selinux-10.4.4-1.el10_2.noarch.rpm e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c ALSA-2026:24348 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm 12ad5a0377cc543161f693dbedf80444ce6430610d3c37c638d24895a91baf32 ALSA-2026:24470 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default podman-5.8.2-3.el10_2.alma.1.ppc64le.rpm 1a2f66da10dbd7c11dbcd02a137e737fadd40bbee49a6340dcb54d87c267eb72 podman-remote-5.8.2-3.el10_2.alma.1.ppc64le.rpm 9bdc14a2915c6d4858e43a58cf4d9b4998715339148e69effed275e38069c4d3 podman-docker-5.8.2-3.el10_2.alma.1.noarch.rpm e205f2f26c5534f264de80514cb994d72b05f6a8fdd0b52239e7998ed355f6cd ALSA-2026:24758 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libyang-2.1.148-4.el10_2.ppc64le.rpm cc90433f0281ca424b0456e71e99e3fb7eae79e96f04168e99cfcdc7203a2b7f ALSA-2026:24985 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default poppler-cpp-24.02.0-7.el10_2.2.ppc64le.rpm 1f588d5e6f9bbcba4620c9bcd6f3940fbbb52b0c48a518251de8536a897344a2 poppler-glib-24.02.0-7.el10_2.2.ppc64le.rpm 377477757edb1874158ee7f63973f239477c94a142fd9e41fbcd46db010d819e poppler-utils-24.02.0-7.el10_2.2.ppc64le.rpm bc99a9cffcc66e51d5d773a8a4f78e0b8c7bf78ed253f9f07f218cb5e95fd7b9 poppler-qt6-24.02.0-7.el10_2.2.ppc64le.rpm bcd05a550804cbc958760924c06d97992f74612992da7ace910a9e5afbbef6ff poppler-24.02.0-7.el10_2.2.ppc64le.rpm e1590f54209eab1630a5ebb5e709421de9b8feedc9017232312ab534d70bcf69 ALSA-2026:25111 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.ppc64le.rpm 04f7309c0fe84862a57b67d04b30e25fb4c024d6d2fdb6556c730fa5337af8e8 dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.ppc64le.rpm 3adc7f8cd5500e23b936ee03a3682de1e76a78dcf414b5ad650d02273ee8c1c4 dotnet-apphost-pack-8.0-8.0.28-1.el10_2.ppc64le.rpm 4c19749942bdd58a977cb1dfdd1f84ee39eddf7202f3b382368faeb52f467d8b dotnet-sdk-8.0-8.0.128-1.el10_2.ppc64le.rpm 5dd483cfd5509727924026655140d6515c405637c55c2a5a67522dc92399919c dotnet-hostfxr-8.0-8.0.28-1.el10_2.ppc64le.rpm 79d224988e757dd8f79dd532ba13d0c042dd23d9c8e103fd25bc52d1a77aad61 dotnet-runtime-8.0-8.0.28-1.el10_2.ppc64le.rpm bb82483066c5e7a3fdfc6e2a0f4d24a3dca17ae43a36b42774c27c61dfae45ab dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.ppc64le.rpm cba53a189d075bc6ab824fb221055231c05e4aff1cba8b2e5daaa4ac4b00d0f3 dotnet-targeting-pack-8.0-8.0.28-1.el10_2.ppc64le.rpm e40276e45924d88988f7fa32c60a6237855a5ace4f0bdc62cab385e14c6c7d02 aspnetcore-runtime-8.0-8.0.28-1.el10_2.ppc64le.rpm e56c4de58f7d00950dc85aa751e66a4c0c3db7d6cde09c330d59d0e9b14b739b dotnet-templates-8.0-8.0.128-1.el10_2.ppc64le.rpm ecc00cf95c4fffa6dfa7331d6d8ac847d2ec82379b7c5acb6a44ea8083dd3dbc aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.ppc64le.rpm f3faa790c138890b7b7105e2900613dd728a86c2a54c86a2bdd62302fcd155bf ALSA-2026:25112 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.ppc64le.rpm 0b0e9147f07f113f6284add08982fa319096110672f2d360a3968c921ba9730d dotnet-apphost-pack-9.0-9.0.17-1.el10_2.ppc64le.rpm 11136ce9c31960b413f39c4fbd7809ea6fe2bc407d1b8b172cfc697388f6cc96 dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.ppc64le.rpm 2915470cde3dc4a6158e1cdb00b8dfafe65874b7837c140bbf4c9657e664cfc5 dotnet-runtime-9.0-9.0.17-1.el10_2.ppc64le.rpm 338bb3fbccbdaf3ce7a6309e0ad11ea1ae0fc8c2fa28f7aa8b9eb3b8029549d3 netstandard-targeting-pack-2.1-9.0.118-1.el10_2.ppc64le.rpm 66d75049a5d8597b346b1698e6bd5eb91b6db693a90a08842f92b8157fd27184 aspnetcore-runtime-9.0-9.0.17-1.el10_2.ppc64le.rpm 6d442267287324a7617a2e621a71261e44e01811b6700144cbc05c3040dd65ec dotnet-hostfxr-9.0-9.0.17-1.el10_2.ppc64le.rpm 7f129f3e2dce62fd2aee45f7342dfe162d90bea63b3e4f838fbae3aa0e24ff5e dotnet-templates-9.0-9.0.118-1.el10_2.ppc64le.rpm 8d31fc07cc2fa99890c58629798fbfeea0da79d01a99bd937168434f8b9dc94b dotnet-sdk-9.0-9.0.118-1.el10_2.ppc64le.rpm 95af5ffb535b5ba73c7871e3dbfb467ef8664f977fdb25eaf3124e4839af6b1d aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.ppc64le.rpm ae59fdaaff6fbeb371e147f69d21512e146153de8e8db161544f05d9f5790933 aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.ppc64le.rpm f4615007bde963b179e8dc4bc496699172e64510efb9173d10da62ccab621abf dotnet-targeting-pack-9.0-9.0.17-1.el10_2.ppc64le.rpm ffd107b43a50350e44060c0d032fedaf3e63f9329f577d6d9ad8a4876167676c ALSA-2026:25115 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.ppc64le.rpm 124fc7bb95b6be41877a2c39d7f821c5aaadfab2735dca57dd75bdcd372380b3 dotnet-host-10.0.9-1.el10_2.ppc64le.rpm 255cda9619cd28c639bf16566a4d859c8a45d9ee20e6a8ce345cd6fc7aa685b8 dotnet-hostfxr-10.0-10.0.9-1.el10_2.ppc64le.rpm 370130a264b81b1411a69375b35f138b4894c4728c6c1639db1e2144135a0e4b dotnet-targeting-pack-10.0-10.0.9-1.el10_2.ppc64le.rpm 396fc654533e64d1d20cdd9689049ed8c9b12d1cc18868cb53e91be3b3674d12 aspnetcore-runtime-10.0-10.0.9-1.el10_2.ppc64le.rpm 5e0c865259752a6ebaa1d993c773a97815aeeefac5c2959b91b800f2bd9906c0 aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.ppc64le.rpm 8f75ad82d2acf7421eb8d18135cbad42049af8a72c8f3779a658778f852220e4 aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.ppc64le.rpm b0ef682d0da5643a37ac61552c7e06b60986e4bfd63c7ff4defd3bf22764d332 dotnet-templates-10.0-10.0.109-1.el10_2.ppc64le.rpm b164745ff65124418f639cdc15039cd00e264227445544c127032a271bfcefe4 dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.ppc64le.rpm bd72dd69c269ff9af993a2af4d8e95f3d4863f9b968f362717b75431bacb0308 dotnet-apphost-pack-10.0-10.0.9-1.el10_2.ppc64le.rpm ec16ab9f0aeb149ff9da0ce330c2aa6df177c404ae5ad3f64df3c9e56fec72a4 dotnet-sdk-10.0-10.0.109-1.el10_2.ppc64le.rpm ee37e942fa90222defdf4da1142797935eb89b4489996ba5c477db28f0ee6b03 dotnet-runtime-10.0-10.0.9-1.el10_2.ppc64le.rpm f3467b078813786f5b6243e1ed6f5f40f303c498291b0ff12f1876db951b8ff6 ALSA-2026:25191 Copyright 2026 AlmaLinux OS 0 1 Critical

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rv-6.12.0-211.22.1.el10_2.ppc64le.rpm 12376b68b2aea63eb9366431d9ae40ab51e044b5c8dbd251acb7848a3569df21 kernel-doc-6.12.0-211.22.1.el10_2.noarch.rpm 1cb3d93030aca010c6182c61bd262ffa6d526fb1b80f5cac5d3a4e0ddfd0923a perf-6.12.0-211.22.1.el10_2.ppc64le.rpm 68546845e7c4d51f809c5c392d98fc6a2fa99e59cbb1e1fc4919b1c1177f5563 kernel-devel-matched-6.12.0-211.22.1.el10_2.ppc64le.rpm 81846c66bfa800070172c61a6d3b3a3bd381ca4adf8bd917c93c90ffe22926ce kernel-debug-devel-6.12.0-211.22.1.el10_2.ppc64le.rpm 8af0a740a0c095ee1c9f8a74efd78ac3104174f2c185f9b8f4acaad0c379cf9d kernel-devel-6.12.0-211.22.1.el10_2.ppc64le.rpm 8c5847f51f02a0e2babc72a4cfdcc54ce1e084b0841f0c85e6b760cd46fb8d62 kernel-debug-devel-matched-6.12.0-211.22.1.el10_2.ppc64le.rpm aa2d25f6d780327cd6c47360101e790ef3a1341246ac115dacf18d77042c8cd0 rtla-6.12.0-211.22.1.el10_2.ppc64le.rpm ad6bb045589341397d75b52b23b5ea50372363961edf6befe715a93e8fdaa908 kernel-headers-6.12.0-211.22.1.el10_2.ppc64le.rpm b7497bed295f0ddd36902b1d2b994586f4bbb9ba32b505941678d805a06677fb python3-perf-6.12.0-211.22.1.el10_2.ppc64le.rpm d3104f7d16e983c7825b791a81d3fa268d78b830af3cc0267ab32c96ccfe1d9b ALSA-2026:25216 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479) * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631) * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default valkey-devel-8.0.9-1.el10_2.ppc64le.rpm a8b95d6226ca89f443adc40f97fba28e6800f4bb1cc53b2cc59306eb258aff3a valkey-8.0.9-1.el10_2.ppc64le.rpm d9d01abfea281acf7ef7a5af2505230b924db6d74e8ace9b87cf1566ae9675ed ALSA-2026:25225 Copyright 2026 AlmaLinux OS 0 1 Important

mod_http2 security update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.1.ppc64le.rpm 27508aea561b0cba58193f0d3d7d6bda6fb9fc4eaa4b56f79be2f59305db074e ALSA-2026:25237 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383) * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076) * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180) * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764) * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766) * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767) * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768) * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769) * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssl-perl-3.5.5-4.el10_2.alma.1.ppc64le.rpm 13bbef4fd147698e295358e9794e926f76d0a7e9b8b12d0105bf6c532f97bb8d openssl-devel-3.5.5-4.el10_2.alma.1.ppc64le.rpm 503447e0273460b4e40e78bc253041366a136a1393b2cb54f7f2a1b71c6e03af ALSA-2026:25341 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 update

Certificate revocation bypass due to improper OCSP response validation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 ALSA-2026:25902 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default fence-agents-openstack-4.16.0-21.el10_2.2.ppc64le.rpm 076328ca856ab70d34bfcd9bbbef000af13b47dacdaf74962a7ded560ca7fef8 fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm 09ff1477d7c24e095b83789574d84696975330f2d0de542d54792c26e7974c16 fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm 12c9076e50ad52eac0fa9c9653ce73fa79643aee1f969bc507af2d7ff138569a fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm 298e8d7a3cc1d82a186ff6a6892e4568c0979e88cd2baebaf8d23a9e24fea0a9 fence-agents-redfish-4.16.0-21.el10_2.2.ppc64le.rpm 39e54b0fd412d260fcba4cb41e2ead63121251c363748ab81ebed70993e5f823 fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm 3e29269bd4baea6327c3f106e567ba79252914196c7d9d6de1691b9b887f5016 fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm 3eae36839b0c37587393fedd0a94d391c7c1b32d4e0038aeb872ce77dcbeac65 fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm 3fd2c64de218b8f14a264b6d4c513527490c25f44ac7974c6ef31fb84798dd4c fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm 50471bc1d7292ee0054f58620f7119f9f2224ef4260b8a953fba66633ec4adc0 fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm 526fcda8f27eca140ad19bc1b50f05fde1e332027a94e23cb2595e6544c91903 fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm 5f0c4629ad31c1b9bd98c26300a2555a858e7da9be98323d3705bb2a17d23d33 fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm 600b0a86968f0aaae3296c8da0b70e18f2cc7836e9b007c314dafa38da84a8be fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm 614315d7378c63e0844826317ca53254844a3938c32f3665bf1df10dacb31d62 fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm 6731b497ac7785ff2dfa81e440a312e85ac8e725199bb261a3290e15f4a3d6d5 fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm 6ce383af0646539baeb184e2641a29ae6df028240286e91f57c016285057771a fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm 8368915fb9a5f0e382da7f974a5e4bad3c7a34142bd9ce52c57c100697a5e366 fence-agents-kdump-4.16.0-21.el10_2.2.ppc64le.rpm 8ae8a1060be14eb96fed1a23a39fde892c3963b3042402b719f3984f5fb8faaa fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm 90c5f69dbd53eaddbb46b7de1584000376afcb442f82782208b63a07ddfc9bdf fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm 970f4b76795e517102ff1e870b5e2a7be172ef477fd8821eb3e190b99f0af539 fence-agents-kubevirt-4.16.0-21.el10_2.2.ppc64le.rpm a0a53428214ed652679446f0c6af88fc8fc1fa9aa8697ad1edb8caa5dbe14b94 fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm a12bb2e9542b76485ce1221906f35e37ff7d6a8f2a241d21f6547347683b5a4a fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm a236afaca18d09d042be0d498c52c254bca90aa39d7048b9c3d72fbe2a966a76 fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm a2bd565e1af480ce00436ca7608818bf704d05480762acfa13b190ec1005bfcf fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm ab44451f3d94da168a7e3b360f7b9aedaa9e42107bdc97e68befbf4d4ee759d3 fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm b2ccee8dd645e52151c781abd778eb861ab3d54b5f99a252ce703f56bd144800 fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm bab15153adfef696f0496913ac9161a048bd71b538b1691aa0bf3c8d8ada5590 fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm bb0c8a0011dacba56e4874d5634add35a6f754e354513e4b6cd736bfa70e0cf8 fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm bce9f617920cf266311a3e70eabdf9efc748e71a34550fc398f1d09a1f866c3c fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm c1311ad03e9d6aaecf221246f0a33f34e04186c91c4f94936a73ce91f0b8db62 fence-agents-all-4.16.0-21.el10_2.2.ppc64le.rpm cd6fc3cc73c004575afc19c334b7e20cef70bde85870194a90f391b6cec1a8a0 fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm cf3c3cd8d2407a4b215021e252553d437c3251f3f621c8600b1df2d2bf4c1be4 fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm d1087cec15bbee8464f580cd85448b7b671ec9b6b50e7f414c01cebf25a27af6 fence-agents-common-4.16.0-21.el10_2.2.ppc64le.rpm d1aae88432ad17f22ab1d31edcbc43270f13d0890528f27fc9c13b2757011fc6 fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm d4442641c3bdb9695e3303315183f9df36ea59d0979749e0fa73a2dc062a307c fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm d4ea6c9d27d6b72c2ec4588d5b86ece102a2e5b5189970f0da144bdea249084d fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm db55586c824957f510c58c45bb2f1e13b97c5a8e23cec28841a2fde724ad0cd5 fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm e115cb7a9584a1268df698f1c2808d858f01ae1dcaa9502ab776538cc16b7458 fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm e50d48d8913ec8dddde456634ae7d0fe1110e61c50c0b31dc281bfc30173a4bb fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm e5953455691ce0520db86e36d4a0520df1aa88bd8345553743a6c5d9eab94360 fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm f2c5425b489f9273f19850815a2fd2af26422f93e9111fa72c09114aa8974593 fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm f65d2ca2ae09bc957279acfab3819afa89a6b4fad45c221655d3f53ba90126d5 fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm f86bf5b2eee3fe4a01366a531f4012957b6b7a9030f7c02c9ebae1fda6d2874f ALSA-2026:25930 Copyright 2026 AlmaLinux OS 0 1 Important

postfix security update

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postfix-cdb-3.8.5-10.el10_2.ppc64le.rpm 204a27611649892bf32d7d6477f38233cdd9111d32b60743e654f893fb481092 postfix-mysql-3.8.5-10.el10_2.ppc64le.rpm 35a41c6a26f4b33c9b78a84ee022640cbc8a36af231034d616d261494c54b921 postfix-sqlite-3.8.5-10.el10_2.ppc64le.rpm 4669221222a7817d1c3a5a7ff223d6600c3eb0029362387b1167542224a890b4 postfix-pgsql-3.8.5-10.el10_2.ppc64le.rpm 500e0205205dfa36fa451404f3e3e82314b6dce5d78a3cca5c2dd47fe5ee6757 postfix-pcre-3.8.5-10.el10_2.ppc64le.rpm aa804c5c57c0dde57180b8447ee0bc03409a212fec34d68ac0a1e3f8238e0ef3 postfix-ldap-3.8.5-10.el10_2.ppc64le.rpm ba4669dd35a8326fb5e84a7d19d71fbec0ef19b51735496a92446663330e03fb postfix-lmdb-3.8.5-10.el10_2.ppc64le.rpm c63e777e69bea2b4ecb31a307ca75aa829bc816b5f1d5ac3db0cf0ffc04597f8 postfix-3.8.5-10.el10_2.ppc64le.rpm cdc6a45e9134cf9f08a10c9240cf60a499d0adc3a767cf96aa7bc9a9caa9b18b postfix-perl-scripts-3.8.5-10.el10_2.ppc64le.rpm d542f75ae4bf638de543f2344c6ce3fba625f38bcfaab6572d9cb84ed0419762 ALSA-2026:25999 Copyright 2026 AlmaLinux OS 0 1 Moderate

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.ppc64le.rpm 945929956659aaf2ee4d3d435fc9b8cd269a8469c4c6a8061c72e52cbd514640 ALSA-2026:26332 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618) * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsync-rrsync-3.4.4-1.el10_2.noarch.rpm 540a428308cad863c69c33ed960b0bc940301aa9b2b59258a14f1fc3273c97b0 rsync-daemon-3.4.4-1.el10_2.noarch.rpm c41feb2a21f43ce9aa84fc833bcabb0d96f6b707a7ee6ccbb51ade3b02c7e18a ALSA-2026:26532 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dracut-caps-107-7.el10_2.ppc64le.rpm 1e3d1b4b7951660b9e97bbee7ca3d2e2ce365b6a94cacf518099722e3cffcf6f dracut-live-107-7.el10_2.ppc64le.rpm 85f3bdfb5a01862ded731c826b7be55a9d4b33f69274a5fadbcb307a594d7236 ALSA-2026:26566 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-10.2.z] (JIRA:AlmaLinux-184290) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.ppc64le.rpm 26b1556ea54da69841540152cd6b2abd06eb1c8efbd6e02ea7608d5755d8caad ALSA-2026:27288 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047) * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495) * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127) * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319) * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-doc-6.12.0-211.26.1.el10_2.noarch.rpm 11db01dd6e6ddd890f4d22adb09a488c7d4dc0295f2128ecd209e94fadbced54 kernel-devel-matched-6.12.0-211.26.1.el10_2.ppc64le.rpm 1850bcd21f68843e2d8bcf6acd452964f7d53c1407b97d47b0cd9b1db279b48b perf-6.12.0-211.26.1.el10_2.ppc64le.rpm 2e1ed7aab9a9cd03f2851e0c8f56ef692006893ab5c14d95822662d51d220972 kernel-headers-6.12.0-211.26.1.el10_2.ppc64le.rpm 49aa8d22a9fc79ab09995758145298a6476d0fd637acceefb4ed7832fce9451d python3-perf-6.12.0-211.26.1.el10_2.ppc64le.rpm 631ee846da8187e5d345c93c652e33a88644050e93e38a4b6325bf1faa11017a kernel-debug-devel-6.12.0-211.26.1.el10_2.ppc64le.rpm 9ff56d097fdd75a7c55901f6df09a729c128cfe55537f0b7b30316318e866591 rtla-6.12.0-211.26.1.el10_2.ppc64le.rpm a59e0cb7a21d9463f21f74845dd71c95146600131315bf430df392774fbee1bc rv-6.12.0-211.26.1.el10_2.ppc64le.rpm b169be8d41e87730f8948a6382e6d393252c0674bef39b775c1d9471da03f497 kernel-devel-6.12.0-211.26.1.el10_2.ppc64le.rpm c52b2276058cd277012fbdd5c48d6b359b8c18f1cb09431d502a8b6fa0db4b28 kernel-debug-devel-matched-6.12.0-211.26.1.el10_2.ppc64le.rpm fa5467711fb6ec87b6ca3a1a658746fb46376ae1dc75e8b9a6f9b5a34d5b9bf8 ALSA-2026:27733 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.12.0-1.el10_2.ppc64le.rpm e9513ebb99c500b40250e5b28fedf32d522206c25146b8ba11209678a4d72c8d ALSA-2026:27742 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql18-18.4-1.el10_2.ppc64le.rpm 1bba71dabe470f2f466056a38cfe9eeb803c26c77e96ef7df1a44a69cb71a1ea postgresql18-private-devel-18.4-1.el10_2.ppc64le.rpm 26d570bed00baae739e07f1b9ddf7750bf2b63cf60a9b255073ef67fc7ebe068 postgresql18-server-devel-18.4-1.el10_2.ppc64le.rpm 2f212f383d2c9e33459767af518ec91b172bf4d43de32d2252867db6b03c248d postgresql18-static-18.4-1.el10_2.ppc64le.rpm 38810cc7713ac7126142f64c12969915576b48e95411e5ac885daa014cbaefc6 postgresql18-docs-18.4-1.el10_2.ppc64le.rpm 462599e24e8ea70b04992afe8fee64d395ce51b3057d558ef472799440bee318 postgresql18-upgrade-devel-18.4-1.el10_2.ppc64le.rpm 53a474b2ac2af4968694dee57889689ca5b03557d4f5889d2b38688d60b979be postgresql18-upgrade-18.4-1.el10_2.ppc64le.rpm 5fd016a52ff389880610e07ddab0aacdaf6db85ba92aa5892ef8cb4c9bbebcf5 postgresql18-plperl-18.4-1.el10_2.ppc64le.rpm acd25a5e4974a73aff1a1c844218c233f68b052bcc93e8ecfdc876474ad1d8a1 postgresql18-contrib-18.4-1.el10_2.ppc64le.rpm afca75348d2786485f0fe69b4263549a17d18a73a4e996472c4226cd2fceff5a postgresql18-server-18.4-1.el10_2.ppc64le.rpm b236e84647821e2f38b28d1d6701197f0d4821d9efd809a63bf4ffc8482039c3 postgresql18-private-libs-18.4-1.el10_2.ppc64le.rpm b54c4452659aeb76194a9f8db63c7381852e0859ab36ae7ff8741db2ae699b97 postgresql18-plpython3-18.4-1.el10_2.ppc64le.rpm bac69ab3d9da4a3d56b4c3f246b6c84cf53f5120892fd55a9f3c0775b74016b7 postgresql18-test-18.4-1.el10_2.ppc64le.rpm fd3d1cdecd772339968a25ac0888c80eb5137f7994fff64dcff003a9df44ba34 ALSA-2026:27743 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql-plpython3-16.14-1.el10_2.ppc64le.rpm 55470222b9be5875f61ac270ff1c3458aad71494667756152a9674d9945e4035 postgresql-test-16.14-1.el10_2.ppc64le.rpm 6439d589a6c044df927b7b4dccac3fbb7842a913847b109904e730668b4e2e9e postgresql-server-16.14-1.el10_2.ppc64le.rpm 6793f111ea6312cb3758d1ce26fb0f7e0d5ac7a8a0471e551b10f4618af59c62 postgresql-pltcl-16.14-1.el10_2.ppc64le.rpm 7b373ec757196d1bdc023c10a329befbff74ef3bfde5a1c789b682a28617885d postgresql-plperl-16.14-1.el10_2.ppc64le.rpm 89fdba10c772440d9461314a9d18fa1275dd5b78cbef6408bcc19da735b19d9d postgresql-static-16.14-1.el10_2.ppc64le.rpm 8b6a28b014308d0789664858e8155e17b59d844ad552e735f0f25d2967ff5c1e postgresql-contrib-16.14-1.el10_2.ppc64le.rpm 8e474e02e48ccdb347c831aebf55b144a40b578d66046057893ea9be20c35cdc postgresql-16.14-1.el10_2.ppc64le.rpm a3c5f270d01cb2b1834a8e390619810e6e9adb773403836f78bed80daa3b4946 postgresql-upgrade-16.14-1.el10_2.ppc64le.rpm b8e59bca805cee0868e6875152068f2271b10d556c6a40827fec28c30660cc4c postgresql-private-libs-16.14-1.el10_2.ppc64le.rpm cd3b94549d8ba1d79e6e7b66922a6405cd375bed23fb75f6b882145d8bc90a69 postgresql-upgrade-devel-16.14-1.el10_2.ppc64le.rpm dac02ea0f365e8f981aebd29c9d04082e95789cf5c250809ce9395de236f4935 postgresql-server-devel-16.14-1.el10_2.ppc64le.rpm dbe39296dd6c26dcd984a1ad181b6d6109d2b0d4b55ad826ad0c62242a52275a postgresql-docs-16.14-1.el10_2.ppc64le.rpm e551feeb847754040f886f215dc9286e288aa0c0be12b47c190328f3cae8d221 postgresql-private-devel-16.14-1.el10_2.ppc64le.rpm feb09e271ec54f6d341265adce79578eefa627f86714d9d85e82aa30d21ef792 ALSA-2026:27842 Copyright 2026 AlmaLinux OS 0 1 Important

memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. Security Fix(es): * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default memcached-selinux-1.6.23-7.el10_2.1.ppc64le.rpm f610ebec6bf676aed0d26adc250a5a58149568fb8ffef44c2ff1592df3a6f6e2 memcached-1.6.23-7.el10_2.1.ppc64le.rpm f663e6b87f71c1f267fa905490f126c84ab56533ea61cd5523d57fe16811ccc9 ALSA-2026:27929 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm 57130c6cb8bb3cf561d8de37fc42674c447fb5b7868aa36aa521c9f85eb9cdd9 ALSA-2026:28210 Copyright 2026 AlmaLinux OS 0 1 Moderate

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default vim-enhanced-9.1.083-9.el10_2.4.ppc64le.rpm 37ca2bb8145b329dc7ab25fa4424be6ab90df48c857d12095de027d0925c8fe8 xxd-9.1.083-9.el10_2.4.ppc64le.rpm b0adc60e67b25c567c910f1526bd4d172b663f3a9724649783ddf6231280c9b6 vim-common-9.1.083-9.el10_2.4.ppc64le.rpm b931d1f0031549d48d44fa68cacd91b792bbaadf56920eb71cc52fae62fb3769 vim-X11-9.1.083-9.el10_2.4.ppc64le.rpm dd2680a25cfec8104f53010608e5f7ecaf5fa2ed8c3d2c43e874c995492c77d4 ALSA-2026:28233 Copyright 2026 AlmaLinux OS 0 1 Moderate

libpng security update

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libpng-devel-1.6.40-11.el10_2.1.ppc64le.rpm 7c90fae3ab7c928042a2d59ac10568bc6cac08460cd2ef81491ac6a9c3e0b0e0 ALSA-2026:28234 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.1.ppc64le.rpm 7fad1d1a9f6cb1fbd207bf3fefc522776c2f65263b5d60646c56d709ed842bc6 ALSA-2026:28235 Copyright 2026 AlmaLinux OS 0 1 Low

libtasn1 security update

A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libtasn1-devel-4.20.0-5.el10_2.ppc64le.rpm 82fa6e620618d3a25624bd6638d9c79f2924ca11c7081305bbaa88de82e8d714 libtasn1-tools-4.20.0-5.el10_2.ppc64le.rpm ffe23ede64d3b30e35cb572cbb3f8a384f88d94aa16ff85a024aa0e0cf2e64a5 ALSA-2026:28236 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-solv-0.7.33-5.el10_2.alma.1.ppc64le.rpm 999f19520f0892268806c90201a8889cee36b03df471fc5d6b332c55993a9b86 ALSA-2026:28581 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-tkinter-3.14.5-1.el10_2.ppc64le.rpm 188895a8bfc83386ee5dc42ad943e60c44e4ac1d0c0ec7bd77c0b66febdc682e python3.14-3.14.5-1.el10_2.ppc64le.rpm 7ea74400893e6fb65bf2271561d4235a9558ab89d4167b44ee49bec5841f5091 python3.14-devel-3.14.5-1.el10_2.ppc64le.rpm 8f3bba57c16173237996394ad0a3ddb713698aca660b3d36077504cd2ac4d2c7 python3.14-libs-3.14.5-1.el10_2.ppc64le.rpm e343233cbb57be6ba8097ec4a72a2b93aae1a557541424f1cb5bd206f11336da ALSA-2026:28582 Copyright 2026 AlmaLinux OS 0 1 Moderate

keylime security update

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default keylime-tenant-7.14.1-5.el10_2.1.ppc64le.rpm 04acdc1d5d5b2a5b4d79feeff112131c9c833b31d46af00c7d1906839d1d3346 keylime-7.14.1-5.el10_2.1.ppc64le.rpm 60eef1f6e58072ba24b4d87f70868d7855a66b7e2a7f96389b64fd91b22aff46 python3-keylime-7.14.1-5.el10_2.1.ppc64le.rpm 77f8dd28d88edc313944448a35051aa210e9ff93c1279ff0029517c39d95cec5 keylime-registrar-7.14.1-5.el10_2.1.ppc64le.rpm 8655016192e510ac7f9c6629c30a1e159417789985a502b1b098ff99fe9bdca7 keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm d087cd9f6da8c7f7422c92a84a47ffcc48661ffb612541d27410ec43622a490a keylime-verifier-7.14.1-5.el10_2.1.ppc64le.rpm d468c53cfe58e94cfe65e2521b1dbbb52d9ea40c5053a66c8e07d4890a784625 keylime-tools-7.14.1-5.el10_2.1.ppc64le.rpm db8377bc3bf868a2fbeb7e538108f96201178291b9ad64be94dc9df833414dd3 keylime-base-7.14.1-5.el10_2.1.ppc64le.rpm e4e84de61361baa9fd1d43804fbfa90c1f8271ac9945fc2c23bc0b612249b1eb ALSA-2026:28584 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxslt security update

libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libxslt-devel-1.1.39-8.el10_2.1.ppc64le.rpm 374d52e2650d7d028c13bf9a2c365675b2f864b9091ea69943bd6ae06cd58209 libxslt-1.1.39-8.el10_2.1.ppc64le.rpm 61da1906c4cc1528358bd1b6764ce85aaf3cd29d38d47fd5dbaaf1dd144e232c ALSA-2026:29035 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default skopeo-1.22.2-2.el10_2.ppc64le.rpm 12d569477cbe1c2125590998c0fc28ca712e1dc135666711402971a7f4d1b998 skopeo-tests-1.22.2-2.el10_2.ppc64le.rpm 8aabe32d6595c717e99a7183691d5d23cc8393f857bea0632d3728c65d6b5df7 ALSA-2026:29195 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-1.43.1-2.el10_2.ppc64le.rpm 393c11ab5547d366aa2653fe6b9c16b80fb58353388db6559da5496d5a6d7365 buildah-tests-1.43.1-2.el10_2.ppc64le.rpm d754aef481ddea353de8f842b133c60fc6046df9c7974e3360f875dbbea5a3d2 ALSA-2026:29874 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nginx-mod-stream-1.26.3-6.el10_2.4.ppc64le.rpm 1f77a6b0924d2205720af840ba4db4a74626a8a54006bdb3b78ab3ad1f87151e nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.ppc64le.rpm 2da2a46902ab652dd56a73cfd0273011ff2fbaa7e5f3b13859f5d06f0a60fa04 nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm 562b83c5c4657fa12e3561c30f43284f0fbc49e4d410c9f9b7f57f8dffef487c nginx-core-1.26.3-6.el10_2.4.ppc64le.rpm 81985e002743114d0d4cf3db2da8306128024870da074443e815f715c8d42c89 nginx-mod-http-perl-1.26.3-6.el10_2.4.ppc64le.rpm 92f86d6059162244de9732004f4d185c46ad87edf280c8e6ed025a91b88da30d nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm 9f23da9e2b3a022ca250a77c0fe4ad02e555ea9d6fc291bd81545b117d01a511 nginx-1.26.3-6.el10_2.4.ppc64le.rpm a768abe5fb97fbef4006e9fa101352c7a87d92ed279a8d2ced6fc889778f4393 nginx-mod-http-image-filter-1.26.3-6.el10_2.4.ppc64le.rpm add8f72b4fecffd26b00e34979c3170a7c4585058cadce0dbc7aee6c8bfeff40 nginx-mod-mail-1.26.3-6.el10_2.4.ppc64le.rpm b04dea05489b8190a171306b8ea0def6acf6e3deac41c1518e14a9c6a899fef7 ALSA-2026:29980 Copyright 2026 AlmaLinux OS 0 1 Moderate

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default golang-tests-1.26.4-1.el10_2.alma.1.noarch.rpm 3726ef009f97fa8d5d3a2547243c897a2ad61b3d3bf8c47c5d2bf97663366857 golang-race-1.26.4-1.el10_2.alma.1.ppc64le.rpm 6c21602af8044c10da043580bcb434dbf75a14aab480fc50cbdc18d8f9e786f7 golang-docs-1.26.4-1.el10_2.alma.1.noarch.rpm 833fa429b2a24d184ef4308625d865d9e06a1d3211c741a966b78c83ea469dd4 golang-bin-1.26.4-1.el10_2.alma.1.ppc64le.rpm 8cff299be7ff16f413eace19939b825df19884611aebd46d63af7ce40973b4e4 golang-misc-1.26.4-1.el10_2.alma.1.noarch.rpm 902dcd6c5009e267bf17ad6a17c944bab1e8d0806d3951286a1e40c6bed7d271 golang-1.26.4-1.el10_2.alma.1.ppc64le.rpm bd40495b04706458809d4345b703c84275ea2a92bf13ed0beb403aba7e0aca19 golang-src-1.26.4-1.el10_2.alma.1.noarch.rpm cfe20b9d0486e89e04d2f4b28058235230bff4d282b1571fc4c5279579e60d21 go-toolset-1.26.4-1.el10_2.alma.1.ppc64le.rpm ea975746dcb0c46e1adad3a8bf2eb9acf673cadd0a78c0b42deb7b9da34cf814 ALSA-2026:30129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.28.1.el10_2.ppc64le.rpm 261c6f4040da06d7da4abd031bfd81c466977d669ac1c1bae1496a4ee1359e05 python3-perf-6.12.0-211.28.1.el10_2.ppc64le.rpm 5cfcb87cf3863fa7c5fcc19baa1ccd28326e929f1f0c5f8ec92e99c24c7e9e8a kernel-devel-6.12.0-211.28.1.el10_2.ppc64le.rpm 6746510183aece7400ec17fa2da043fc4ef7c5a01d4bf3eee49a6d74013c1064 kernel-doc-6.12.0-211.28.1.el10_2.noarch.rpm 7017f858229dac25fead46f7a86ea9f48bda9ff21527d8dafd2ca37464130d2e perf-6.12.0-211.28.1.el10_2.ppc64le.rpm 91053206d472815e9639a816c40a47d8ab809cd3690e6c874a5dc929b61f4b10 kernel-devel-matched-6.12.0-211.28.1.el10_2.ppc64le.rpm 952d7de560c2706be4b4cbccd8cb509d733dc264ed4cbc40960c5a326a9f37bc kernel-debug-devel-matched-6.12.0-211.28.1.el10_2.ppc64le.rpm c98314efc7121e25d00a9403002fcaf43a486c3495bd92c521999c8f6846f392 rv-6.12.0-211.28.1.el10_2.ppc64le.rpm cfa939b5c773e09a40dc4fa9c2a0d6b76feb15ff6bcbba6e5fb0953c3a12bd9a rtla-6.12.0-211.28.1.el10_2.ppc64le.rpm df69ffbb7e57086bc45e5afd985563b49118dc6cb7d2a27bfedc139d81f92e9c kernel-debug-devel-6.12.0-211.28.1.el10_2.ppc64le.rpm f04c6a87f3d2ea63a5a11aefabf5c3e0fad5a24c096d631c1acf5279872a59a2 ALSA-2026:30845 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_md security update

This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mod_md-2.4.26-5.el10_2.1.ppc64le.rpm acbaeee39e9f1d38120812a32b533fb9a4cefbcab5c1c705e140a53f7e70e325 ALSA-2026:30846 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.12.0-1.el10_2.alma.1.ppc64le.rpm b34e3f3903ee108e8bc9bca389a7086ad7548ea00c9c842d097f0b01c9427402 ALSA-2026:30855 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.5.ppc64le.rpm e4266eb2bf2b16714340aae10bc75bc19eb12190f0dcfd1e2905d7d96f362ff3 ALSA-2026:30857 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm e6efbbe6db7984a333245143097f48825a68f0f7cc2d488c57fd1eec9db1d08b ALSA-2026:30860 Copyright 2026 AlmaLinux OS 0 1 Important

perl-IO-Compress security update

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution: * Compress-Zlib * IO-Compress-Zlib * IO-Compress-Bzip2 * IO-Compress-Base Security Fix(es): * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm 741508f5ad1fac081838f6f573ee7ee5aed1ab60be165fde7eab4c556b6b2f28 ALSA-2026:33092 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-doc-2.39-126.el10_2.alma.1.noarch.rpm 07f1c0fec3d86d729f94febb97a600a9829176f2de6b4eac4354dc95cf165db1 glibc-devel-2.39-126.el10_2.alma.1.ppc64le.rpm 14fd774e715daccd43056166f2f5c337367b270409081e769a940e41607f1146 glibc-utils-2.39-126.el10_2.alma.1.ppc64le.rpm ebecf7e0cf0c6d7e8f39d956597ad11d78c38ab5be91e20cee934f3c042aa400 glibc-locale-source-2.39-126.el10_2.alma.1.ppc64le.rpm ec690264dfeeaab631006e89581f9d77d1ff91c429a38f5325a7232ce84af88b ALSA-2026:33093 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb10.11 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mariadb-devel-10.11.18-1.el10_2.alma.1.ppc64le.rpm 12889ae937ff7e011237dd8b85b42050d88a45a5476d71a83383c8fb23b3b716 mariadb-server-10.11.18-1.el10_2.alma.1.ppc64le.rpm 1734c0ae13115a1380f3537d51fd8604cd7fd4c145b4892f90afad58093249ed mariadb-10.11.18-1.el10_2.alma.1.ppc64le.rpm 2b8fd465d3b99e8c83f4167fddc7ccb7f84ea2f319091e799f7b0f98669c2be3 mariadb-server-utils-10.11.18-1.el10_2.alma.1.ppc64le.rpm 38d2e70f6e89b2ce8a35dba55b62cc5d84af6e1cdf5273bf5a941b670149cb50 mariadb-oqgraph-engine-10.11.18-1.el10_2.alma.1.ppc64le.rpm 5561c4a41fd342bf1c0b32ca23a18d801e5d79dc8f0f1005f36c3c72b694ecdd mariadb-test-10.11.18-1.el10_2.alma.1.ppc64le.rpm 561897306f34de3b31988ffa863f85508305d996d8bff43f7b1369d7be5a9d13 mariadb-server-galera-10.11.18-1.el10_2.alma.1.ppc64le.rpm 56ad8650f5fd22effaba717f8a207318e85f76a1c8f4a9a4cc9f598b344eb304 mariadb-embedded-devel-10.11.18-1.el10_2.alma.1.ppc64le.rpm 62bded4f872966796c265c4dcc73514753f9425fdc4057b6703430d4fcb300cf mariadb-client-utils-10.11.18-1.el10_2.alma.1.ppc64le.rpm 674bea85dac39885a755d066ca4200abad79dbda6c6be0c13f25438ee9529424 mariadb-common-10.11.18-1.el10_2.alma.1.noarch.rpm 681f8ea6830f9775d238ef434fe0cb1d7ae292f04e23bb51b564dd3396b48a53 mariadb-errmsg-10.11.18-1.el10_2.alma.1.noarch.rpm 714e7719347d3e47e8ad2c0770a97c3dca85f00f5f67c30868bbc81cbeae8dea mariadb-embedded-10.11.18-1.el10_2.alma.1.ppc64le.rpm 8fc1ffee7f1c703c51b78bd744c75a264f5e6a877fd3d5185dec9cb4a4059a87 mariadb-pam-10.11.18-1.el10_2.alma.1.ppc64le.rpm b6949ea4a6ca0c08011219a6dfaa2d568d0d61c46fd74094476575c2562c2412 mariadb-backup-10.11.18-1.el10_2.alma.1.ppc64le.rpm c146f4bcdc92ef143ef72546a3955115a48493cb6adff34b98de60a1018da0d9 mariadb-gssapi-server-10.11.18-1.el10_2.alma.1.ppc64le.rpm c1bae9e07a0886a17ab28aeacc4264ab35f5383e2c87670608917eee2b995365 ALSA-2026:33412 Copyright 2026 AlmaLinux OS 0 1 Important

galera and mariadb11.8 security, bug fix, and enhancement update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084) * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm 1b8213a94b5a803fee91159889715d18dce58d1206715acfe2ca987d9c88560c mariadb11.8-pam-11.8.8-1.el10_2.ppc64le.rpm 29d91f344cd310a322153621b6c2ba7986458a976bcf34ed3cc3f0af80bc5e9c galera-26.4.27-1.el10_2.ppc64le.rpm 2a5839c3b24f00a74257f4ebf2c20e2ce5a0771d7fc1ebadc64b967fb88ead9a mariadb11.8-gssapi-server-11.8.8-1.el10_2.ppc64le.rpm 385c0ab3af7970307fdf1a5998d982be81a7d85564e5cf2ee09da17a21eb771e mariadb11.8-embedded-devel-11.8.8-1.el10_2.ppc64le.rpm 53fc7be4237206f6ccf972b3a3fcc3d2b2d7b274ac03c8dbf7d32fcb7acdfb8f mariadb11.8-devel-11.8.8-1.el10_2.ppc64le.rpm 74b479c67b18f08fc6aa0738b6e5c2d8cbcf019e2a5b89bcdda30fdac8acd2a7 mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.ppc64le.rpm 8424046448ac12d4c7e9aa3e707c5ff839bf13da36863d688f023de45e8314a1 mariadb11.8-embedded-11.8.8-1.el10_2.ppc64le.rpm 87be2a02a7771e3fa1547f05bbbcb1bbff0f41a17abdb315cf0fe568dfbd0496 mariadb11.8-server-galera-11.8.8-1.el10_2.ppc64le.rpm 9b602293de1e387a5ff524ea4d15b178b3d36c4a43b98ed57987326c90c36fc6 mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm 9b959318939709d585735442a771104817080a3fa715a214b85e0185a5e94ac0 mariadb11.8-backup-11.8.8-1.el10_2.ppc64le.rpm b24c471f115a546fc3ff9cb268e3de012e9fabfc5a7bda722c7070cba51a478d mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm bf247857f833df313151be70c72cf6cc08b2708a50410ff68503d30347ea33e0 mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm cedb5ef493d966e6486d252d6067e6b53503d8ae6ebdb7dd3e8f68edfd7f05aa mariadb11.8-server-11.8.8-1.el10_2.ppc64le.rpm cfd70471cd02ff090197e770fc22b0783419d0e9bc0504f2508fb6a631f0f56c mariadb11.8-test-11.8.8-1.el10_2.ppc64le.rpm db06862601900292a99622dba65e61b779001a1433ead623c373e9ccac6ead00 mariadb11.8-11.8.8-1.el10_2.ppc64le.rpm e22253efd00076f802f4a9819e8c560675da11cc0eb90ef4159de528caaea706 ALSA-2026:33502 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default giflib-5.2.1-25.el10_2.ppc64le.rpm 8a3fd3269d8576d7944d89620e5826dec9826f84cff6bcad8940dba784616c3c ALSA-2026:33540 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.ppc64le.rpm 1f2530778c2a87fb8f3abaef17d829459adf5d601d51e8bc52443a42d761cda6 ruby4.0-rubygem-pg-1.6.3-35.el10_2.ppc64le.rpm 4be3cc129130cd161ff9fd7dfd69d7b377b6c88fc71ea7535b529500499bb96c ruby4.0-devel-4.0.3-35.el10_2.ppc64le.rpm 69cc223f4b08d63365b3b16e2ccec6c31c88058fdaa498aa0fbf3ad0f933d3a8 ruby4.0-4.0.3-35.el10_2.ppc64le.rpm f1f818e84ced4d41547c81bcefcdcd46d5fe866c23577721ebf5415629ca2fd0 ALSA-2026:33565 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rubygems-3.5.22-13.el10_2.noarch.rpm 2f09c90f0b4981535ebbe0b5b7b4ba60dd9bf5785c27f0948403aee04d0d5b28 ruby-default-gems-3.3.10-13.el10_2.noarch.rpm 39ee09200809903651fa2e054e18cb445e9dae3f0c19984efe4045642eba7d34 rubygem-rbs-3.4.0-13.el10_2.ppc64le.rpm 3e031b6afbb7dade95dc2fead2ce45d30906484d49da6427b8ceeb991c8b2f52 rubygem-irb-1.13.1-13.el10_2.noarch.rpm 5fe9dfe4760320749f19a851ab422764bf54367af0eb5510c9e54a95549daba8 rubygem-io-console-0.7.1-13.el10_2.ppc64le.rpm 64c5e3fcc554987e53eff2a395ea839e987ff6349b790359327d1cf742b3aafd rubygem-rss-0.3.1-13.el10_2.noarch.rpm 77dbae3e8147ddc42bab5b6ea0d18c2e4118e0105e415dcfe6fde5793202bb0a rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm 84f1915103438280abdc5b9e57ca39fb26ffae2bf1bc21027bd6ffc6d79f3a9b rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm 866eeea21e0bb345ada37a03f5d13b57a0399196476d646d5eb5506909bc81d2 rubygem-json-2.7.2-13.el10_2.ppc64le.rpm 88334ef4f15f1c3910cb5262893e08de7fca792435df5a42e191dc4d056fbb2d rubygem-minitest-5.20.0-13.el10_2.noarch.rpm 8d9d188779b8666f560bb68d91edd4391c9dc0cf440b9130fc0564c11966ea8f ruby-3.3.10-13.el10_2.ppc64le.rpm 8ff882d413e98101a750e22be3d8dd54e8144b76f753b07bd6122b7d78173afa rubygem-rake-13.1.0-13.el10_2.noarch.rpm 9b79c2f558b1658de031381b86dd753b030592a6199883a0022919c04b379525 rubygems-devel-3.5.22-13.el10_2.noarch.rpm 9c2bdfcca295e0d66484e9c97a77cd7f3e0ac57cfdb203043fc7933c70d2ca71 rubygem-racc-1.7.3-13.el10_2.ppc64le.rpm b2dfc7c23ac442943198f683e34b390d6703b3a76b5d9c7182ccf1dc9bb5d501 rubygem-psych-5.1.2-13.el10_2.ppc64le.rpm c83cb60587c218b0549eca8a5ca72cf88a51df8a35f2f0a16fe0542e761a3485 ruby-bundled-gems-3.3.10-13.el10_2.ppc64le.rpm cab1e1e31bda16c11a9ec7b6bf64dddacc486b5be31432656dbbca1fbabc1a2b rubygem-bigdecimal-3.1.5-13.el10_2.ppc64le.rpm d0cd0137e34a9eba107a7ebb979f935cdf31b17e51f319d5e517518e5808145d rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm d3a54b16ced51c5e321382a648a7fb7a1a9cac1940df6d3e2b907de4669c5d3e rubygem-bundler-2.5.22-13.el10_2.noarch.rpm dd71e0f69e1f86a3e4c35e6fd46db1e3360041d19976243b46e4612a81b06606 ruby-devel-3.3.10-13.el10_2.ppc64le.rpm e0f734268dbcbf01be480ab8490976f2a4c1a1c87f95f02805e85c76774aa4f7 rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm ed105a1583192586a2f3343deb1cbc054e85193e938c0fb1822c3397f0e7ffa2 rubygem-rexml-3.4.4-13.el10_2.noarch.rpm f59082b3a7963f92107e82ec2557edc1e4be848f32ef1752978e61ea1311d1c2 ruby-libs-3.3.10-13.el10_2.ppc64le.rpm f6f0980a6d5abe3824ed5fa0bfdd7d8929bc9e8b4a0711f4c7dc455784eebff0 ALSA-2026:33685 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887) * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.29.1.el10_2.ppc64le.rpm 144b0da62c481fdeb31b9aa4273b98b9d889e4dd9ea44bb19dc279ae231caf3c kernel-devel-6.12.0-211.29.1.el10_2.ppc64le.rpm 153c659c7f2b507fe4fa0f602a737da88d0e82b6713104e4967973687d0cb626 kernel-headers-6.12.0-211.29.1.el10_2.ppc64le.rpm 1b3b2a17eecf9adea1a5193ab182c1f8dc155c858c12a5b5455395d010b125d1 rtla-6.12.0-211.29.1.el10_2.ppc64le.rpm 1c0428e22200a848b3ce8767a6c9183db36ea070581d52d27c14f54652cb3210 perf-6.12.0-211.29.1.el10_2.ppc64le.rpm 210e07e9341bb553d2e1ab23b78497166049125659339c4e0eb199450a96e564 rv-6.12.0-211.29.1.el10_2.ppc64le.rpm 2d72ee2a42e51938a0656d2052669e66c0be5f317e57167d8128f646a6127daa python3-perf-6.12.0-211.29.1.el10_2.ppc64le.rpm 6e4287926b66a4f060b55a4db6f46f75af81ec017fb7b081e9f4409b15668991 kernel-devel-matched-6.12.0-211.29.1.el10_2.ppc64le.rpm 791f751c1a1b326332114b788c2b9f0a009e42b4e33e00e6e01f411ac551a827 kernel-doc-6.12.0-211.29.1.el10_2.noarch.rpm b836e329534f6755772c1ddbdf8b9206b050a9efd1b92e1c01c0d98fdd9037c7 kernel-debug-devel-6.12.0-211.29.1.el10_2.ppc64le.rpm d2525a4482049b98cd1a9da1f17a320206bb2cf99b61b6fc85f92d75633445f4 ALSA-2026:33731 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rrdtool-1.8.0-21.el10_2.ppc64le.rpm 1dc4d6d65974f14d921dff813e403f9b7fe9ce726304bee6e1e70b442f071d00 rrdtool-perl-1.8.0-21.el10_2.ppc64le.rpm 38fb8de2e8efdb7610485968d10fee74c2da8c09e90ebb91361518bdc63b539f ALSA-2026:34109 Copyright 2026 AlmaLinux OS 0 1 Important

httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm 30a9431c19d9b0eaee77dd0b3a9c83a8c8a3a28bd86f1779bae9f85de7bc9f30 httpd-manual-2.4.63-13.el10_2.4.noarch.rpm 5e32be7a095c8c1c4519272d18d660a3422b7a943ac850a731cff5f11027152d mod_lua-2.4.63-13.el10_2.4.ppc64le.rpm 5f0ce47837056b673082124f65459c8169486c0d27f21fe1de44389977fca781 mod_ssl-2.4.63-13.el10_2.4.ppc64le.rpm 6c38fb0284a2186191d1b22ebc80b363caf9f4f11700bd8cc67da1dabf03d2fe mod_proxy_html-2.4.63-13.el10_2.4.ppc64le.rpm 7bad418f1466820268c14360b056b95d1c8122b1ac45c2be80123ac3069a4cf8 mod_session-2.4.63-13.el10_2.4.ppc64le.rpm 9edbc8752da22adc9145420d106d00f744c54e7231ce627dadfa9e30459e9d20 httpd-core-2.4.63-13.el10_2.4.ppc64le.rpm a449a28eb84a81a4303afa4aae8f780c05b05c2b94df3ab065160c1ddd21f50a httpd-tools-2.4.63-13.el10_2.4.ppc64le.rpm c43711ca4d87585f3755fab2db5fb2011dc981e0830f1da99d0469f6a1c7be37 httpd-2.4.63-13.el10_2.4.ppc64le.rpm de990119d44ae193a78cdf346d554ec54817534795d6342f95414df66a912a84 httpd-devel-2.4.63-13.el10_2.4.ppc64le.rpm e9f8f0170a45e2a0963bec707d6dfd45ddaa9e2dffbbf8465cdddaf089b3f8cb mod_ldap-2.4.63-13.el10_2.4.ppc64le.rpm eb614d1b7a7fc7519de9edad8a228f8e89b8fc81777f6ccfeb0ea59ce64dae8e ALSA-2026:34355 Copyright 2026 AlmaLinux OS 0 1 Moderate

mod_http2 security, bug fix, and enhancement update

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mod_http2-2.0.29-4.el10_2.2.ppc64le.rpm cfa14898beef41fbf1bb4d766b2d7e3942f16d5c07d71b9e9fc112ec5208eb5e ALSA-2026:34357 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-1.el10_2.ppc64le.rpm 6219bc695f6deaf331bd9768887339bce702bf86bdfbc381e88416957bdb28ca ALSA-2026:34911 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: kernel: ipv6 frag escape () Bug Fix(es) and Enhancement(s): * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537) * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.30.1.el10_2.ppc64le.rpm 270356249fe27700b7abdebe45c4c90e6514d0f18c1eae5076c61f4a897f15f5 kernel-devel-matched-6.12.0-211.30.1.el10_2.ppc64le.rpm 2bf2b98b5ff0e17d4b1995d7e57360f670b4f06904b49d1556f82f5410f5412e kernel-doc-6.12.0-211.30.1.el10_2.noarch.rpm 37071c47ef6d33902382a8ed775082ac0e87202627db8e9d81a39e5f0fbdfabc rv-6.12.0-211.30.1.el10_2.ppc64le.rpm 4935df34f816a5f75ee7eeac56c24c9a2e3b2934f31c38edfeffa0a14b768a22 python3-perf-6.12.0-211.30.1.el10_2.ppc64le.rpm 5865e37bc9846ee57c972032868bfc94a08e591ba742276461a64f294fa295d7 kernel-debug-devel-matched-6.12.0-211.30.1.el10_2.ppc64le.rpm 6a300405b613244ec4e9ecd404c569b63b02d3edc51ec3e167eb83c24eae8367 perf-6.12.0-211.30.1.el10_2.ppc64le.rpm 955506bffce9c2e8287b13b2f76b825ab763fa4919db7c80786c6124b6d782f3 kernel-headers-6.12.0-211.30.1.el10_2.ppc64le.rpm a3a4f9e27565b60eb9a64c08f68b0f2b685c7dcf1b84942e1bcf0f58523fa07c kernel-devel-6.12.0-211.30.1.el10_2.ppc64le.rpm d7873a84c607744e45e93bdc010ae4635109dc9ff775f05c4e15689b2f95e1c8 rtla-6.12.0-211.30.1.el10_2.ppc64le.rpm ea7c2c1dc60c6825ec89d20924ae309f71e952d6c4b0a7c1da772fff657d1e7f ALSA-2026:35826 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-pcp-5.3.0-7.el10_2.ppc64le.rpm cd06df307097b240a1d18db2778b686004df0802525acc8690b990f95d8d0757 ALSA-2026:35827 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-10.2.6-27.el10_2.ppc64le.rpm b24645e0ca0e6c9f8bd5dc9e6221a50dca86639944587f6caf9ba096108d6e08 grafana-selinux-10.2.6-27.el10_2.ppc64le.rpm dbaf996924ff23ae4a9277aeeae4be3bd52e48112217144d8b83e79192d376a0 ALSA-2026:35832 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.2.ppc64le.rpm f38668e39c0526ed538ccf06a130a38479759b9aa94f30ec8c3c85706042c878 ALSA-2026:35841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs24-devel-24.18.0-1.el10_2.ppc64le.rpm 0ac21b7fad611caffa616ca9ff62df28e786fba844f1119524f4c29a34c12ba0 nodejs24-libs-24.18.0-1.el10_2.ppc64le.rpm 18befeabf183e5a34c983de950ea1d55dfe0bbe320b875d7f8a422bd2a68cff6 nodejs24-24.18.0-1.el10_2.ppc64le.rpm 8e336a110440dd0ee77be340abdc360376c866b95ac54ef808bdc9ea58647d3b nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm b26d8267ca66276f7e691e6ae46d36fc0beaccc3064246c73bf7e97f5437ff7d nodejs24-docs-24.18.0-1.el10_2.noarch.rpm cfbfb133600350bcd79f384de1fe77fa2508bf7bbac0e804b4b4b5991450e772 nodejs24-full-i18n-24.18.0-1.el10_2.ppc64le.rpm d94427b6768a30fdaa8016890f373881393226c861ed65bc485fa50768983b3a ALSA-2026:35842 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-libs-22.23.1-2.el10_2.ppc64le.rpm 33830c529c3de948c610b0a8ab1f22bbb0171f133893569db00930d1dc6a7eeb nodejs-docs-22.23.1-2.el10_2.noarch.rpm 492a598f325fdb1de667b1cf3eb563ff290a931816399634238410c6852efc36 nodejs-22.23.1-2.el10_2.ppc64le.rpm bd83fa5c020dab1f67525a46ccf6902a4f21661644555c8707c506eccb4d96d0 nodejs-full-i18n-22.23.1-2.el10_2.ppc64le.rpm d0cf68d2cab7f19b011081c7a5de3f5bde84221302c4e5edd1f5547b46e9cb1f nodejs-devel-22.23.1-2.el10_2.ppc64le.rpm d77321971f773f31e115bf80626206f60eb6cb96a298efe61d560ad971692e72 nodejs-npm-10.9.8-1.22.23.1.2.el10_2.ppc64le.rpm f5a0e02a4e40522333398d39f2eaefa51769682c1484b5b7971948eeacc0c761 ALSA-2026:36193 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-pip security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm 80456c6bf4f96a398309a5858cf83bf96d5c0f655b8b581a95e3ff83b8664e80 python3.14-pip-25.2-3.el10_2.5.noarch.rpm 927cdfb0565ce93516e52106bc6c1092e3eb33f3170f0a74c8dfae46233929be ALSA-2026:36196 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default 389-ds-base-3.2.0-8.el10_2.ppc64le.rpm 1360b2e0f6f6d4c6d798f17d02067019dbd3b26b16b49add2d414935490237c0 389-ds-base-libs-3.2.0-8.el10_2.ppc64le.rpm cbe467c30246b2f9570a6210a37afe527487b9f3810628f03fdf0efb27ac0e8e python3-lib389-3.2.0-8.el10_2.noarch.rpm db8acba0242228f0760021708fbba6f09ec6c3ed8b57470de69e594a8a184aa0 389-ds-base-snmp-3.2.0-8.el10_2.ppc64le.rpm f74e0e683d583ade2435f218b1d4cf56feed2d5dfd3021a0913416bf5fc7cbf8 ALSA-2026:36199 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-1.43.1-3.el10_2.ppc64le.rpm 0d0147d0acaca262ac0001f62d8093dd764faa66d24aa53a3befea317e0e2103 buildah-tests-1.43.1-3.el10_2.ppc64le.rpm 4b88935e997cfcce8eed555ab17c1f9e54762557e206fb62d5bc37f16ec26462 ALSA-2026:36203 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.6.ppc64le.rpm 45bb751f9d2435b53cbbd65f8f4605d683388709a43c744b13e0322699f9d100 libwinpr-3.10.3-12.el10_2.6.ppc64le.rpm 5de781494aec06a7d1558d7406b6d80fc22a666aed902f7532c9de483195b73f freerdp-libs-3.10.3-12.el10_2.6.ppc64le.rpm b231e73bd36e7ed8d3018cc4b8f02b2585257e2492630d80a310e833d88f68c4 ALSA-2026:36211 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freeipmi-1.6.18-1.el10_2.ppc64le.rpm 587a27a42f53dd7e00d4f35d922e80b5954a08a79e0904a115ffab4f33b4f3fa freeipmi-ipmiseld-1.6.18-1.el10_2.ppc64le.rpm 73fa13afd01c23ab430e88d3b08119929fd299e7610a9cdbff0bc6fb32938825 freeipmi-bmc-watchdog-1.6.18-1.el10_2.ppc64le.rpm b36d0d0118453ac790f1e5d2ab79e094d389f9d34f8eb920b82593f9c0bd8767 freeipmi-ipmidetectd-1.6.18-1.el10_2.ppc64le.rpm bdc2645d751a46e39853dd4bca599178f1157c881b6519a2f36a754c11e064ff ALSA-2026:36320 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-unbound-1.24.2-7.el10_2.2.ppc64le.rpm 1d35c44cd80413fdc34df03b475f08b7873f2a368c86fa7f1524e5da7acd6656 unbound-libs-1.24.2-7.el10_2.2.ppc64le.rpm 21bc9b8b1fe59cbaa01da43bdc3a4376aa1bed08ceee85ee4c4f460209de00fb unbound-utils-1.24.2-7.el10_2.2.ppc64le.rpm 2396f7e3632df61ddd9fdd52c7c542262f1a71458565d86b023296aed62890cc unbound-dracut-1.24.2-7.el10_2.2.ppc64le.rpm 46df49c32aa3bab145fe56e89dbc2c59056541794ea49e802bcb9d81f28af937 unbound-anchor-1.24.2-7.el10_2.2.ppc64le.rpm 94a295f9b69ce6a3afbd000026e69b3d27931abbe65904fdeeb173161be327c4 unbound-1.24.2-7.el10_2.2.ppc64le.rpm a09065f0cf1cf7705126b51ba2781151819a10ef2c91aaa4a4b69e4c16c2f4c3 ALSA-2026:36364 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nginx-mod-http-perl-1.26.3-6.el10_2.5.ppc64le.rpm 1f2a5aef25b58c2c34c56f0f45e1d24a7a5d18cfd2194647f0b8841b238b17a1 nginx-1.26.3-6.el10_2.5.ppc64le.rpm 27db95d93ae706e30439b10030641ebccaefac3bdc83378a3c5b3660bbd291e0 nginx-mod-http-image-filter-1.26.3-6.el10_2.5.ppc64le.rpm 3f7f0f78b4cf73bee94ed692ff50ed74e2f608a25050047caec0f8dbee8f74ef nginx-mod-stream-1.26.3-6.el10_2.5.ppc64le.rpm 5da1cba143050f6340b8a93e41c750379e3a1e0b262e5dd7fce70a6c35dfc507 nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm 63783f2757ef9f4c14eb7739660124c6c7d8094475d4b3333f54aa552c72f0fd nginx-core-1.26.3-6.el10_2.5.ppc64le.rpm 76bcce5d83c0e4f90b4b96a2bac34910721a2d94cf955245b77c98c367f83832 nginx-mod-mail-1.26.3-6.el10_2.5.ppc64le.rpm da5d8374ea2690056046b5b66ffb56296916456fcafeb2f80e122e57bdf4a0c2 nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm e33cd1bd4272896159c0e7c1cd3fb48f85a85d98e7641fd3ac67aa121ff5fae5 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.ppc64le.rpm fc4b6aac4264044ba7c9e54a3cae3b2d1bbdf53946e721ace5c6c7284e8c3776 ALSA-2026:36541 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140) * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rtla-6.12.0-211.31.1.el10_2.ppc64le.rpm 0bbd4dc35dda267e0797b30304ff4cd672a92968997ea7a4b15d1fcaf29d469f python3-perf-6.12.0-211.31.1.el10_2.ppc64le.rpm 15c829f1debbba7b0511fbcdc971e14f63801b5fd19b2575b9cdc7c04562e38e kernel-headers-6.12.0-211.31.1.el10_2.ppc64le.rpm 1f5e2e17d0b5317c92975f81cf9fa07853e54d8c6b6e1cd6e83694b08246382a perf-6.12.0-211.31.1.el10_2.ppc64le.rpm 306e9ace4dd00c773b167688fc689d83dfeaf5e18c62c928d90b3785d49e24da kernel-debug-devel-matched-6.12.0-211.31.1.el10_2.ppc64le.rpm 400bf2525aa55bea4e09be3de7a3632f71dc6ef5b86d071184b86f09ce17e525 kernel-doc-6.12.0-211.31.1.el10_2.noarch.rpm 89b91f15b9a6c2c75be8b2c7e16409d5457cac0e17efe5cccd145ffe6964e501 kernel-debug-devel-6.12.0-211.31.1.el10_2.ppc64le.rpm 9832bbd71699c286da36bbb88686e8ec41af1d11eeb99e992f34a44ab3f5ae24 kernel-devel-6.12.0-211.31.1.el10_2.ppc64le.rpm b489474adf12821f191b8cd03c384e267b9cd92f28e59ab983ababd50d099cf0 kernel-devel-matched-6.12.0-211.31.1.el10_2.ppc64le.rpm c4b5e9910bc004b3dcb99a0a9b0b30380b106468959dfb5ec3a4910816a721ab rv-6.12.0-211.31.1.el10_2.ppc64le.rpm ff8169a15073996a71fd88bd71bccb28a9c1a334c19dc0a51e4dcd944b5f5276 ALSA-2026:36673 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.ppc64le.rpm db212a2f81e721522ade908e1b43f861aa0962587fe7b570d84892abf6c373b9 ALSA-2026:36675 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.1.ppc64le.rpm 080fd633c86b0bc8be526d71f72872ab4a2be7d11c87d3bd539089c330f52b87 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.ppc64le.rpm b776f63381a791ddbc06cb0524cd5be9428ddfe3b40d86a3a783f7e84b869524 ALSA-2026:36749 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.ppc64le.rpm 867becd8f680429c44b91e3f433baa9d90f1208326e2f6afb7c7bd8ca3c61f24 gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.ppc64le.rpm 926ad8156b9191a7838e47f16ac22a309b2e995a10596bad178e6f3419e50a81 ALSA-2026:36782 Copyright 2026 AlmaLinux OS 0 1 Moderate

aardvark-dns security update

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`. Security Fix(es): * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default aardvark-dns-1.17.1-1.el10_2.ppc64le.rpm 1c61c210b93c9b9312537cbab7e9413209e4c07c1a710df0d336a14154dbb7a3 ALSA-2026:36788 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat security, bug fix, and enhancement update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat-jsp-3.1-api-10.1.49-3.el10_2.alma.1.noarch.rpm 1819dbffc1a4bca43680dfb716f9f6bfca480b2c4603395e77e0a419a58fbf40 tomcat-servlet-6.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 2554b1cd27aae45d566ee543e529a7f8b631976f3dc644dccaa3151198093639 tomcat-el-5.0-api-10.1.49-3.el10_2.alma.1.noarch.rpm 4b09a49a6a830ea70914354fdb2180be3d73be82a0bebb83bdfefc3d3432cb85 tomcat-10.1.49-3.el10_2.alma.1.noarch.rpm 7a52ade066f085dc82c61eb86e4ef336c98d2ac6ba70eff0127686795e779fa3 tomcat-lib-10.1.49-3.el10_2.alma.1.noarch.rpm 8493861578941c0333c0447a8fba9719aa909187e4dfce1eb7ea6f9689eb73f4 tomcat-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm 8545fc47344bf1f124375700093b8bd550c7b5bbd3885316391a2c6901779bf3 tomcat-docs-webapp-10.1.49-3.el10_2.alma.1.noarch.rpm cd529a071ef3d5271bd60e65c7097b158dc762889174cff1d29908a19942df9b tomcat-admin-webapps-10.1.49-3.el10_2.alma.1.noarch.rpm f1ca32a57c82c415745065d6ad5dee139ea70ca3e4b206c2c5213577fb413f9f ALSA-2026:36790 Copyright 2026 AlmaLinux OS 0 1 Important

tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat9-el-3.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 1e7a1f290d83d33dca1568da1d68c956d2ff9d703a7b398d2955f8f881f6c51c tomcat9-admin-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 35f74b44de15b3b04a6bc454a111d3dfb26dfee6c7ad16644fb1a88130dce735 tomcat9-webapps-9.0.117-2.el10_2.alma.1.noarch.rpm 3682120341af35136b188a86d60de457c2c5936026aea99b5a7b1317d71f90f2 tomcat9-lib-9.0.117-2.el10_2.alma.1.noarch.rpm 3a1e23335ca4fc1ca27006743516d5c74f7da734dc74dcdc72f5a4bed710668b tomcat9-servlet-4.0-api-9.0.117-2.el10_2.alma.1.noarch.rpm 42f01e89a5d4c20d96e5212710be93238f72ce04851d86ae714c53b925109a88 tomcat9-9.0.117-2.el10_2.alma.1.noarch.rpm 7b18a53d3580ad05f99f8ee76bc0a5408bc9f0a2ca45465fd3446184546c2cb9 tomcat9-docs-webapp-9.0.117-2.el10_2.alma.1.noarch.rpm a59f4bad7f545f5287804da402c7f5be36cbae0c74cf7b8b5f691c3473fe68b6 tomcat9-jsp-2.3-api-9.0.117-2.el10_2.alma.1.noarch.rpm ac4d0fe0045a2723cfb5b6f43bdf719a027a0d7e5f26985bc08e3b4c1c91feb3 ALSA-2026:36956 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rv-6.12.0-211.32.1.el10_2.ppc64le.rpm 2e07d20efa8de4dbeecd035ab4071eb779d3e89dd67092140041d73db7fa0ccc python3-perf-6.12.0-211.32.1.el10_2.ppc64le.rpm 33d8abf89414a1b9c5ac170dfa564d39e5c76c0c514ab2e93aa3dc062013253f rtla-6.12.0-211.32.1.el10_2.ppc64le.rpm 42796c00c908794c7c39ebf05143048f59a8d2a10dc2678d2b912542689534c5 kernel-doc-6.12.0-211.32.1.el10_2.noarch.rpm 4f6f025dca58da64c2300881e18f8767aa214eab6914aec981f04cad4cabb279 kernel-devel-6.12.0-211.32.1.el10_2.ppc64le.rpm 8410bd9f06d45eafa510b015a5ba9d36ca82d6265377cfa6f62594247ccb2eef kernel-devel-matched-6.12.0-211.32.1.el10_2.ppc64le.rpm 8bbe6a22523092875e79dd780f5001cba7b72c9967a638bc0faec86f30bd5e10 kernel-headers-6.12.0-211.32.1.el10_2.ppc64le.rpm bcfd0a52c8aad3e91234b24b15d3ce58249bba917eec8541e58f18deb93a8b49 kernel-debug-devel-matched-6.12.0-211.32.1.el10_2.ppc64le.rpm c74e99f6137a5f681e42a16b6d6421caec3cce0183a8a3294615d3798fd22e9f perf-6.12.0-211.32.1.el10_2.ppc64le.rpm dc9ae9ba1dff4d71e83f9b49d3fb7b35ae24a1483cc5644122945df1a8adaa5b kernel-debug-devel-6.12.0-211.32.1.el10_2.ppc64le.rpm e89a43f804e8fbd794d5c9178cdc452b0b3130f2e182772006ee17388d39fcce ALSA-2026:37436 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default golang-1.26.5-1.el10_2.alma.1.ppc64le.rpm 1c19213e66ca22728e3377f0e22085da4e0cb182cac94a13130c66c8080f1e7d golang-misc-1.26.5-1.el10_2.alma.1.noarch.rpm 8b1baa3232557c008b80897b0d878d2d32cb781b8cc9b3418c2541f114ab8bd2 go-toolset-1.26.5-1.el10_2.alma.1.ppc64le.rpm 99085b04d1ab2127d96fc4264f7d19e5b209518db8f9ad59786bd249fad204ff golang-bin-1.26.5-1.el10_2.alma.1.ppc64le.rpm ae9e8e6d7f13aafa4094ff0fe03e57ef819cf684fd4b1622ed2907092320cf2f golang-docs-1.26.5-1.el10_2.alma.1.noarch.rpm e79232aca5b77e65b500df22bd8d4d8328e0c2dce6833e3fc94730d5830a9c07 golang-tests-1.26.5-1.el10_2.alma.1.noarch.rpm e793fc42fe1650f9a19106e8b5b7a3d9bdb7d8d0204ee5e5af2c808d2d66a9bc golang-src-1.26.5-1.el10_2.alma.1.noarch.rpm ec33bba2e56c497962b088c3e47106cc014d357d9e7a0743489c3b9f1da82635 golang-race-1.26.5-1.el10_2.alma.1.ppc64le.rpm f7bc01b4411f1e6859681934a04185bde4fb606e349bf0ce0543e8e9bb85f127 ALSA-2026:38489 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.ppc64le.rpm 21441e938dc88008957bc27e43a6baf2b55fad5466a4bddfa4d60c34065420bb ALSA-2026:38492 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.33.1.el10_2.ppc64le.rpm 106ac0a8433ce02ca29c085e436a8cb63cf30cf109c435d73c82755b738f88d4 kernel-headers-6.12.0-211.33.1.el10_2.ppc64le.rpm 11ed51107ee40217bad828fb16b4fc90866244b0a8888c93a78f7aec04f96ac1 kernel-devel-matched-6.12.0-211.33.1.el10_2.ppc64le.rpm 1b6800df52a752d35a7112073988a43f1aee830028de4d81ce28d04a207208fc kernel-debug-devel-matched-6.12.0-211.33.1.el10_2.ppc64le.rpm 2cbbf65203a8ec3ec03db5fb17944299ac21318026f74b6fd25305ee2046b683 perf-6.12.0-211.33.1.el10_2.ppc64le.rpm 48afc4fbf7a5f43d93467cff769d47390bc8f033c46626f553ee6a191913d316 kernel-devel-6.12.0-211.33.1.el10_2.ppc64le.rpm 4c1006ef45c61518279b714c299dc9490b44643f3b03b66562bf295f3e45abc7 rv-6.12.0-211.33.1.el10_2.ppc64le.rpm 78618abecc694878ce4ec7a5cb95ff3a9b8c5907ef70d619d368c1c9e0331c1d kernel-doc-6.12.0-211.33.1.el10_2.noarch.rpm cb6b5ac15159f9f1673206a9a80d24ed89608d643c0b10f5ae9295c1579474e0 python3-perf-6.12.0-211.33.1.el10_2.ppc64le.rpm f46d0a9621768c3e5ae568e79d76c739fad13a4f820cc7ca9a9a6ae0a962a487 rtla-6.12.0-211.33.1.el10_2.ppc64le.rpm f9b83faea7815aef07d7ea3202af78c6a154bf7803ffe06e107900b97ec8775d ALSA-2026:38494 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-1.43.1-4.el10_2.ppc64le.rpm 6930770d7c132e0d3a08f601810db97e3a4bea91445a37fc68259a6664b2843d buildah-tests-1.43.1-4.el10_2.ppc64le.rpm fc0d66c528bfeb624dff0d651e55575f46cb446e44b8881c89693ec633068104 ALSA-2026:38495 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default podman-remote-5.8.2-5.el10_2.alma.1.ppc64le.rpm 239ebeaeca5bf40fa43a120c9e5bbe0af5358a1d3054872173a035f4bdeb9150 podman-docker-5.8.2-5.el10_2.alma.1.noarch.rpm 6d642e7bf54d7d8737244e959bd94e167100278c8303a9671587b40898d8f8a0 podman-5.8.2-5.el10_2.alma.1.ppc64le.rpm e260eef1e1d13866aecbf403e524993d7fa99594999a36725a19341f41bbb44c ALSA-2026:38499 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.3.ppc64le.rpm 4a64711c3005345bf2ecce11b307895fb5c34495da166a8b3eeb8b420d18b358 openexr-3.1.10-8.el10_2.3.ppc64le.rpm 6252a1cc799af81f5ffcf60a49ce4ecc9f522b1733334f27a952c4286974f45a ALSA-2026:38509 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162) * vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858) * vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.7.ppc64le.rpm 1e378cdc38218fa31bc8c64b5c62f470c576d40cdb860b91b807de7c58331ad7 vim-X11-9.1.083-9.el10_2.7.ppc64le.rpm 2b3a6f3c4199967320b506be93e6f2688abe82aad101d381e3e2f4eddbc5f5f0 vim-enhanced-9.1.083-9.el10_2.7.ppc64le.rpm 3515246db3e1586ae3e0dbc208c0767da3ea44042bc4c25a08e2ec27a2908af3 vim-common-9.1.083-9.el10_2.7.ppc64le.rpm f89f96ef405bd645d7a019e8501a8c60fac3e2375c77197f13d3784980a08630 ALSA-2026:38513 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.1.ppc64le.rpm 811cf04f8e402c6aab7d544c0df26d35227c5ac0ec1b65a13a52ced48d4ed753 ALSA-2026:38514 Copyright 2026 AlmaLinux OS 0 1 Important

plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. Security Fix(es): * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default plexus-utils-3.5.1-9.el10_2.noarch.rpm 0e05d395f8b55a153026dfa3c8010ad4245d0439c34d80e42db758da41ab8738 ALSA-2026:39183 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python-unversioned-command-3.12.13-2.el10_2.1.noarch.rpm 01fd0cfaa34357b582559770297e93d57c2b9e0ffb6f529c89ba4cd34d50ce96 python3-tkinter-3.12.13-2.el10_2.1.ppc64le.rpm 2ce29537282cc51291971f7f8955727ba47d7cb148288a1a53184248cfbdb03e python3-devel-3.12.13-2.el10_2.1.ppc64le.rpm fba7b44c99decd4653d342523b5ec0a94fac57a64dfd87f26e7af003747b084e ALSA-2026:39272 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.6.ppc64le.rpm a3980ea6c08bdb140f29b84f9334d059921f16cff4ce3ebd724e38a3cd4ab4b7 ALSA-2026:39296 Copyright 2026 AlmaLinux OS 0 1 Moderate

libinput security update

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libinput-1.30.1-2.el10_2.ppc64le.rpm d35d5d2f3950334f3ef253037609ac1ca03360f15fddf07fdf1262c3c4d7c99f libinput-utils-1.30.1-2.el10_2.ppc64le.rpm dca8d8d84ecf298d05552866a464406200d1e68d98ff9ab1de9bc225e1eeaabd ALSA-2026:39297 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790) * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) Bug Fix(es) and Enhancement(s): * edk2/x64: re-enable legacy kernel loader [almalinux-10.2.z] (JIRA:AlmaLinux-182421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default edk2-ovmf-20251114-5.el10_2.2.noarch.rpm 15c2aa72562324380757fa4e4264b27e8d215a4ead60505448e6556096472823 edk2-aarch64-20251114-5.el10_2.2.noarch.rpm 5ebf1586f73cdbb4f6af4b6fac8634e21e96c81337572dd52d11cb6022b477ab ALSA-2026:39302 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups security update

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cups-printerapp-2.4.10-18.el10_2.ppc64le.rpm 6d9e31ef33dd6cfee03341441d801174254b201ba142a948c5e158cb04268feb cups-2.4.10-18.el10_2.ppc64le.rpm 7b66b032d9bf937a1883b6ce3aa51990964e35e4ea494f612d027523afd0451c cups-client-2.4.10-18.el10_2.ppc64le.rpm 7cef7dac1bf8dbecec27feebf25a62096ac5131286aac2dbcb6a08438790a0a8 cups-lpd-2.4.10-18.el10_2.ppc64le.rpm 7f317ee29adcd33d69ce80940c4be85057940b38ab7a1a997ea23022db8cc863 cups-devel-2.4.10-18.el10_2.ppc64le.rpm df89a35a2ed4c3bcba3d3e89d373e5f9cbdf77c8b733f2b577b276535c771c6d cups-ipptool-2.4.10-18.el10_2.ppc64le.rpm f859684d710c7c594697b579fa95af7c7c6b2f52c6cafd2bb60b1092270d5b5c ALSA-2026:39304 Copyright 2026 AlmaLinux OS 0 1 Low

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.2.ppc64le.rpm be1c538c89bfc0e72599115567aca30f2e0f15ae1ab95d11c0f1499cff2d6fc5 ALSA-2026:39494 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: XFS data corruption using reflink () Bug Fix(es) and Enhancement(s): * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.34.1.el10_2.ppc64le.rpm 0881f873004a3880301c013a0034cf73bb47f37e3d06a529adb5a7c19a973f02 python3-perf-6.12.0-211.34.1.el10_2.ppc64le.rpm 6647cadefa622e2660219b9242470b790ee96a2c549dfb254b94dc9e8390913a kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.ppc64le.rpm 6afa04e099e734fad6156fcedac203194bcaf7c8d03be22aeaa00296f551beb6 kernel-headers-6.12.0-211.34.1.el10_2.ppc64le.rpm 7fb78ad31f51876ccd06e78550c7eda0632b62a893289a9249b98c6b069e954b perf-6.12.0-211.34.1.el10_2.ppc64le.rpm e10a710eb9be92e4ceb4af26da8e8f278457098ce2154c879a5fe0b6dd7a74eb kernel-devel-6.12.0-211.34.1.el10_2.ppc64le.rpm e62bb3ad5cb81c837bec8553211803a545997714481273b3b4f7f6df406907f0 rtla-6.12.0-211.34.1.el10_2.ppc64le.rpm ede841177dbc09005c1b0eaf7bb6cabb732d5a3af6de9e4ca719259178086738 rv-6.12.0-211.34.1.el10_2.ppc64le.rpm ee0bac12d82e4467b83125d2c478f165665b962460541186cbfc222a9e91fd61 kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm f70c0c028135ad9c40726ef7b16d8d2b3251fe80614da1fb1532d5c0d7eb97a4 kernel-debug-devel-6.12.0-211.34.1.el10_2.ppc64le.rpm f914fcf75f22edd0f8d30e52930281da4e67cdf35ac31dfc91d80c10ba37a23e ALSA-2026:39547 Copyright 2026 AlmaLinux OS 0 1 Important

perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fix(es): * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-XML-LibXML-2.0210-4.el10_2.1.ppc64le.rpm 9fcaa8b4580b674be2ab2e21f99e49f438734890022bf0a7ea272e3a39efcff6 ALSA-2026:39573 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.ppc64le.rpm 872362f8b5b1d3ee3a47cd2da2b916b8f19d939b31097a11af30b93e6567426e ALSA-2026:39976 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default hplip-3.23.12-10.el10_2.5.ppc64le.rpm 3631a101451b52c9d45561ba8381b9a3bbb77e0c26ece4c1bcd9771199b60161 hplip-libs-3.23.12-10.el10_2.5.ppc64le.rpm 7981440a1be46afb85ada34f814b817c5470e753ea04bd3e9af21684a5d1b31b libsane-hpaio-3.23.12-10.el10_2.5.ppc64le.rpm 7bb38a05119cf7cca58d4bb7ee5016e0379400916bd662131e20f12ac5bb7116 hplip-common-3.23.12-10.el10_2.5.ppc64le.rpm e3cf28ab512a646be9a7e7fd8e7c2ecbee0e941d713fdc84759bf31c9364e3a2 ALSA-2026:40833 Copyright 2026 AlmaLinux OS 0 1 Important

pacemaker security update

The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. Security Fix(es): * pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm 6e3da70c121af183095ce7a58c2b0a382194143758f71b5c897c62fa60a07c53 pacemaker-cluster-libs-3.0.1-5.el10_2.1.ppc64le.rpm 7748cf1ec5a65fe28a8ac3557159133092950351e19eff26e4383b7f192a7877 pacemaker-libs-3.0.1-5.el10_2.1.ppc64le.rpm d7c58190b8a96b317fa3537ad8e9184ed59c9bc00c674df5520b0a67b111da47 ALSA-2026:40856 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-libs-3.14.5-1.el10_2.1.ppc64le.rpm 74939cf80fc00fc6c435ad5e1923e89d9c12edb8d383b1dea08ad43f9db1a296 python3.14-devel-3.14.5-1.el10_2.1.ppc64le.rpm bac002751d03d341c240a281e8c365295caf0a59115e049c26dfa4501aac7bb8 python3.14-3.14.5-1.el10_2.1.ppc64le.rpm bb848b6c8efa46e6748d75856f52f780cf3f699ab21d12d084155e2d36ad0e49 python3.14-tkinter-3.14.5-1.el10_2.1.ppc64le.rpm ea492091bc23ef8e21eb614c73e77fde48e9d722df6df503001a0aed3b4d9c30 ALSA-2026:41892 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security, bug fix, and enhancement update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355) * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) Bug Fix(es) and Enhancement(s): * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libtiff-devel-4.6.0-8.el10_2.4.ppc64le.rpm 0371f2e9da66b221f372baed418a9f912cad92e9eeddf91a6b96c2841a182390 libtiff-4.6.0-8.el10_2.4.ppc64le.rpm 5d32581bea49b1da4ae1a8e4cafa97b4b2164c0cc463acb83ed3d7edfc122fc1 ALSA-2026:41893 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-targeting-pack-8.0-8.0.29-1.el10_2.ppc64le.rpm 12f0e1a1f258ee777372e2fe01ea843ac61ae0764287609b0581ebe99ffc4934 dotnet-hostfxr-8.0-8.0.29-1.el10_2.ppc64le.rpm 16dd24bdbea9a4e3b5aa6a9a62e0ece60b8d31815dde2906803a74305c261ae5 dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.ppc64le.rpm 27fa64eef967e49dcf4f97fb1fccd2465a48446c30e9c75b19cde7ab01359d32 dotnet-runtime-8.0-8.0.29-1.el10_2.ppc64le.rpm 6425ce6925b207000354d1b91734e1d9fd94a83ab259061a23dc4c13b2930fc2 aspnetcore-runtime-8.0-8.0.29-1.el10_2.ppc64le.rpm 8bbd4ac07a96bcc160d9b441243f6b4fefdc9cb8b6cca04e13fc0c4e85b2c703 dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.ppc64le.rpm 8da4415e530a366f8b9e524cb270c4054e4e372ae4248a7568f69e60188e5245 dotnet-sdk-8.0-8.0.129-1.el10_2.ppc64le.rpm 9d65789ea7bcdac1ed178a42af211cdd7311bc59509d36bc8c9d1cda291a592c aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.ppc64le.rpm b05a6f3e4751a54bbf055fa588e90dd35dba1a6d655119a7dd6d1dd760a86447 dotnet-apphost-pack-8.0-8.0.29-1.el10_2.ppc64le.rpm e2e75ed2358b7305acaa4e804c8953cc8712de7b1237917e36de28f976d77f0d aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.ppc64le.rpm eec4709fb806d28512cdb5f31214a39992964bf36b808bf556f8118fac6dbef0 dotnet-templates-8.0-8.0.129-1.el10_2.ppc64le.rpm ffacfec56df8f8eedda1887f48adc1443fc6bd04f9f22c58168bf7e4bc4de1ab ALSA-2026:41895 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-hostfxr-9.0-9.0.18-1.el10_2.ppc64le.rpm 0ca45959645730f8fe1b5b073b0b2d8db715f682bf10b5c2ab6703e33066e10c netstandard-targeting-pack-2.1-9.0.119-1.el10_2.ppc64le.rpm 5e58ec656045fb30927019a5319c5e4c83d9cf52919db36552653bc84ba8c0db dotnet-runtime-9.0-9.0.18-1.el10_2.ppc64le.rpm 748feb033426c5aafca58b6bdf77e62877996f9453e2fa54f062f52ec66e9b5d aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.ppc64le.rpm 79381c98157208094f328c6133cb7cab8839d7efb7949bff5cb3024fd295c0a5 dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.ppc64le.rpm 95bb64b7448a824b5598d173c0bb3a42a288ddbe8d53fd8389e4bd04c6ef64b4 dotnet-apphost-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm a458aa67fbe0bcbab000dca774b3f1594f03240dedf006654273cbae3fc24a77 dotnet-templates-9.0-9.0.119-1.el10_2.ppc64le.rpm b09c7adce494de7e5b1fafcaa07ee47b2ad04e34190ae9e74f8d9b92988d41a9 aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm b46e3da5c04dcfff3dd293826ee51e744d47e82a4dd28a221317e3724a31dd88 dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.ppc64le.rpm cafa639cbfb381c9c2061e739079e41ae6f4d11acd40955f79433d519339fef3 dotnet-sdk-9.0-9.0.119-1.el10_2.ppc64le.rpm cda2ef8ab57c26884588e1668472058f911d03c84391991c7a6b8711d0280a15 aspnetcore-runtime-9.0-9.0.18-1.el10_2.ppc64le.rpm cf948cde5f5f18f2a7e87c493975badc329ce507959926e8f39e22a4772bcef5 dotnet-targeting-pack-9.0-9.0.18-1.el10_2.ppc64le.rpm daf1b6d03af452cd4d641cfae9d24265a7372268bfd43fc3b3850bbbf68af6d2 ALSA-2026:41897 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-targeting-pack-10.0-10.0.10-1.el10_2.ppc64le.rpm 16fa6981cae576331d465c804d21acf02fe9c0a7817f0955026225da877f9a0b dotnet-sdk-10.0-10.0.110-1.el10_2.ppc64le.rpm 19722cc25cc13aa37d25c6dc1c4a77a08edc42d9310a7263c3f6779a572a06c1 dotnet-templates-10.0-10.0.110-1.el10_2.ppc64le.rpm 27783f4a030c3b03fb13cc236435fbdd8dc265735db8226b208bb685adb0427a aspnetcore-runtime-10.0-10.0.10-1.el10_2.ppc64le.rpm 33b99ef8db15b5871d2c5a4a2931ff00fcdc82420db1feb4f228e4e305991403 dotnet-runtime-10.0-10.0.10-1.el10_2.ppc64le.rpm 4b51ab72bfc30220208226eed0c172c30228be013690e2d79b2104014f7f3605 dotnet-apphost-pack-10.0-10.0.10-1.el10_2.ppc64le.rpm 827d2eb957e3d9168bb924e8f783fc9a2f87668aa3504b4394f12d89dcde185a aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.ppc64le.rpm 9a891da9af1005dd123a1d7febf43166184ee12201e44f9e71c91b02c1b295af aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.ppc64le.rpm a0eee78fb701af191c65a9bd17011b47882aed746f7c94a4a33a9772011e34ac dotnet-host-10.0.10-1.el10_2.ppc64le.rpm b5008d9eca21ed87bc392653561bb6eb0ab17e3d6c1ee4a8ff224b3dafe3633e dotnet-hostfxr-10.0-10.0.10-1.el10_2.ppc64le.rpm be925554fe6ea6e7ac58ee6f18ec3596c77d8587ea0279bd7b83be1c21720521 dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.ppc64le.rpm c267e875dd710875f27476481de4ac9879cabe6193efd615fd3923709f7995ee dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.ppc64le.rpm f22b44dd7ace8d463d74ceff755d8649e3b63e698efd1d8c39a267c3aa7e14b9 ALSA-2026:41937 Copyright 2026 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.1.ppc64le.rpm 5c93920a6a1c53d90bbb8747f7d1ba401a6aca3d23a8a9f84a551c402ffbc031 ALSA-2026:41988 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dovecot-2.3.21-19.el10_2.1.ppc64le.rpm 1540914ea650ff12aaf4c8769a543cafc46e53b8965aad71b6e6415c60e870c8 dovecot-mysql-2.3.21-19.el10_2.1.ppc64le.rpm 7c2e9561aa41fdb1a3093858f9d1939f8d332cce45dd164ef87037cbc4b7472b dovecot-pigeonhole-2.3.21-19.el10_2.1.ppc64le.rpm aed222dd13417461ac4f2c4f65a68a76480c6e5ef9c7f2bd8462cf8723c2c5b2 dovecot-pgsql-2.3.21-19.el10_2.1.ppc64le.rpm fb014b3016020548cc29d2d88fd631d87d36f5de5a1e93de269644e8eb3c6cf3 ALSA-2026:42063 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.14.ppc64le.rpm 19d35aef4b6c092db415f0b3310a8841a512a138fd6e5a61798fc41ecfc38bf4 glib2-devel-2.80.4-12.el10_2.14.ppc64le.rpm 2cc6b5ccd4aa7421d9c730ae955233fb2ec57272112e06832da9ac99784cd3be ALSA-2026:42096 Copyright 2026 AlmaLinux OS 0 1 Important

c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default c-ares-devel-1.34.6-2.el10_2.ppc64le.rpm e4754dd3be7a92f2538ec93f3563bae3977f1f6cd8514d734afe923e7358f95f ALSA-2026:42694 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-utils-2.39-128.el10_2.alma.1.ppc64le.rpm 6e4a0b5e7d04162e12fe4818df5a005990461157b02dcb6371f1dbdf91dfd5bc glibc-devel-2.39-128.el10_2.alma.1.ppc64le.rpm 830d988ce700ad063659c6b3aa076a24da673b57bcfdc69fdabef8287c1b1754 glibc-locale-source-2.39-128.el10_2.alma.1.ppc64le.rpm 89f9beaa9b95bc3ae2568bea0a3350dd02720efdf497a0ded60ff91de940d6c2 glibc-doc-2.39-128.el10_2.alma.1.noarch.rpm ec6e77a457ba7f13faf9ac4994f0f83f6fa55864f6690c7cb0495903d28a82f2 ALSA-2026:42739 Copyright 2026 AlmaLinux OS 0 1 Important

acl security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libacl-devel-2.4.0-1.el10_2.ppc64le.rpm f794ec381a44697c3c0305c0e5976f3a8f17e458e2d8ff2a80ffad5a2f09cd70 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default java-21-openjdk-javadoc-zip-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 2d502f7d2cd74f7facf27830d54b41e61654cf4b30dc7bc3aae55bf902b4bc52 java-21-openjdk-static-libs-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 34944fde03b149b54114d9ed72090ae9d383a59aaa60d3e4d5e883fb0ff76137 java-21-openjdk-javadoc-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 373f8c604b939f61bf01ac96c0a03b16a9112eaf204d07fc55da8f8f6d6e82f6 java-21-openjdk-headless-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 414f6acf33b306909d86d277c17af147fd782193756bb9f1c18d07b69beec80c java-21-openjdk-jmods-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 43a302b4ef71912d7a7195ac1cdb2f8e97f6efceecc1ab57045692af42cab88d java-21-openjdk-demo-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 43ca1a1fe7b3ea8a72bd6743453da58d42ec120c1c0988d61ec39d6e129f97fb java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 47796b01136aa1bf97a434714e56a7f38a461e2af6acfd948feb4b6c85e15f22 java-21-openjdk-src-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 6c38324266c4c2a2de4408d73f340c35ef0e8da7b2fcd79603b158af67858b16 java-21-openjdk-devel-21.0.12.0.8-1.2.el10_2.alma.2.ppc64le.rpm 78c9a7fdbc5f5d4281b19ad32cb4c14ca7a9d5d1ad8ac6e9a5582b63ad40f71d ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default java-25-openjdk-javadoc-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 1d38e1fe9902b2d87e874130809541028ae26e39fbed1d38e327b9de7c3a0da0 java-25-openjdk-src-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 21932b4ceeff7153b660506a2bf762f03c57f90f2242073801f5ccf1ad90a62e java-25-openjdk-demo-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 3367840efbd38eb91396b45c854e38c013301338bed75b9e5b4fa37cf88ea7a3 java-25-openjdk-devel-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 4f4f7beb22c21366fc34801731f5aba4784d9a201af9358622c519db38927e6e java-25-openjdk-jmods-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 5227e699d7050bb1b3ca268a32dd036681c1420350e0c67f36aead28a6d6c31a java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 5b82cef83ca82a8317439b14b22bb117780c79116f2ccc887491f5d33537ee3c java-25-openjdk-crypto-adapter-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm 6abfed0e47f7d143544b20546ea6aa7efdcba9ec9840833971a97604d3906e18 java-25-openjdk-static-libs-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm bb4a9d5feb46f5ba134bcc2c94ad22f6d475a527576799c8b51c5dfa23786ab1 java-25-openjdk-javadoc-zip-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm de0097192c21b9db93b7193b53e860f337e8632a144c28e818d63274dac0e96d java-25-openjdk-headless-25.0.4.0.7-1.1.el10_2.alma.1.ppc64le.rpm ec557dd696240125ff706c64c98fd9fb23ec07fede6a365a0ee542596333a383 ALSA-2026:42919 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103) * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975) * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311) * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rv-6.12.0-211.37.1.el10_2.ppc64le.rpm 08ae03d949ebe9d78e83554d1c5fb5870321cf9f3aaa87872df470047e6c86cc kernel-devel-6.12.0-211.37.1.el10_2.ppc64le.rpm 324908f5fd4043c8141d1137d43c9bb4eda9d0570d5310915e0e33cdad86191e kernel-doc-6.12.0-211.37.1.el10_2.noarch.rpm 87d31242d05551914e981aae0b0f4d898f16e6999a0326758830d5c4a4582d3f kernel-headers-6.12.0-211.37.1.el10_2.ppc64le.rpm 9cf1b328c139f608400184b92c592283575644d95cf2bcfa82b93531bb35c6ab python3-perf-6.12.0-211.37.1.el10_2.ppc64le.rpm a47c056d29fe57b5a4d2411265246ca4975dd66f0f18bd0520a1b7e5038a2f1d kernel-debug-devel-6.12.0-211.37.1.el10_2.ppc64le.rpm ac32ebcc78fb64f6b07e74d1c5cd751c6c2a219d8c40dfb5436b5cae8af5300b rtla-6.12.0-211.37.1.el10_2.ppc64le.rpm b234e0035e38a4a13214af060d165a9a2ed3e29a7800a602d3353be1a5fd74d1 perf-6.12.0-211.37.1.el10_2.ppc64le.rpm c7c1a62e131101860668f48585493c94053be4886db9e1acb47830f5375b23af kernel-devel-matched-6.12.0-211.37.1.el10_2.ppc64le.rpm eb2848cf3ec439f56b120969ea5d25cfacdf86d2679f87ad0d3b406e5fa5d69a kernel-debug-devel-matched-6.12.0-211.37.1.el10_2.ppc64le.rpm eedef3003297ac1d57666115ca53e3f022862f3784c5b2cd1e873a811085557b ALSA-2026:43400 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default idm-pki-kra-11.9.0-4.el10_2.alma.1.noarch.rpm 0969cdaf908804a41b9168709166a69e8aa7ae8fcc2e747357080f04a1172f5e idm-pki-ca-11.9.0-4.el10_2.alma.1.noarch.rpm 0b735f0dd0d261caa3582e67de71f6261dbab4015274cff710fc04879b00b9e9 idm-pki-java-11.9.0-4.el10_2.alma.1.noarch.rpm 19db97d8c3e96b064b9b644b115703383e1a284592656856fb4c10b17f0ff783 idm-pki-base-11.9.0-4.el10_2.alma.1.noarch.rpm 2078148c1821766f42e07686376b4f47372e0d8d1f28117d64c14ecfa9c35ec2 idm-pki-acme-11.9.0-4.el10_2.alma.1.noarch.rpm 65f47e5c5837435369b77d7a6e0414cfd4e2ab76ac728e69b36043659fdf4ae8 python3-idm-pki-11.9.0-4.el10_2.alma.1.noarch.rpm 6e8938d303bc048889247d06f240b4f4e4629de2d3a8d8d05230791ef281e8a6 idm-pki-tools-11.9.0-4.el10_2.alma.1.ppc64le.rpm 79a7241fec2ccce7e2c0a1db385ad0eccae5fdf262974d2eb5285e3f7cbd8a18 idm-pki-server-11.9.0-4.el10_2.alma.1.noarch.rpm b82532ebd593f44ece5bc792082777393864e54da71878f86dc5d3f9abd9a78a ALSA-2026:43505 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mariadb-connector-c-devel-3.4.4-2.el10_2.ppc64le.rpm c84ee403713b599418a8c24e7ab6e2486a2652f18a76d615173b2045846f4e31 ALSA-2026:44270 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.38.1.el10_2.ppc64le.rpm 0eac9a2e1ebfe91f644193b2224f2f6aae6cd876b1214ede0a503bc9ae5fcebf python3-perf-6.12.0-211.38.1.el10_2.ppc64le.rpm 33726877321702e54ddef1ec16cbec8f56a34b5ad9e1063d06174558ef8c8624 kernel-devel-matched-6.12.0-211.38.1.el10_2.ppc64le.rpm 35afa7c8da5ad22dec4ffff464b2578162e953a6fa27afaa2a387e08a9af1353 rv-6.12.0-211.38.1.el10_2.ppc64le.rpm 45ee028fabb404af9805eb70af0979418d23307394f7f9fd57d07a34b1579395 kernel-doc-6.12.0-211.38.1.el10_2.noarch.rpm 4a069b5675e58961c90a55b7563fc8b4cdfeb44341f929a948dd293d00bbc4cb perf-6.12.0-211.38.1.el10_2.ppc64le.rpm 6ffe00efa8429d0f358acc1ca80fb855ff7dc67734ceacb541cd821771e2df28 kernel-devel-6.12.0-211.38.1.el10_2.ppc64le.rpm 73e31ad9453ff6df6c841601c74c1e28e2d448ec1c715a03d6361fb8b1ac91ad kernel-debug-devel-matched-6.12.0-211.38.1.el10_2.ppc64le.rpm 751073bd0d4e7017dc3bb45d5093fa64fe98472ed197d9a00ed6b69df6b0b87e kernel-headers-6.12.0-211.38.1.el10_2.ppc64le.rpm 8512efe8b57990bb112968291b75dec529481a425cf7c394714d84f38ba87984 rtla-6.12.0-211.38.1.el10_2.ppc64le.rpm b49a66a3d9febb0ea72e555ab2e36cd12052e5736ec2dc1e1671058dbe100930 ALSA-2026:44391 Copyright 2026 AlmaLinux OS 0 1 Important

libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libpq-devel-16.14-1.el10_2.ppc64le.rpm 61abf53941ba35f0af34956efe532b80f223c028c00aad7a1e5aeb4980e02dba ALSA-2026:45114 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.39.1.el10_2.ppc64le.rpm 0f4e87cd206fe97b3d95efc292d3c6ad7b36eed2eb96c53819f96af6d982b04a rtla-6.12.0-211.39.1.el10_2.ppc64le.rpm 6978bc44f367e7ff9940f8364ca06cd570db06965490083bdffebd91fb05d26f kernel-headers-6.12.0-211.39.1.el10_2.ppc64le.rpm 702ca0fe491c0cb4baf73e86996ce322b4a5be0d2c982113c5795cf1c0d01560 kernel-debug-devel-6.12.0-211.39.1.el10_2.ppc64le.rpm 71e3f69f8bafb942ec87033a07e161cf38b669d274ab650be2056970daf2ba74 kernel-devel-6.12.0-211.39.1.el10_2.ppc64le.rpm 7ac34818234cf53391a526e8dbda2ac8a10ff98143a0c54eae48b2b36deffcb8 rv-6.12.0-211.39.1.el10_2.ppc64le.rpm 8b646081e7ee758b399297be88827de485e891b62860db6747ab48176ae7da29 python3-perf-6.12.0-211.39.1.el10_2.ppc64le.rpm 8bc44ce2800353b28d56eff57b844d1a68f73683b80238a97dd7d50cf6e6e332 perf-6.12.0-211.39.1.el10_2.ppc64le.rpm 8ed760b105768920b3ed413ea97be2aab53130b6742997d212cb8f288d42daf0 kernel-debug-devel-matched-6.12.0-211.39.1.el10_2.ppc64le.rpm 94d388dd5ceebb201b2191a13e5d298ad16f99ccfd71f69cc68e874fed86cf77 kernel-doc-6.12.0-211.39.1.el10_2.noarch.rpm bed818f0799b768ff6cfc2f657938405ca4fdd836ecda0511057e50c36a60fb4 ALSA-2026:46395 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default go-fdo-server-owner-1.0.1-2.el10_2.3.noarch.rpm 8a1f12fb60dd6f709e8d044b6d020d14de7e6afbde8dda5848544a5e669cff85 go-fdo-server-rendezvous-1.0.1-2.el10_2.3.noarch.rpm caf1db0da6a4940dc368733c9e45509fe9a782dd4331421e6ca8bcf1a5779321 go-fdo-server-manufacturer-1.0.1-2.el10_2.3.noarch.rpm cb7c2a74215550a5f2ce3d4355be09b754b0e502285caecb7e0f536ef2a0011f ALSA-2026:46398 Copyright 2026 AlmaLinux OS 0 1 Important

libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libreswan-minimal-5.3.2-1.el10_2.ppc64le.rpm 7633e8f752e0916a0a218f637f50d91e12aa95588cea9ccc480ccafa4b6bc755 libreswan-5.3.2-1.el10_2.ppc64le.rpm 9150010934d74f01ab23c3cbeca42f554d757a9d1d4747d715e9d43432505867 ALSA-2026:47017 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) Bug Fix(es) and Enhancement(s): * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-perf-6.12.0-211.40.1.el10_2.ppc64le.rpm 36c33aec6e7646a79f9b7b9243e0c1c385aff7d5cfd76c95188a36e4b4ca54d7 kernel-doc-6.12.0-211.40.1.el10_2.noarch.rpm 3f33284f7c4ea3f56149f8190f4db9d0acabacfef1186c7aa7ad46d25395aa49 kernel-devel-matched-6.12.0-211.40.1.el10_2.ppc64le.rpm 48960078fa46b8ffbccb1179c43059ab966ca71eb74ea343e43574d6a79499d2 rtla-6.12.0-211.40.1.el10_2.ppc64le.rpm 535d75edc8cce54e48fc0db19afe193592080c636b284acd14a4cb321f14fe12 kernel-devel-6.12.0-211.40.1.el10_2.ppc64le.rpm 7fce169094caf86b38d5b0c48239f81416cb16ec716d5833f58e9ebcb2019e77 kernel-headers-6.12.0-211.40.1.el10_2.ppc64le.rpm a5e96ae9167414b79c297df025ee54bafcc830c419fd398370227add9fd7c2ce kernel-debug-devel-6.12.0-211.40.1.el10_2.ppc64le.rpm b6b0658c4bb8851ca3216b03aa27cf4cc6453653319f850f82c284af4110221b perf-6.12.0-211.40.1.el10_2.ppc64le.rpm c47ac69c869876d79c689127e560657f1534a38075681ec82aa88095517eccc9 rv-6.12.0-211.40.1.el10_2.ppc64le.rpm d4a39e3bec1d5c3a1a7199c0cb1419e84ebd292d0707f12c8c411466afca50b8 kernel-debug-devel-matched-6.12.0-211.40.1.el10_2.ppc64le.rpm eecc54eab10810db54c4af1222aed2b06f575b105f052143b6cf6746244144e4 ALSA-2026:47079 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.1.ppc64le.rpm f36f0db39056df447211f4509710e91a5442cccc2e735ec56cb39a76e9752516 ALSA-2026:47083 Copyright 2026 AlmaLinux OS 0 1 Important

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pipewire-alsa-1.4.11-1.el10_2.ppc64le.rpm 1655dff847304010954f2622413f431491a11e391aa0fc652ab005a114bacd86 pipewire-pulseaudio-1.4.11-1.el10_2.ppc64le.rpm 2aadbc0e9fbcc80e988b0895dd3f25f73e55a79beae4386ef7f13ab567c66fcf pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.ppc64le.rpm 2d20f87cc17c7aed17ec2ffad6541a38596609fd1b1318cacbe5b27d663e0732 pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.ppc64le.rpm 43a09decec930ec583f47078332847f9ea650c4f15e50ff4d64af5358f322fb2 pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.ppc64le.rpm 8ee146d5d1861af800707d449ec516c3cf3d1ebf49c7376b4e37788da0cbde79 pipewire-libs-1.4.11-1.el10_2.ppc64le.rpm 9902df606325eb1f79e1c39ab3d625c18d06bf63a3c8478530302b9934ef3678 pipewire-utils-1.4.11-1.el10_2.ppc64le.rpm 9ff723b805106ff3c3804ce783766f95c71a785495f8ce4f2e7c4b1ecbb09325 pipewire-gstreamer-1.4.11-1.el10_2.ppc64le.rpm abf8823b83e946df231ff163c3574062e6c59c411743b0f125922c6644c7e7b3 pipewire-module-x11-1.4.11-1.el10_2.ppc64le.rpm b29bbdc725295fa164f101956b56c26d460d4af56d9f562b644eda62142a02e3 pipewire-devel-1.4.11-1.el10_2.ppc64le.rpm bcc738c52b949893d946d580537c2bded98a1ed977c9c492ffeb04f640c20eb5 pipewire-1.4.11-1.el10_2.ppc64le.rpm e031bc60893c68a396bcf855885dc748b672cffd5bf664775860053aff0bd531 ALSA-2026:47085 Copyright 2026 AlmaLinux OS 0 1 Important

rest security update

The rest packages provide a library for access to the RESTful web services. Security Fix(es): * librest: weak random number generation in PKCE implementation (CVE-2026-16615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rest-0.9.1-11.el10_2.1.ppc64le.rpm 494cfbb0b83dab7489d09f18ddbbee1b62272a3e2570b6c3c1f8954c12a9a526 ALSA-2026:47101 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.13.0-1.el10_2.ppc64le.rpm 5e832f4d029c6cf379ed715c894dd00d4fbcf4bb097d72133ca446af73c0b6f7 ALSA-2026:47180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.ppc64le.rpm b411d62f613a05fba20c3b1062c1b20b4e9f0c548e6cd65ec57bdd68a9cecd83 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.6.ppc64le.rpm bd3dc9d8dbe8343c5039ca117c5e45b59e259fa08cf3d92a7e7157f999d5b03f ALSA-2026:47757 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655) * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssh-keysign-9.9p1-25.el10_2.alma.1.ppc64le.rpm b982b3e9dc94596583882d478b2eb4343353bc23532947b04b7087c38f18ea22 openssh-askpass-9.9p1-25.el10_2.alma.1.ppc64le.rpm e4e12716bfaa0348d2ad6a151a81d2e24336c9fb4c4c8c68a41c2fe30f32a51d ALSA-2026:48032 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm bbd3e0be33345b40f7140ed617b9d6ac035fa7d714eef964005b4f634524f37c ALSA-2026:48033 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-docs-22.23.1-4.el10_2.noarch.rpm 4a83c12224f35412b6625e9741ade14adf2898f3deb3cc76c129e06984205bf2 nodejs-22.23.1-4.el10_2.ppc64le.rpm 657305d71927e4f56129ad52ae7f0de70854f9d9695b8fc4ce1a51155f33a26c nodejs-libs-22.23.1-4.el10_2.ppc64le.rpm 71ac9b072f92115478875a37f6df7b456ccea61a84ea8ed16ace597303463a67 nodejs-devel-22.23.1-4.el10_2.ppc64le.rpm 93f95481d4db7cfae629ef1ed7773a40a1a783615d098cbbdf34b486afba7cf0 nodejs-full-i18n-22.23.1-4.el10_2.ppc64le.rpm aae046b579c73185fe61f2443fa7cbd2a3d34be3bf202bd6f3d6f113d2a19709 nodejs-npm-10.9.8-1.22.23.1.4.el10_2.ppc64le.rpm f1d380e9a4320e450a6e251a2f789b06c525c50b2d024809a072268b75f218c0 ALSA-2026:48034 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs24-libs-24.18.0-3.el10_2.ppc64le.rpm 46a7c0d1c47800febfc78d5adee695a6ecb579840ad84243918e97b3c4be9b79 nodejs24-full-i18n-24.18.0-3.el10_2.ppc64le.rpm 6b7cb5833d0929f3f2642b3e2835a32dc2cae5cfdf7bad1b98dacf4c2f1cb9f2 nodejs24-24.18.0-3.el10_2.ppc64le.rpm 83af59b823f132af71636949a754ffd70036f9c5f3dc5e45d72f9929a9804b96 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm 89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745 nodejs24-devel-24.18.0-3.el10_2.ppc64le.rpm d4fa388133c7ab56adfdbda0f109fdc9e3a99564b1e6605361af57acb60ba787 ALSA-2026:48170 Copyright 2026 AlmaLinux OS 0 1 Low

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php-fpm-8.3.32-1.el10_2.ppc64le.rpm 040d6cd708944b0e20be1dbe5247f3a07bb31e3df48546fbda3fb1ed9fa2a584 php-embedded-8.3.32-1.el10_2.ppc64le.rpm 04bd1f17b288634e271e83a11bca3c79768088a61fa0738ae75d19df888ef8fc php-process-8.3.32-1.el10_2.ppc64le.rpm 08cd04209e90c8b5cb4d9ce1297cec014556d47d833bcedd2c21078834176d40 php-dba-8.3.32-1.el10_2.ppc64le.rpm 1a58165d57378550072dcb65ceb829de42d54c386014d8dc117c5a864f003359 php-common-8.3.32-1.el10_2.ppc64le.rpm 2a08d9617348df336d0a8987325fb39485cf061ea094b41b93630f9c5875df60 php-cli-8.3.32-1.el10_2.ppc64le.rpm 2b5b04a9486ed9fdc141ab1bb09cb89189f5d1bc4c658f1c65b7a22bd7f0fc09 php-soap-8.3.32-1.el10_2.ppc64le.rpm 2c8a6f32dd8b2059ebb60cbb73c16fb791c5a12338d7ffab698d794a3a0a4eee php-enchant-8.3.32-1.el10_2.ppc64le.rpm 2f7aa21a563c31e4863995a94b203323734c81d044651b719297ebbd48ad43fb php-dbg-8.3.32-1.el10_2.ppc64le.rpm 31f65e217b1d35d6da9dba6ce7ba3699fa322edb7930b2b16740dcf027e841c8 php-ldap-8.3.32-1.el10_2.ppc64le.rpm 3a6d9e06863b1e94f95ccfa3cc8971e4ea5c5495b4d9f57a43d0aa1180e0c978 php-8.3.32-1.el10_2.ppc64le.rpm 4db2ebcb3dddb8d40447842497c277f381209eb5f0b942caa7b958251eb6a764 php-xml-8.3.32-1.el10_2.ppc64le.rpm 56515f45e9baaf92a959422134aee99b14cd818b779aac1fe3c20198ff26afe5 php-ffi-8.3.32-1.el10_2.ppc64le.rpm 6507162b9b7c4d402898858b03ab8c30ea90eb2a754449066525707a9b999c6a php-opcache-8.3.32-1.el10_2.ppc64le.rpm 66574d3fe451a0b36fca31d49cfcc5677f38fe4a30e23ac8336cdda96f6bb60e php-pdo-8.3.32-1.el10_2.ppc64le.rpm 710831aa07f4c4641189911b191a8d9eb05fdb2b2fb2f337975807884388e96b php-intl-8.3.32-1.el10_2.ppc64le.rpm 72489feddbbc2e44a75def5876b15278f482e19ee6fb81e4fd30a82b88c09e73 php-devel-8.3.32-1.el10_2.ppc64le.rpm 777377bd8c54765ff9d5a838cba0db45e92d299fb990b47a771f385e0a5690dd php-mbstring-8.3.32-1.el10_2.ppc64le.rpm 80ee608753b606ba85b25d6d3d40c5ea9f507060b908dfe755e29615d07fc9bf php-odbc-8.3.32-1.el10_2.ppc64le.rpm 8fa990a31c5081a957d984652a172b537e8d0625585fea4aec8e35acad5edd31 php-pgsql-8.3.32-1.el10_2.ppc64le.rpm a05615921feda0a1c0d45e616af3820d6d8145dc5ca3298d9a0c8560701c44db php-snmp-8.3.32-1.el10_2.ppc64le.rpm af9638085f01e2f951a08ce1858d342082619b2bb9112076f632b1d5f83998f8 php-bcmath-8.3.32-1.el10_2.ppc64le.rpm afa13252808c51e20e44a4920458312f57a437b7528222faf323882afca891ef php-gmp-8.3.32-1.el10_2.ppc64le.rpm c12acbccd453a51b7b935aae05bb644282e5d6f60a0fa57ff8fe131a0247074e php-mysqlnd-8.3.32-1.el10_2.ppc64le.rpm e7a6307687dc6d9ca2bd05c685dc5a3820bde216c9ec295f4cebb3af960b28ac php-gd-8.3.32-1.el10_2.ppc64le.rpm f23955c6c6cfcca0aa6b37478045c06c37c4e2c9f4bf22405b9d655c1e0d9ebc ALSA-2026:48585 Copyright 2026 AlmaLinux OS 0 1 Important

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default fence-agents-scsi-4.16.0-21.el10_2.5.noarch.rpm 02a9562b78a8a24d7e333970efbc532e24161062499846a84fe75f07c16df2e2 fence-agents-cisco-mds-4.16.0-21.el10_2.5.noarch.rpm 0585c3e9f38920e515019f74ebdb69e2987cda9c3fc8f55553b0d5b46a04667e fence-agents-ifmib-4.16.0-21.el10_2.5.noarch.rpm 079ef24bb4d641ff4713ab43de2a354ad8dc7350f764f31380313fb52bb8e396 fence-agents-eaton-snmp-4.16.0-21.el10_2.5.noarch.rpm 089facbd88cf4480c948daef5080d8a4e863f876af741e894953a052c18472f1 fence-agents-apc-snmp-4.16.0-21.el10_2.5.noarch.rpm 0ed42a2237e32de2ee788e8d1ce0205de2e3e3668fe8621b0454862360f4cae9 fence-agents-virsh-4.16.0-21.el10_2.5.noarch.rpm 0fbe596f99db8f892c67c85f7cca46ccd883667a63ee6aa5c0a06fc771d1546a fence-agents-rsa-4.16.0-21.el10_2.5.noarch.rpm 1af89745129e72d3cf10835d0b18dc20f4fbb3c87def696fa64d2677f26078eb fence-agents-rsb-4.16.0-21.el10_2.5.noarch.rpm 205874c6618128431f134d578571738ee9368d524e16f9991bf507a48a1fc4af fence-agents-wti-4.16.0-21.el10_2.5.noarch.rpm 2ac50c4183e12154477c90ad233354a1b426ce6ada8318cd9ff1c95783d0a6e9 fence-agents-ilo-moonshot-4.16.0-21.el10_2.5.noarch.rpm 33a6033ef28cbf57fe6ae177ba899bee9efa2586458cfc9f4b17d8816f4852e9 fence-agents-sbd-4.16.0-21.el10_2.5.noarch.rpm 393ba16d2124e745058334be1a9ea19466f1ea2ed79be749f9534c0eb2eae3a0 fence-agents-ilo-ssh-4.16.0-21.el10_2.5.noarch.rpm 3b06b3b6370f1542f6c561b830148802a761f1a54cced27f5b897bc72bbf000c fence-agents-bladecenter-4.16.0-21.el10_2.5.noarch.rpm 43be7813f12ea8487c7144e058efdca667f8ee63e3b8fb3688b1ee768242c4db fence-agents-kubevirt-4.16.0-21.el10_2.5.ppc64le.rpm 4d0bc507d334eaf468467ae7e11e926946c8a70d4f29e1b288574e66ca47365c fence-agents-amt-ws-4.16.0-21.el10_2.5.noarch.rpm 4f4f9455dc2124c09068d3955018c52d59c5e5787e20c74b56664df7585682b8 fence-agents-brocade-4.16.0-21.el10_2.5.noarch.rpm 512d3a91950b1d4aba9d521f1b1298cb5281a94cc741007163fdefa3ff9c6d6b fence-agents-common-4.16.0-21.el10_2.5.ppc64le.rpm 52f7bc5b3f72d161f7850bb1beb9256e465b5678c0fce9db66f94abd3e49549e fence-agents-mpath-4.16.0-21.el10_2.5.noarch.rpm 63316b6226135353f691c6e8611077a5d55c61e96e1bbd2f0feae1ef1156055f fence-agents-eps-4.16.0-21.el10_2.5.noarch.rpm 70805cb3186ce3b83c61dd6a92392e10e2269d97bb12901831a705caa2e13e67 fence-agents-ibm-powervs-4.16.0-21.el10_2.5.noarch.rpm 769c27a5bdf674e7ae7d3e284ca2ef59c325032952f687138b4de3eb49bbf684 fence-agents-ibmblade-4.16.0-21.el10_2.5.noarch.rpm 7d422de49cf099ef097c46e463774d835a7a6341739f62bf21f362bf0369b424 fence-agents-hpblade-4.16.0-21.el10_2.5.noarch.rpm 89fef3d43f7585019392d0dc5d961f1c4648edbad79329024e184b6e229a1f31 fence-agents-kdump-4.16.0-21.el10_2.5.ppc64le.rpm 8ba9c4d20500412d42579c380862db37023e580e983b7133b1f631dae331c158 fence-agents-lpar-4.16.0-21.el10_2.5.noarch.rpm 91ae58cf021e245e1a1bf1024c70c1f559915400b560633a3068c117a652dbec fence-agents-cisco-ucs-4.16.0-21.el10_2.5.noarch.rpm 9380d9758dfd4d1453e71e86b6de038363038a4d33fa19c298d368038b30f2cd fence-agents-vmware-soap-4.16.0-21.el10_2.5.noarch.rpm 998f6222b512104dd6ebeef7539b27e306dc5fcfa10ff8331e8975e680821aff fence-agents-heuristics-ping-4.16.0-21.el10_2.5.noarch.rpm 9a5a0dc003e77f5a9ea108f92a622c5d6976e36a844c4b748e069257b31f1021 fence-agents-openstack-4.16.0-21.el10_2.5.ppc64le.rpm a05fc43d3e328d510ed33fc577f9148dea9cfacae42a94fcbac8147995ab3abc fence-agents-intelmodular-4.16.0-21.el10_2.5.noarch.rpm af75659dc64c53a891fd4636e3b0602ad519684579d5271ea03c01a7caa278b2 fence-agents-emerson-4.16.0-21.el10_2.5.noarch.rpm b3ba20e516f6f7d2812656bf61775f98e42e342544de7b9ed01aa80028d7e454 fence-agents-vmware-rest-4.16.0-21.el10_2.5.noarch.rpm bc1b3776aff2e7d3bbe29a17599074c9bf396e5e1b77fe5ab1defede6847358b fence-agents-apc-4.16.0-21.el10_2.5.noarch.rpm bec0c532edc9657fca3d85daa3a0597c46af622904928c2339a37f0adf7ed7ce fence-agents-nutanix-ahv-4.16.0-21.el10_2.5.noarch.rpm c009350e071848c015df98437c80cab01c9ca98f0801415e0e5a445ee998c502 fence-agents-rhevm-4.16.0-21.el10_2.5.noarch.rpm c41641cbe4507b116bd310318f52a3d80536a50089c6df7dca2a11a7a759457c fence-agents-all-4.16.0-21.el10_2.5.ppc64le.rpm c5dc11eff065f14a5306ad07fc1c5eca5f3433c4cd9bc608b56b2cb49d5919ad fence-agents-drac5-4.16.0-21.el10_2.5.noarch.rpm c72dc94ebe3471be09580a457d1e65fd832107047626548b5bfb15a04b9060dc fence-agents-ipmilan-4.16.0-21.el10_2.5.noarch.rpm cc3c20cef2b889d5204bd8db41430e7e4147d375fba2c598f1d7f4ae9a00fd26 fence-agents-redfish-4.16.0-21.el10_2.5.ppc64le.rpm e4e76eaf1cc7019546031068ac8f71dadf45555dbfb29b441d76e72f3251b925 fence-agents-ilo2-4.16.0-21.el10_2.5.noarch.rpm eb84f77d4c349914d249a21e99b260421c5f9152deb8ab4f6aefcad2c4b71e68 fence-agents-ilo-mp-4.16.0-21.el10_2.5.noarch.rpm eeb9b2bc6cde8b87c3ec4e65ba4ab628d789e89f6bb675f9de06ddff240c830a fence-agents-ibm-vpc-4.16.0-21.el10_2.5.noarch.rpm f902c8e652433f804325f4d993ebdaaa7d96b4806e8da803c04d74fd44eb47e5 fence-agents-ipdu-4.16.0-21.el10_2.5.noarch.rpm fc9de80e97011d49b8861f131eb3794c92c566c1c4502d917365892d71a8bb61 ALSA-2026:48650 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455) * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456) * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693) * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856) * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.12.ppc64le.rpm 3b55444f22fbdd7bfa85d343e4c3e36e8b3119acad8ef2cac77b7760a7d07d04 vim-common-9.1.083-9.el10_2.12.ppc64le.rpm a2f870e5cf645586d6dfdf9af082f03be9d5cfdce66cb9c9bec8dd9be3a1a3f1 vim-enhanced-9.1.083-9.el10_2.12.ppc64le.rpm c00ae20048e2d369692fec674cb4917b586f9c78e47a7ae2db07df6c3502c172 vim-X11-9.1.083-9.el10_2.12.ppc64le.rpm d4ac03aee13eb065fcc4e110c6e07e7e3c413709d56cf290ab911c399f56d250 ALSA-2026:49211 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () Bug Fix(es) and Enhancement(s): * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-matched-6.12.0-211.42.1.el10_2.ppc64le.rpm 05c5a4096ca2aeaf9f40350fb98721b5a15e6dbc5d044be77d50343621cc0890 kernel-debug-devel-matched-6.12.0-211.42.1.el10_2.ppc64le.rpm 06bc22eaea77118eb478d674d378aa79cf0efa227d1b3788a7eb003317748cec rv-6.12.0-211.42.1.el10_2.ppc64le.rpm 0f3af2937b4c55eebed78a83552c2f1b6c4edfbd94f240605771f5886c3537d5 kernel-debug-devel-6.12.0-211.42.1.el10_2.ppc64le.rpm 1497982a7499b43cdc240b8fe4a9e1a03e872366f319d5b3b3a28d99b2a5b43e rtla-6.12.0-211.42.1.el10_2.ppc64le.rpm 1c69ffde754b865f545e3d6681c6f3ac25b5409d4a889650447a29cb3537d6d7 python3-perf-6.12.0-211.42.1.el10_2.ppc64le.rpm 29b8b6d980479b4ac053439311a832b5380e3d3e98001e38e8ea1ea3387e8909 perf-6.12.0-211.42.1.el10_2.ppc64le.rpm 3587345835839858e86d2ac79c8226a8e82569594085cb107e827a8e352aaf12 kernel-headers-6.12.0-211.42.1.el10_2.ppc64le.rpm 43b47d377c376d9cfa98dc3bab364bdc671ea5cab5f0b9570ee80955b7b382a2 kernel-devel-6.12.0-211.42.1.el10_2.ppc64le.rpm a13a0542bb678c557efbc587e866ad4774a2dff3b2fd6e91627ffb38b717cd62 kernel-doc-6.12.0-211.42.1.el10_2.noarch.rpm bf419056c1f25a425baf0071c6b140681f7a5be5fb6970d09bdaddba8a9d6353 ALSA-2026:49508 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via stack-based buffer overflow in qtdemux (CVE-2026-5056) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.2.ppc64le.rpm 46782d1e7ccad669cf24a87497afe927bd03a41bf30aa1c332ad0571a3d3e3f2 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.2.ppc64le.rpm e15aa91e2cf7ad391757ae70981ef9960e8f55b4f7336e0db81270b08c480c7e ALSA-2026:49514 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.3.ppc64le.rpm 1f19afa9b97726e6065b28eaf7cbb148e9e91065ddd2f523d7bd472cee52dd01 ALSA-2026:49523 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-Archive-Tar-3.02-512.el10_2.2.noarch.rpm d2c6df33777b5bff8ce63f4a073d414a7c9afac6e1da152d7b5a41393951e548 ALSA-2026:49526 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default osbuild-composer-worker-165.1-3.el10_2.1.alma.3.ppc64le.rpm 82366de598e52cb32e85587a80fe2bda6b3e6f63020ef763989e14cb2416144f osbuild-composer-165.1-3.el10_2.1.alma.3.ppc64le.rpm 91ef09a5a6edd3c4ea93f605e1c33496f57d19addc5298ddfd4fb6e410c3f9f9 osbuild-composer-core-165.1-3.el10_2.1.alma.3.ppc64le.rpm caf9cf82f26b40c0d0abe401bd9f13a4fdee3111d3921ccf5f17292d1713ba17 ALSA-2026:49621 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.13.0-1.el10_2.alma.1.ppc64le.rpm 272f4585da3ddeec1e6698cbf1bc2287b23c1c2f01f7ec903b93178f51287bcd ALSA-2026:49668 Copyright 2026 AlmaLinux OS 0 1 Moderate

p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files. Security Fix(es): * p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default p11-kit-devel-0.26.4-1.el10_2.ppc64le.rpm 37cf4585078d736d9b1cf0cbf60575f01b994a0a55402a18eb6bf770838514be p11-kit-server-0.26.4-1.el10_2.ppc64le.rpm 540f90d21e49bb0e06c5ea038ea81097aaf785c785b9ca3700af91f8875aa248 ALSA-2026:49836 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ldns-1.8.3-18.el10_2.1.ppc64le.rpm 34e56634f4be42bfea74d820cac081469e09c95b21fd0277eaf296a2197ec543 ALSA-2026:49871 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199) Bug Fix(es) and Enhancement(s): * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832) * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266) * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011) * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.43.1.el10_2.ppc64le.rpm 197b9ccab61c38f1435099a29b408961d5a62795596e150d143d04e03ecf8c6c kernel-doc-6.12.0-211.43.1.el10_2.noarch.rpm 1c74553d75296b52e5083e8873de03e04a8574cf085839e5ac3f4e2003a287ca kernel-devel-6.12.0-211.43.1.el10_2.ppc64le.rpm 1eb759de29b932f76118afacd587dddb1a1407d2156e8e3c03ac8191c616a8f9 rtla-6.12.0-211.43.1.el10_2.ppc64le.rpm 3072513322e91b8e60f5c79b560f2b5714bbb06a070961f4fdf320a5953bcfbc rv-6.12.0-211.43.1.el10_2.ppc64le.rpm 4b85adb52426ea1b56a0a72df50cf3f70ccc75601c7c568c3d8e8f98e905ccd4 kernel-debug-devel-matched-6.12.0-211.43.1.el10_2.ppc64le.rpm 5cd1c079e0ac9877f871257626c8e3dea3b86542c4547a1314c36e4f57f19fb8 perf-6.12.0-211.43.1.el10_2.ppc64le.rpm 899e23de41588657de87dbb7368b053d424d096943ba34b2c515ae97c6376429 kernel-devel-matched-6.12.0-211.43.1.el10_2.ppc64le.rpm a8a8bba0830b926c6a1d3e05dda38676e53bd5b7febdf0dd3eb937c62dcfffd1 python3-perf-6.12.0-211.43.1.el10_2.ppc64le.rpm be647d562f53d9524b659ba29e150482d1224b9f1253644150b3b957f5b594a3 kernel-headers-6.12.0-211.43.1.el10_2.ppc64le.rpm ce139d1b8b9973ad7ffdc43c5edb5f601a7020d3fe13d900cde150bfdc9304fc ALSA-2026:49914 Copyright 2026 AlmaLinux OS 0 1 Low

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php8.4-embedded-8.4.23-1.el10_2.ppc64le.rpm 0f5236f103d8be09f95a05564236cc0f0ece644b9c4e0d4f17be495884b3df31 php8.4-dba-8.4.23-1.el10_2.ppc64le.rpm 1712f9fad8de3ba6e81d7f7a4bfa1de524f0dc13abb7719aa0b5007afb1599d4 php8.4-devel-8.4.23-1.el10_2.ppc64le.rpm 183bbbed65e314c11ae8321573c5f4abd05b217524e868bb0c28abd5330d1e0a php8.4-intl-8.4.23-1.el10_2.ppc64le.rpm 18d0b01371e70af55694c658919053cc66e580c77b97bea5fe7afb04f2f0cd4f php8.4-pgsql-8.4.23-1.el10_2.ppc64le.rpm 1b348b2f8aadcc7a953316c29673a0bc86a8cef1b5cf08be14aa00f95fb2d67d php8.4-fpm-8.4.23-1.el10_2.ppc64le.rpm 200d04c9e0396f00b2483530a364364f4038ef6b6a8fcdc136c6d8318f1b2a5a php8.4-opcache-8.4.23-1.el10_2.ppc64le.rpm 217ce6665984fc569779e636a7ef5288307cda797165d64a6aca81761dc54ee6 php8.4-gd-8.4.23-1.el10_2.ppc64le.rpm 2252a06a2ce67f4c1a3b2bc156370e49e7474df964646becd033159fe997ebfc php8.4-soap-8.4.23-1.el10_2.ppc64le.rpm 29e1fc7dc4c9db12c15bea7cad1703b815b6cf3e78fe36d2f0a4503861f95c79 php8.4-snmp-8.4.23-1.el10_2.ppc64le.rpm 2f1fc8edf772510bf699373373dd4bd478bce5c1988eea85e6fa9c96bfb44348 php8.4-ffi-8.4.23-1.el10_2.ppc64le.rpm 45a476e84471a1ab14db853e27ebc350c04adb1cb3eebe881b0598ac222ac319 php8.4-cli-8.4.23-1.el10_2.ppc64le.rpm 6f74fc30cd1eaf8fa5c4f749a92497b68a3ef48a798ccbba16611f6671f7eeaf php8.4-gmp-8.4.23-1.el10_2.ppc64le.rpm 7a75fff22915e9547ec04b83dc61d9b6e49cd697de86831503467f1c40dcba32 php8.4-mbstring-8.4.23-1.el10_2.ppc64le.rpm 80897cc7b1559768a8e66c591d102e7314a2ea56bfd54fcb5e2304bdf110bbf3 php8.4-bcmath-8.4.23-1.el10_2.ppc64le.rpm 846d5d0c339dd4a54e59b97f684c485ab3cae784360966f87b2da5bc2dd8613d php8.4-8.4.23-1.el10_2.ppc64le.rpm 86f6b476f70938a99c991fc4fada5d528813f183eecd169ea58bdcdca757cd21 php8.4-enchant-8.4.23-1.el10_2.ppc64le.rpm 87adc14787ba2106dd3df6207656f4e98a3afa1b40aede8371fd7e66fe20fdec php8.4-mysqlnd-8.4.23-1.el10_2.ppc64le.rpm 9589a8c9efdbd415f331a446b4f529633edc343036fc309761e0812e7754f0c3 php8.4-ldap-8.4.23-1.el10_2.ppc64le.rpm ad1e63997d76a250cebf9a65b5b57d4bfa9be9f70991d9ca6f27cd05a08ffbef php8.4-process-8.4.23-1.el10_2.ppc64le.rpm b21bf6c4365e001582d479854abf873221b4f1dc9ac8c7680393bb02e97576a0 php8.4-odbc-8.4.23-1.el10_2.ppc64le.rpm bec9f0ffcd777f89fdcc1f92fbeafe9936e24cbe0df9c6b74c0d46a86162e6d6 php8.4-xml-8.4.23-1.el10_2.ppc64le.rpm d27eaad1757d2f1c298e694be9165ac402ea8a76905ddfc18521995ee037629b php8.4-common-8.4.23-1.el10_2.ppc64le.rpm deba684cbe28e1419114572d877744218752b04570ce6d28fd6a24907e040f5f php8.4-pdo-8.4.23-1.el10_2.ppc64le.rpm ed0fec279c039fdf7adc370f557d142e578e6b414f63c2130929082aa1405d9f php8.4-dbg-8.4.23-1.el10_2.ppc64le.rpm f2d6434e755244d98c9a5ee796d5f67c7a602f0bb7a7eeec493ebf2887af10ad ALSA-2026:50144 Copyright 2026 AlmaLinux OS 0 1 Moderate

libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es): * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libgcrypt-devel-1.11.0-7.el10_2.ppc64le.rpm 3a49c41bb0287f97e9a258be2f9d0c6dae0c5cf41722b76784fd133a07b2cc77 ALSA-2026:50747 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.7.ppc64le.rpm 14c967754e7e808a39a30e109fe94d47d8cc728e3ba4ee4b84b3c517abb0473d libwinpr-3.10.3-12.el10_2.7.ppc64le.rpm 615e30de7c4de9ba6bb909abbfa33da74710f198651420f219590d0209d6030f freerdp-libs-3.10.3-12.el10_2.7.ppc64le.rpm 77584fb2f7532a3689dc22c7a9940336b998401a54782a7929af8525fc9197ae ALSA-2026:50773 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ruby4.0-rubygem-pg-1.6.3-36.el10_2.ppc64le.rpm 7d6cf8265df4f47619e5d0df2dd4a9b8afbabedc96a920a8332fcd72d5b1e3c7 ruby4.0-devel-4.0.6-36.el10_2.ppc64le.rpm 98d2a50127e40719e69d2b4b81a40a7de52a08343acc5914eb0c37dbe90539e7 ruby4.0-rubygem-mysql2-0.5.7-36.el10_2.ppc64le.rpm a4bedd2ea205316214a0e932373a99aea441d5bb39ea8fada5da4a89a8e279f1 ruby4.0-4.0.6-36.el10_2.ppc64le.rpm d03e99b04cba4e4f8f4e3427e52ee097725dcd9efb7d0bf3cb062747445a2b58 ALSA-2026:50778 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241) Bug Fix(es) and Enhancement(s): * ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ruby-3.3.12-14.el10_2.ppc64le.rpm 03f7c80b21b43fc4edb71b8b79ef29dd9b540e34794c9e6104c40cf16a4b134f rubygem-rbs-3.4.0-14.el10_2.ppc64le.rpm 06da515649a3d9020fb5685ed255b1e72c9617deaa1fd5f792865c475ab4fc1a ruby-bundled-gems-3.3.12-14.el10_2.ppc64le.rpm 1137e5ff1b656bb64a8949257139abe9112d4b91bc9a30d121e090f006763fd9 rubygem-test-unit-3.6.1-14.el10_2.noarch.rpm 131dd8cdd912467ba1f8827ee2132e59e97772a0a19a34d30dd7839e793b2109 rubygem-minitest-5.20.0-14.el10_2.noarch.rpm 21c1889fe2fe8b665fd8d07927f509fe6feeaf78754ab805c15679497e55be47 rubygem-bundler-2.5.22-14.el10_2.noarch.rpm 2351acfc5df3fcc5dde89c2945b1b2c2f82584566adf5020e0254e7f592cfebb rubygem-racc-1.7.3-14.el10_2.ppc64le.rpm 2e1e4b046abffdd88bb67211248eb0edb453cc73fbef932ea28f659dc85a63be ruby-devel-3.3.12-14.el10_2.ppc64le.rpm 353fbe479f3fda54446cd44056ee6bb0201fcbd669e680406d7f18b275051bfb rubygem-bigdecimal-3.1.5-14.el10_2.ppc64le.rpm 3bec9eadd52b36d97da37ce910e48136a0c258e2d09ce42f264243e01f528c21 rubygem-json-2.7.2-14.el10_2.ppc64le.rpm 4244e9512eccb3f4bc6c9949d707b2df255a824a47002a0ebc12c88758ef1d00 rubygem-psych-5.1.2-14.el10_2.ppc64le.rpm 46397029a00a483ef1cf3b2024254138c5ddf95feb2b20a6f7d11d0be9b5e16b rubygem-irb-1.13.1-14.el10_2.noarch.rpm 46613819af1fb9478b0e629651c46aa11e4464bb5c9cffee7e759d6786dec0bc ruby-libs-3.3.12-14.el10_2.ppc64le.rpm 598662cd207bc134388749aef5656bc9b1dba1dc3ec3ab1af3fd3b7649b3cc16 rubygem-rdoc-6.6.3.1-14.el10_2.noarch.rpm 5c00d2550ead68020d3187766315cf476e673c256a3075d89c40e6868434b24e rubygem-io-console-0.7.1-14.el10_2.ppc64le.rpm 6be3fdf1f8de7c0b3032f96c9eb9e23eab3cde261ca68d50e5492855668ec88d rubygem-rexml-3.4.4-14.el10_2.noarch.rpm 797e9b5def067ed1b4a076e585bd427d2faa3fa20db74f61c349ce54a17001bc rubygems-devel-3.5.22-14.el10_2.noarch.rpm 7e994cc7820f22d4c3173560806e49845622523b1b6813aaaf17a3274d4dd035 rubygem-rake-13.1.0-14.el10_2.noarch.rpm c53bb678682a61e82cacd04f0a3d4f33c0e1d8dcad90c1eefd2d5de20caafebf rubygems-3.5.22-14.el10_2.noarch.rpm e614c319dddb353036831b3163c6c76c806a302b2d1b420f110dc3ac9779a8bd rubygem-rss-0.3.1-14.el10_2.noarch.rpm edcf8a577a06115a59a8a5e4d7f017b389372a4f7da251061524db691c1b5132 ruby-default-gems-3.3.12-14.el10_2.noarch.rpm eee30784ab9187664bab88713a780f0e03173777cb24eeeb2c65f08854146ff3 rubygem-power_assert-2.0.3-14.el10_2.noarch.rpm f635633eb2dfd48b67a65aa9e6a82eadfada6bc616d85081cdf4cc5bf73f08e4 rubygem-typeprof-0.21.9-14.el10_2.noarch.rpm f76ebecc0e4d4bec6ed47f476de014cea992d3b11812f607afaed01950bc5dc6 ALSA-2026:51075 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution (CVE-2026-58459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gpsd-3.26.1-3.el10_2.1.ppc64le.rpm 479ec7bc5b1440f87fbc5827a1386f6f68feaeb382b42747ddb36a717d51c5b7 python3-gpsd-3.26.1-3.el10_2.1.ppc64le.rpm b4d2f1a691c84792b89cc64a856e12c5dc271ecf674bbab9ffecedf805c6c047 gpsd-clients-3.26.1-3.el10_2.1.ppc64le.rpm da4c96b5a6c271c1f431fdaa9c5a05909a029f372ce97286f673738de8022c98 ALSA-2026:51295 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-10.2.z] (JIRA:AlmaLinux-186345) * ice: driver update 2026-06, part 2 [almalinux-10.2.z] (JIRA:AlmaLinux-193134) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-6.12.0-211.44.1.el10_2.ppc64le.rpm 18ef14ad9c29c3adf37eab852ec8f399203e2c0c7bd8944dedd7d414f110a31f kernel-doc-6.12.0-211.44.1.el10_2.noarch.rpm 1c4aade5d5fb516248eb660f2819523377e9feca8b77c696901ba628dcc0602a kernel-headers-6.12.0-211.44.1.el10_2.ppc64le.rpm 21328f1a91aca79ad8ac69f90f7177fee6f558335dd5c4d02c0aec3c809291b8 python3-perf-6.12.0-211.44.1.el10_2.ppc64le.rpm 2f7763aa880fdae0db27c5c49a728161f7c89a04572195599f317649947cd89f rtla-6.12.0-211.44.1.el10_2.ppc64le.rpm 31cab0f7eff9cf63fefafa1269958021e64d4490aabac87f8f8cdf68d7941123 kernel-debug-devel-6.12.0-211.44.1.el10_2.ppc64le.rpm 37d6669421d007d86f60ab69f80d8e9ccdaa1357be2758d0bce2019f3282815b rv-6.12.0-211.44.1.el10_2.ppc64le.rpm 7c8fa55d90834605d8eb50bd03589cf6ae20fbb90a37a5004c7ee7d5e17b785e kernel-debug-devel-matched-6.12.0-211.44.1.el10_2.ppc64le.rpm b871d75e9559159263accb02123c7fa40dc12c1a041ec9b4fe2208d25759111c perf-6.12.0-211.44.1.el10_2.ppc64le.rpm d48d38e59bc0180bf6a179ce3c56713f951d448f1c8a509e4c88dff4d7336ea6 kernel-devel-matched-6.12.0-211.44.1.el10_2.ppc64le.rpm e55329bc880f74dd74abe0ac3bd5d78bc345fb7e69c9c3cc64a2f32aea876aa5 ALSA-2026:52675 Copyright 2026 AlmaLinux OS 0 1 Moderate

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libarchive-devel-3.7.7-10.el10_2.ppc64le.rpm 771bb5f0b1ba1e77051a8e45106079c0743962eada4f3d65215d51e059758801 bsdtar-3.7.7-10.el10_2.ppc64le.rpm be9f1c80801cfc194ce55a59bd706e8a5b0d9771c7a3cb2a69b0ae4d30477965 ALSA-2026:52841 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm 754dbb75c7096126fe89e0025ab2e31e63eda960fb77226c5e627a74feb18d21 ALSA-2026:53330 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143) * kernel: shmem: fix recovery on rename failures (CVE-2025-71072) * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035) * AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503) * AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rtla-6.12.0-211.46.1.el10_2.ppc64le.rpm 09b4e41194050fc5f232474f70688241c1db3dc41c3795da79181bc52c051274 kernel-devel-6.12.0-211.46.1.el10_2.ppc64le.rpm 119c3e8461943c10a69850bddb78462777ca9283f0f64a8ef479fca674fef5b7 rv-6.12.0-211.46.1.el10_2.ppc64le.rpm 1dd268d54d9bd41273154390a775d531c78cc27403f49d11fef74bdca2443291 kernel-headers-6.12.0-211.46.1.el10_2.ppc64le.rpm 4d74a11cf755499d38420994389728069fa245f94b3ef1603e8ccc27fd014de3 kernel-doc-6.12.0-211.46.1.el10_2.noarch.rpm 889073b12cc0ea295f2ca8fe44265cfc363bf64df9f9389e1236bf5667da86f5 perf-6.12.0-211.46.1.el10_2.ppc64le.rpm c0a635a54bded4f66f52a8ea8103861b70ad3645c81499d43366c59c7618fe1d kernel-debug-devel-6.12.0-211.46.1.el10_2.ppc64le.rpm d574b0105fa0b46799adefbd8a8157fb575c9cd0788e3cadad397ba7cff8e3aa python3-perf-6.12.0-211.46.1.el10_2.ppc64le.rpm d8eac760a0d12bc4ddec866e05f2011249b7f8f19ef24dfb3a035dc5ebe95ae7 kernel-debug-devel-matched-6.12.0-211.46.1.el10_2.ppc64le.rpm f0d39f03ef9492ca52a55e424b045d4d9c2137453e42ea908d4aa429abc334b4 kernel-devel-matched-6.12.0-211.46.1.el10_2.ppc64le.rpm f181f2297007b24b7895ce905be9ea3f564e514554d790cf950fc8dee3839c4b ALSA-2026:53435 Copyright 2026 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks2: udisks2: Local Privilege Escalation via as-user option spoofing (CVE-2026-7867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libudisks2-2.11.0-2.el10_2.1.alma.2.ppc64le.rpm 45b7098e05fae651c98b2ade6588c970c7e046a082ffbf61f6a1a1f1d9da2afa udisks2-iscsi-2.11.0-2.el10_2.1.alma.2.ppc64le.rpm c0629aaf2cb3795dcf7b843c1f49c4ef72e7f7f33c51af338676e3225ecb884f udisks2-lsm-2.11.0-2.el10_2.1.alma.2.ppc64le.rpm cf1d172e49bdaae4393c5fe0d2aebd6d050d59da1c6b4c0926185be7c0305674 udisks2-lvm2-2.11.0-2.el10_2.1.alma.2.ppc64le.rpm e087a2a6d1853f75862c1929ae7649d63714472436b147d20503ba56f5e02f27 udisks2-2.11.0-2.el10_2.1.alma.2.ppc64le.rpm e394b34c2d9c6d26b4168932bd212f7a290dd164d00e272cce36c552f6bdf579 ALSA-2026:53451 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders (CVE-2026-18649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.3.ppc64le.rpm 8f19e8b5987e1c036522d2c163c88d64f83debd76883ae2f2d8f1dfe2391d191 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.3.ppc64le.rpm a8e04a571076d34c7135e43268c7e473aae4f1ad97b8948f1a4d62679eb75ba4 ALSA-2026:53845 Copyright 2026 AlmaLinux OS 0 1 Important

iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks. Security Fix(es): * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944) * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943) Bug Fix(es) and Enhancement(s): * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el10_2.2.ppc64le.rpm 7016472eb315beeb8dacf381ba338d6a049a82970abf4fe3c730ad0af6a3994d ALSA-2026:54178 Copyright 2026 AlmaLinux OS 0 1 Moderate

grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) Bug Fix(es) and Enhancement(s): * [grafana / rhel-10.2.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-selinux-10.2.6-28.el10_2.4.ppc64le.rpm 415c8af51a73ea0d7f8ef26eeb89c0e658bb900fdc687362b72c1cc9e29cc1d5 grafana-10.2.6-28.el10_2.4.ppc64le.rpm 5fd6717ecca184097a73156dde6f00df2c8d8a941bed3c2a67a4a28db94e25ad ALSA-2026:54343 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.47.1.el10_2.ppc64le.rpm 17afd16acb7c7435d8707fadc12bfc6ef8344e10555fe0561a952bb0860738b2 kernel-headers-6.12.0-211.47.1.el10_2.ppc64le.rpm 63f498ca1b5e57bf87d36a2cf79b3760fa7f92dd9a560ca2e78e70d643fa8db8 kernel-debug-devel-matched-6.12.0-211.47.1.el10_2.ppc64le.rpm 6bf438440362499604aacfa8f146b054d71ea725480e91d3fed83a1152dfdc35 rtla-6.12.0-211.47.1.el10_2.ppc64le.rpm 8d892cd564c7e662e52a696561e8a4d9c5973de5c189138cda7485179203524b kernel-devel-matched-6.12.0-211.47.1.el10_2.ppc64le.rpm ae53d7f4ca15e1acb99e09ec19473f24bd95eec88b23328d923650d6b1d32cc7 python3-perf-6.12.0-211.47.1.el10_2.ppc64le.rpm b0be152a40e362325c6c412e86025b765b72dbae5fed98ad304289fa4fb120e0 kernel-doc-6.12.0-211.47.1.el10_2.noarch.rpm b6ea785a24bb7a5f9f936164f09340cbc926d13f91290fde4caa9d611fc41c48 rv-6.12.0-211.47.1.el10_2.ppc64le.rpm bf83d25f28e7a98bbec998e1d775dea2ecc492a145692f9730f2a26c7da087f3 kernel-devel-6.12.0-211.47.1.el10_2.ppc64le.rpm c89932aff76220b363616fe7c0500b790197dc125c7e2c3f62470954fd8026ba perf-6.12.0-211.47.1.el10_2.ppc64le.rpm e10844d60e5ea50bc30edbbea1b12f52065faa571edca2b39c1923dc052933ad ALSA-2026:54486 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620) * FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621) * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.8.ppc64le.rpm 6a7e1d19236bfc94906e18ea3d336ca66e1d0d88a4df734367de854f6c598c05 freerdp-libs-3.10.3-12.el10_2.8.ppc64le.rpm 8f37fa5b3fde7d16aa80e1fcce1dbda3fdc4be03c7fcbf3ac96d6bbb5cd3ce90 libwinpr-3.10.3-12.el10_2.8.ppc64le.rpm f9e7165f877432a59d1977205802e9b3a0deb2b6a913a95e7a58815f8c90779d ALSA-2026:54512 Copyright 2026 AlmaLinux OS 0 1 Moderate

gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gnome-remote-desktop-49.3-4.el10_2.ppc64le.rpm 9f28afd8167828e617f912910643a545d7637661b6dcbf7b85d42d5a65919ace ALSA-2026:54541 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-sdk-dbg-8.0-8.0.130-1.el10_2.ppc64le.rpm 168e43c5ed471d5597d5da024702acd88bea091911a1c829b67812db045e2518 dotnet-targeting-pack-8.0-8.0.30-1.el10_2.ppc64le.rpm 1e0190492cf74b401da56d8dcc99bba8949c26ae4f2519b1f56d6071913ec80c dotnet-runtime-dbg-8.0-8.0.30-1.el10_2.ppc64le.rpm 291171390aca34d68140bc30f50322746783a4a6a28cdfdb529707d72b41bff1 dotnet-apphost-pack-8.0-8.0.30-1.el10_2.ppc64le.rpm 31a5b39504ea95817f873a08d14c471dca901a7c4902424e3f7a7a5451f277e8 dotnet-templates-8.0-8.0.130-1.el10_2.ppc64le.rpm 359022a8f0cc2add55ea3074cd9f8be02a778acbd52fbd40db6cdc94888470a8 aspnetcore-targeting-pack-8.0-8.0.30-1.el10_2.ppc64le.rpm 3e40261e98f89a2683fb3606488470c278ed90b51b26276061f2d8fe86ba278d dotnet-sdk-8.0-8.0.130-1.el10_2.ppc64le.rpm 76f893aa416eb5cacf217d6e049059b3dca414f1866ab77253a4e0060cd12a10 aspnetcore-runtime-8.0-8.0.30-1.el10_2.ppc64le.rpm 8e38c74bf0c355e945519b6e346276c784088361da5758b6f24ef700dccb0012 aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_2.ppc64le.rpm 8f107898393844bbc3d242747622502e0ae494a80d999a16e0312c626e5ebbc3 dotnet-hostfxr-8.0-8.0.30-1.el10_2.ppc64le.rpm af43f26674a35c6f9bf94b22bb37330a07b8a2bbc943afb365c2d69719d34db5 dotnet-runtime-8.0-8.0.30-1.el10_2.ppc64le.rpm c30c0e256f58d3e6f5eae28fecb84bf03aca45e8417e081c68af4d7d7df81b4d ALSA-2026:54576 Copyright 2026 AlmaLinux OS 0 1 Important

dracut security update

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dracut-caps-107-9.el10_2.ppc64le.rpm 2bed73bc238cc6a20adcdf6c34ff76b4ae9768603f687f32fee4cbe833c340ab dracut-live-107-9.el10_2.ppc64le.rpm 3138008a3a3e8266798bb6c4a3704b1183a9e0a17a7c174bf8ce21043604781a ALSA-2026:54590 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-sdk-dbg-9.0-9.0.120-1.el10_2.ppc64le.rpm 08d77c8a4dd140b856e9544d35cdc7a869b58945ca0620cb9bc2f02f1dce6de7 dotnet-targeting-pack-9.0-9.0.19-1.el10_2.ppc64le.rpm 2e11b021809ffb4e8e2e693ff44de1adaa04d119ae2f94ccb1c4f4ee34b47ca1 aspnetcore-targeting-pack-9.0-9.0.19-1.el10_2.ppc64le.rpm 46730fb43019240f7dc4a5615c89e203966599409858586d7c385148f9fede25 dotnet-hostfxr-9.0-9.0.19-1.el10_2.ppc64le.rpm 5802e08e0295de342da88f1ce57ec9b628c6e40c022a5f0db6cfc1fd0be3de0e dotnet-runtime-9.0-9.0.19-1.el10_2.ppc64le.rpm 58a46eeb7465514ebfc5bb3d987eb56e0359ca195db61f7218ac4f1fcf0d41d7 dotnet-apphost-pack-9.0-9.0.19-1.el10_2.ppc64le.rpm 6a6f47d4dca28537e629ed3a7485cb1877587d950c0496738ad5c47e86f98c10 netstandard-targeting-pack-2.1-9.0.120-1.el10_2.ppc64le.rpm 742ffd9d8feb3e0fbb92c974c6c139c51c5311ec1e115a450078ec85b4e12e0c aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_2.ppc64le.rpm 77836be11d21f53d014b89f66ddbd1d0fb94f46d3d9912261bec9416be8aa213 dotnet-templates-9.0-9.0.120-1.el10_2.ppc64le.rpm 88374bdd20c106c93acec0c2a65667f3dcbc669ae100aaec1829fabb575f7981 dotnet-runtime-dbg-9.0-9.0.19-1.el10_2.ppc64le.rpm d81595f7facc1a18f7b7252ff9da9f77d9b4cad8f110d45e0e1255c0405d7f9c dotnet-sdk-9.0-9.0.120-1.el10_2.ppc64le.rpm ed1b0e39cd3ce2e0344d6608b4e5d8b5baa39c573506cf9d98345c7e980a6733 aspnetcore-runtime-9.0-9.0.19-1.el10_2.ppc64le.rpm f15a76a28aa1ddf62fe23bcd04bd7f3f2707ceea075e8e8523a594489dc619fc ALSA-2026:54650 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libnghttp2-devel-1.68.0-3.el10_2.2.ppc64le.rpm 54f72ab6591ce2874e90a881a8948929cb21d339eb5a8058a22649ca046d297d ALSA-2026:55424 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default 389-ds-base-3.2.0-9.el10_2.ppc64le.rpm 0f1afa51405a3d020b3f4e8ac7335fcaf51d971f32ce4974fa0bae2cc39355fc 389-ds-base-libs-3.2.0-9.el10_2.ppc64le.rpm 2775c87b284c7e099a1a7d7f92ce398b6fc4169bb7d4ffbab105d87c2120745f python3-lib389-3.2.0-9.el10_2.noarch.rpm 27cf3e06e99257f4c51c72088b1f9e5f48d590b294e516768385c0f484ac53a2 389-ds-base-snmp-3.2.0-9.el10_2.ppc64le.rpm 811af1af75c9d1e98003c0a9cb6edbcf11a6f53ac44602e09263e65dbb223a49 ALSA-2026:55432 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.4.ppc64le.rpm 11b5e2a75cb602761993e24dcd743d89d6fdc7e77edd569490d0ed9f73e646dd ALSA-2026:55433 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7.ppc64le.rpm 3aa1f490d9ea6cecac2eb20657fd544d3e410f44a5f576f035a888445f7bb941 gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.7.ppc64le.rpm bccef11c1049ce069e8b678830c5d250ac79b35001323bf3550e3e0fd495185c ALSA-2026:55434 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write (CVE-2026-73433) * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVE-2026-73434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5.ppc64le.rpm 47a144942e5d4a9e402d95db01cdd1edb800dc1c181a068c494888f776046976 gstreamer1-plugins-good-1.26.7-2.el10_2.5.ppc64le.rpm 9594519d7e592fc90cf57f0acaf04bc65412300dd8b3c29f2b8705f878e3f0b0 ALSA-2026:55435 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2.ppc64le.rpm 0d6d4b356064775870649c2f76c220f39d996fd55f374b86e50213f0d99a79dd ALSA-2026:55437 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default bind-chroot-9.18.33-15.el10_2.10.ppc64le.rpm 426ace85823f85ae709bece9ae1dabd29196c7857512395c997561c17945b11d bind-9.18.33-15.el10_2.10.ppc64le.rpm 9bef3dc911d3d75734263a2a4918812e108907a55c8e35f27bf541a1b4a70ee7 bind-dnssec-utils-9.18.33-15.el10_2.10.ppc64le.rpm 9d62496e11e44dfdcfbedcc3277968096927da94d8fea210245a24c66cc7f4f3 bind-libs-9.18.33-15.el10_2.10.ppc64le.rpm c996ce71bde9aaeee1c4da9951aeda9bfebf4abd89f4d2067fe4b6e340789cd2 bind-license-9.18.33-15.el10_2.10.noarch.rpm e7269f3a04d0f19af0b01cb87ae997a2d63f8b901c3fbbbd06b2be1ac756d519 bind-utils-9.18.33-15.el10_2.10.ppc64le.rpm fe5218b5cbfa62af746ee53cafb921f305103e412bdfe24890679665bf692fb6 ALSA-2026:55448 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libXfont2-2.0.6-5.el10_2.3.ppc64le.rpm ac914bd4c8d88dd032d557a774c278b08ca35f63f881e1dd005762a947149d88 ALSA-2026:55541 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-full-i18n-22.23.1-6.el10_2.ppc64le.rpm 1fa61f381289f01c4409f656e5d3bbc021820c40a88a422f998751649a889506 nodejs-22.23.1-6.el10_2.ppc64le.rpm 215628cd23e7ef863baea7efbd96ff01dbc9519971615a5645dfcefb4a442429 nodejs-docs-22.23.1-6.el10_2.noarch.rpm a4cf7db461223295f0f82718617815510079e00e6e5e5f79921d8490e5169df3 nodejs-devel-22.23.1-6.el10_2.ppc64le.rpm a93951f9a657a762ffffd10878228f5fcdaee58e82f574150b41cbe0e818477e nodejs-libs-22.23.1-6.el10_2.ppc64le.rpm e573f928f08bade5c629f8687dfc9c97918ab97c38b235037753fd8006037558 nodejs-npm-10.9.8-1.22.23.1.6.el10_2.ppc64le.rpm fe211f4a4b20eb21a6e460516f88e4cc1e88990d7552db0743a419185c2249fc ALSA-2026:55617 Copyright 2026 AlmaLinux OS 0 1 Important

pcp security update

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pcp-pmda-redis-7.0.3-5.el10_2.ppc64le.rpm 00baf78e6f48e9d0b2272f417fa54dd5dcf2535a373ba79cd1c1eb1443546f07 pcp-pmda-nvidia-gpu-7.0.3-5.el10_2.ppc64le.rpm 0363ef1340e06bdf913915283c6ff7b3aea170397ed4c54190f605eb37401d11 pcp-pmda-pdns-7.0.3-5.el10_2.ppc64le.rpm 04c81993b5933f021d3af70ec8297f1db19d9be207078e27aab16b87e1e7d1dc pcp-pmda-bind2-7.0.3-5.el10_2.ppc64le.rpm 051abd14dfb0d96d208d8c397fbecda75d25dd71f2fd4cbe83808616407e4d09 pcp-export-zabbix-agent-7.0.3-5.el10_2.ppc64le.rpm 05af4d6f9a994e8e97e4abea4801224ff25bd693aba0c6a435364c87cba7586d pcp-pmda-lio-7.0.3-5.el10_2.ppc64le.rpm 07427adc2518fb1b0548ce98ea3b6e4b3830d9bbcfb5af0d9aa223341bc514c6 pcp-pmda-slurm-7.0.3-5.el10_2.ppc64le.rpm 094d4974658510838aff2a75066e91619ed2d497fb412d3637eaf6b456dab582 pcp-pmda-rsyslog-7.0.3-5.el10_2.ppc64le.rpm 09f0f66f5d49ae2c27d135f62c78007dc48fae002f3f526f2d033bddf3efa75d pcp-export-pcp2elasticsearch-7.0.3-5.el10_2.ppc64le.rpm 0f2e26b31c87a3e98a71b9aeec94f46623885cfa84f3b8abe53eaa04f0b39c8f pcp-pmda-postfix-7.0.3-5.el10_2.ppc64le.rpm 0f34a71f8a30a16aa06a783d1069c29ac20d10eeaad30f9d9ba2275d15c2cc5f pcp-pmda-opentelemetry-7.0.3-5.el10_2.ppc64le.rpm 171842a14549f09571632f9139381b9cdece933e14da9cf0920276ddbd5d03c1 pcp-pmda-bcc-7.0.3-5.el10_2.ppc64le.rpm 18dc6f16a01a0cf233652750ae18c3bb815e980b5251108164ca8baabea23d77 pcp-pmda-libvirt-7.0.3-5.el10_2.ppc64le.rpm 1d7279d87569e408e24bcbab4fa13c675196a8ed4567e4585b2353cf3c348be5 pcp-pmda-denki-7.0.3-5.el10_2.ppc64le.rpm 1f6efc271e3781dc82fe79c080d30b14b9a2766ead7913393687de2e19fe048c pcp-import-mrtg2pcp-7.0.3-5.el10_2.ppc64le.rpm 1f986c238bccdee9fa289766153caad9dd6b647240ca1f553ace218a5a64007c pcp-pmda-openvswitch-7.0.3-5.el10_2.ppc64le.rpm 1fea616cfbced1e5cbe30f2a8edb9504336602883929aa9c41a4055d3d152c2b python3-pcp-7.0.3-5.el10_2.ppc64le.rpm 215c5c353c2bd756539c7beab4180070c48ecb04accac30105497ac8e468bc5b pcp-pmda-lustre-7.0.3-5.el10_2.ppc64le.rpm 23cb4f81a6accd9586974056e09580e9f849b705eaf5a1ae72ae522565508211 pcp-export-pcp2zabbix-7.0.3-5.el10_2.ppc64le.rpm 2b3ecdb3fa1ab2e44b608bfdc0a661ad0eef8f488fabe583546b7770a18cd307 pcp-export-pcp2opentelemetry-7.0.3-5.el10_2.ppc64le.rpm 2d8d8589fa78924339f854ba25b3e07c28fa34aa5d9faae495e57b30495e0095 pcp-export-pcp2spark-7.0.3-5.el10_2.ppc64le.rpm 3052292e7ed7522513129d3278c964cad033cdce28131f1b9ef30ccd396f90e6 pcp-export-pcp2json-7.0.3-5.el10_2.ppc64le.rpm 30eaafcf2c075b8428beb0f341606954c849fec675e213cd76bbf525e35e036b pcp-pmda-infiniband-7.0.3-5.el10_2.ppc64le.rpm 3207976a57bc2538e628b7dcf718fc8cfa0b74a44595aa1c40801dbaabf9d37e pcp-export-pcp2influxdb-7.0.3-5.el10_2.ppc64le.rpm 36dba4d0f759a0dbff56d0f28041eea70c38654856763bd657f635f7b3223d26 pcp-pmda-hacluster-7.0.3-5.el10_2.ppc64le.rpm 3b2317ad5975cb0b196171ef2e2918c68f8aa85b3f4940941a5f1ea8edb8e6fa perl-PCP-PMDA-7.0.3-5.el10_2.ppc64le.rpm 3d0194f906c21ea873e004a87e37377ebbd3dfcde1ece8643d5d5b6565c40c52 pcp-pmda-lmsensors-7.0.3-5.el10_2.ppc64le.rpm 3d39e74e0965471e5c9fb80c66c67857351125e590a5ed854c1703ba9e318be7 pcp-pmda-rabbitmq-7.0.3-5.el10_2.ppc64le.rpm 3fcadb46d772181979b21bab2b77ffc9996f7a19cd885bf4af1c06e9548bf184 pcp-pmda-named-7.0.3-5.el10_2.ppc64le.rpm 40a2a27bfc95db56b2e016fa4db1229c0f7b454336b76aa7126507bd4d807f9b pcp-selinux-7.0.3-5.el10_2.ppc64le.rpm 4296a71e948d5ec013cf1ba4531d9f01edeb8fcdf60b7a0de7c62f1a3b75db4b pcp-pmda-docker-7.0.3-5.el10_2.ppc64le.rpm 452f7106d0e502cce35d899bbdb34b810735ef17a1830370dc66999b27a19cb3 pcp-pmda-hdb-7.0.3-5.el10_2.ppc64le.rpm 45f79d112e7ba00a606b0c30e7daa495405a114ae9f23198041fe2f7a275ef81 pcp-pmda-postgresql-7.0.3-5.el10_2.ppc64le.rpm 47950c7eeef637e89e086e2bf83e95e9d9031e6280f3d52fb028d27dc3314c0e pcp-pmda-trace-7.0.3-5.el10_2.ppc64le.rpm 47aaeebd62ed623f2a04c7967ad348691240a3efae16267e48c4c18d72c2a527 pcp-import-ganglia2pcp-7.0.3-5.el10_2.ppc64le.rpm 483f72378356c6d6532af7774ee9406a9be28dd38810ce66e006774d923f4413 pcp-pmda-oracle-7.0.3-5.el10_2.ppc64le.rpm 49c8a7c3d6546e198bb057faa67121a786b2e661ea66f685e82b248243b2018a pcp-pmda-bpftrace-7.0.3-5.el10_2.ppc64le.rpm 4bd8a4e7b046f571ef73ebef9aae72676b624bea9dd0e8151f6fcceeb4c2c338 pcp-pmda-mounts-7.0.3-5.el10_2.ppc64le.rpm 4e4d751b84570135c0ec878f4d1ee7f48dd5ad8e35131d83cc16f52a0c241900 pcp-pmda-cifs-7.0.3-5.el10_2.ppc64le.rpm 5358cae44354455b67bb38c228acf9d4f5150470254b43258207c89442d04962 pcp-pmda-zimbra-7.0.3-5.el10_2.ppc64le.rpm 53b134935a32d188ed0421b3cd86c88fd9b92fd80ec92a2b7c86ddc96a7d56fc pcp-pmda-farm-7.0.3-5.el10_2.ppc64le.rpm 57049a717a99a8f12cf615bc674b1e13ab3531dff91fd515fa5922c64f7994ad pcp-pmda-sendmail-7.0.3-5.el10_2.ppc64le.rpm 5aee441b04276bd97c43b7fb54027aabe353894c120c6ec47f7476b4f8f1e7ea pcp-pmda-haproxy-7.0.3-5.el10_2.ppc64le.rpm 5c4818427d7b446fd281580fd7e5580c6d7e495bd7416a5bff8887d4c00eeed5 pcp-pmda-lustrecomm-7.0.3-5.el10_2.ppc64le.rpm 5ec043cbc920d08b8336ba4edfe64f12cd5275aead6eb3db182ffdfaf2aff4d5 pcp-pmda-mic-7.0.3-5.el10_2.ppc64le.rpm 60d9c827464751ba96650a32616fd6a4694b52ac98eb0812b2b945454f3b4ad5 pcp-devel-7.0.3-5.el10_2.ppc64le.rpm 64edb5606e20dda52c3b0adae46835206ab1f4233db54d569014a63e23915431 pcp-pmda-statsd-7.0.3-5.el10_2.ppc64le.rpm 668b34da04e89d9e76e31c5237c8f5ccd41411a8683fce8d18de39bb99f0b6e6 pcp-pmda-shping-7.0.3-5.el10_2.ppc64le.rpm 66ab8eab29e10d5680a6a35ab434383d0d42537d65a9df395393534c3944931c pcp-pmda-mongodb-7.0.3-5.el10_2.ppc64le.rpm 6735c0aead95345a8f9df7d57e240e4e3a8c09b420158fcd750305438626e8a8 pcp-libs-7.0.3-5.el10_2.ppc64le.rpm 6860b1676d8481568c49634276f2455dd764c8265dc8bc9d68ee8df23f7b92ee pcp-import-benchmarks-7.0.3-5.el10_2.ppc64le.rpm 69d9e7dbdcf5d2de12209df23d45ada2f7b33c5f55cb1ce179f9fe39f30e1bd7 pcp-pmda-ds389log-7.0.3-5.el10_2.ppc64le.rpm 6c6299c677f3761216a49141b16c45f9f5d44b8f62777252f92fd9e6a7e22e9b pcp-pmda-podman-7.0.3-5.el10_2.ppc64le.rpm 714bb4c0b749636cc74a293f6173c434e993d1f4c0a5033e3c8876b5a8d92c9b pcp-pmda-amdgpu-7.0.3-5.el10_2.ppc64le.rpm 7649c28959fe75d1470f3e3fb0cb77a639ab5b80e13e3f9ab93725b8bc3a1921 pcp-export-pcp2openmetrics-7.0.3-5.el10_2.ppc64le.rpm 86b2ab2efa6b7daddb70124913b881ce112f35428418fc125968a8bd7936d709 pcp-export-pcp2graphite-7.0.3-5.el10_2.ppc64le.rpm 8a002a82ce7232be850d94e4221d35af2ee8f9d1477a93a512736bf35a703fa7 pcp-pmda-roomtemp-7.0.3-5.el10_2.ppc64le.rpm 8c0ef59c0df0a56893936211b2536317061676345528e08b1973393d67dc1d79 pcp-pmda-perfevent-7.0.3-5.el10_2.ppc64le.rpm 8c5cb3f727459a775fa9cf0eb8a9cde5747d997ced4523ada8d5b076bf5c5dd7 pcp-system-tools-7.0.3-5.el10_2.ppc64le.rpm 8e133cf99a9145ca3f3ed512d622c51e30bdf497814b1b0702d017cb6656c1b5 pcp-pmda-bpf-7.0.3-5.el10_2.ppc64le.rpm 93f81ee269123afc88844ff452579c4b46ab1df5110d865536be2dd51c4f6203 pcp-doc-7.0.3-5.el10_2.noarch.rpm 94a7dc3f75afab71ce735dd038541108a4e6b18e03790db4d1e46bbc272ecb1d pcp-pmda-openmetrics-7.0.3-5.el10_2.ppc64le.rpm 95c151fa321c987920e5176f8b6f6ad2087efd4988e68149b7996476cd340d3d pcp-pmda-smart-7.0.3-5.el10_2.ppc64le.rpm 96d206c84ec6edfea337787cbc92be5501cf2efc304dc277fb7816f73af1d06c pcp-import-iostat2pcp-7.0.3-5.el10_2.ppc64le.rpm 98ae2027f61a077f0dbbc72a8c5f5b7b11b1758bd345339d5db16b8bdf18bc60 pcp-pmda-netcheck-7.0.3-5.el10_2.ppc64le.rpm 9dfd85836bafe44962a68b5d66da30a53e80198e3fb2849d0f8d114d0e396580 pcp-pmda-weblog-7.0.3-5.el10_2.ppc64le.rpm a01682e213080140e6efad319b303d21cac143bc9dabfdd7455899f5adb8e19b pcp-gui-7.0.3-5.el10_2.ppc64le.rpm a1fe8dbd7911e3926dfd2b6893102138ae1460c13f701d2f3468bf261b43f727 pcp-7.0.3-5.el10_2.ppc64le.rpm a265437faa3d16f328f23b5a9b412772c95b266cc16104a77bcc46b6112e9599 pcp-zeroconf-7.0.3-5.el10_2.ppc64le.rpm a4cd4991b11b356282d3ed2bdbe869ff07ec219c473377d4985b53736889e338 pcp-pmda-apache-7.0.3-5.el10_2.ppc64le.rpm a7a6d16a35743de87b6152682c055171a7b779f22c303e9c2507e6128bfa9f09 pcp-pmda-mailq-7.0.3-5.el10_2.ppc64le.rpm a7d303559e6f3472d42759d0acf874204932b88a8cc7d970a1dce4fe7afcbe56 pcp-pmda-summary-7.0.3-5.el10_2.ppc64le.rpm a94216d108c3404a2387a15fa620225eb3b67ed2a97435ebcc74a0ac976d34bd pcp-pmda-dm-7.0.3-5.el10_2.ppc64le.rpm aba461923ef6c8650835e62a0ea1674116f928de6dc7177bd68f877149d7554d pcp-pmda-snmp-7.0.3-5.el10_2.ppc64le.rpm ac2d80518775bc240306ed51411ac25d37e9d5811ae260b4d7391a840a864fea pcp-pmda-unbound-7.0.3-5.el10_2.ppc64le.rpm adac81aa758ef84f8552b197cad41ddd782b06937075362a669da8e051b15458 pcp-import-collectl2pcp-7.0.3-5.el10_2.ppc64le.rpm af27d26bc93183fd6f74ee1fad306830c4daeda25026263a4dfcadabcac7b945 pcp-pmda-dbping-7.0.3-5.el10_2.ppc64le.rpm b5d3b8f87ff9dc6f72bddf0291812838ceaef9a48909ba61f06d86241dd6f4d8 pcp-pmda-uwsgi-7.0.3-5.el10_2.ppc64le.rpm b7ed6a46cf73a742a1c9f4c16e2ba1b662e8eb3fdd5e24572ee4cd7b6388eb99 pcp-pmda-mysql-7.0.3-5.el10_2.ppc64le.rpm b88ae3a2a59588ea87ed9c5b990317a01f1ad0151af0d60fd7ce98fb1050f76e pcp-pmda-sockets-7.0.3-5.el10_2.ppc64le.rpm ba64e43ebcf8edb753951a29a65d5f452e85b293fd7002cb0bcd9a359bb75f49 pcp-pmda-logger-7.0.3-5.el10_2.ppc64le.rpm ba713ccb7b19ccbfaad73bce73e644e7f7ae8043c690377466bc9c5cbd993b0a pcp-export-pcp2xml-7.0.3-5.el10_2.ppc64le.rpm bfa1e6606ebc0011a6fbbb6ec44ba00fcd0611fc681d298a7f46fd124049f1ac perl-PCP-MMV-7.0.3-5.el10_2.ppc64le.rpm c1d9a57b41c2d366a6ff3566756b59975c0a800494d16ae5fec9cafde70990cf pcp-libs-devel-7.0.3-5.el10_2.ppc64le.rpm c340c3e61440b69c2cab2abf9810344bc2853740221b1ee2665a1dbd1f9f8c80 pcp-pmda-gluster-7.0.3-5.el10_2.ppc64le.rpm c3a86f865b9b97557a14d03c7e1ed91e336cffaf19c9b41c8dfec64cfa627c8b pcp-geolocate-7.0.3-5.el10_2.ppc64le.rpm c3dbad8a56590b2922fe030de7aadde010131fe0c213a6350f0f3e9418f7f42c perl-PCP-LogImport-7.0.3-5.el10_2.ppc64le.rpm c63138cab4d9ce0fedcf74119c93e7d2d4992f22ff681f5caf84bc2b4c0786b9 pcp-conf-7.0.3-5.el10_2.ppc64le.rpm c83442027720d8d12eefa7af9c3e16042bc79bc570f0f5c1ecf82f2f76448a00 pcp-pmda-samba-7.0.3-5.el10_2.ppc64le.rpm c835b58d92d1549d02fd06adc6e068539ea7e07971f14bf1c50a0166393dc34a perl-PCP-LogSummary-7.0.3-5.el10_2.ppc64le.rpm c89f704f1244399e52220f11c6d63dbaee20ec15bd7fd5c425cd49c9415cb9fd pcp-import-sar2pcp-7.0.3-5.el10_2.ppc64le.rpm cca1d51ec4ccbd46bd41b4a21b138b1e9d357a704f783dac4cf470932d9996b1 pcp-pmda-activemq-7.0.3-5.el10_2.ppc64le.rpm cccb230c7f04ee015f14eb95d5842311a971f764756c23f6062a4370f1aabdbc pcp-pmda-nfsclient-7.0.3-5.el10_2.ppc64le.rpm cea1afd6c1732fd776b016c0524b3d96c5afe9c5ea99a228f9d929b863635da4 pcp-pmda-memcache-7.0.3-5.el10_2.ppc64le.rpm d06b54a4fee936deaa79225ecacbab295428a8698edd578d506b27beb1262a18 pcp-pmda-bash-7.0.3-5.el10_2.ppc64le.rpm d5251c748775998e0261e3fed749b385e752b5cd4c7703f879e4074b49729789 pcp-pmda-rocestat-7.0.3-5.el10_2.ppc64le.rpm d84653bfcda97270633a45ad11db64f2b69442ac73572778077140b373cc0e63 pcp-pmda-news-7.0.3-5.el10_2.ppc64le.rpm d881c8c800c4f077442b1ccbc57967c1f8824ab52ca6d83c9308bcde666fd5e4 pcp-pmda-cisco-7.0.3-5.el10_2.ppc64le.rpm dac939863cdb4650ac15ba0f61111607032dcff9fd483df28de49580a1abce80 pcp-pmda-gpfs-7.0.3-5.el10_2.ppc64le.rpm dfe349719bda4837939e77d6390900e40a5d222ef9f887026736423af5787cfc pcp-pmda-bonding-7.0.3-5.el10_2.ppc64le.rpm e022cbcee276a834e480d06179d4014b4badf6560dffc056e90eb43a2d03aa12 pcp-import-pmseries-7.0.3-5.el10_2.ppc64le.rpm e4d5d8549ff5b6c9dec1af7807310b59b06d5896220fa28bba9c4c96ed5b8aa3 pcp-pmda-gpsd-7.0.3-5.el10_2.ppc64le.rpm e92eed5c744fbcf1c29b880d48175fa7f8f43f329dde64328c5b0f1747089eb1 pcp-pmda-nginx-7.0.3-5.el10_2.ppc64le.rpm e94fe247678f195e5a8615991a419e91dac5dc4f54e1290ef19701bd04d87491 pcp-pmda-elasticsearch-7.0.3-5.el10_2.ppc64le.rpm ea1667d17371d40ff8230da527993f29da607b509c4d983d93df9165374df393 pcp-pmda-zswap-7.0.3-5.el10_2.ppc64le.rpm f2159a540931d59923684e8d31e3ab6336bf59f7883b02ac67da2fcba19191f5 pcp-pmda-ds389-7.0.3-5.el10_2.ppc64le.rpm f6e90f68c8721204a728c9acef94cdc0de5aef100e5d3aed2ce2a8ad0cd3b55d pcp-pmda-systemd-7.0.3-5.el10_2.ppc64le.rpm f83dc96d93588df92efcf2128a7b5f27d718f1cd7dba9e19a770108a1670131f pcp-pmda-netfilter-7.0.3-5.el10_2.ppc64le.rpm fcb7b796e4dc97e16e3eac98cd606f07813eede509113c8041b66b0c14f352c6 ALSA-2026:55679 Copyright 2026 AlmaLinux OS 0 1 Important

haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions (CVE-2026-55204) * haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling (CVE-2026-55203) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default haproxy-3.0.5-6.el10_2.2.ppc64le.rpm 373d6ff1d2138d0b20f583215022a4c011687f6beeac3cf4dbf2515a3549afbb ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default java-21-openjdk-jmods-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 140cd4aee6edfbc872d2263c2e61ed908badf2900ea90d787e5659460fda2a7c java-21-openjdk-headless-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 189903fff1cabeebf6fea9eb0a5a5b3756553172f90d7c9fc2721e17bc605e7e java-21-openjdk-devel-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 28de19b962565fd10dd221a0de948fd563a5adac94209ee136aa622761ad3364 java-21-openjdk-src-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 38cbe417dff0ec4fd3b43a960400c20d50757cbcdaaa0853e8d8c644970e834f java-21-openjdk-javadoc-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 42726a3d645bbdcea930691b31eeba209d8a3759b88ac139a53e058625a8d4d1 java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 506eaa3895f8713402820b2a2defc95c1e07b8aa97b02cead90c8e106acc4fd0 java-21-openjdk-static-libs-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 70f5ddc5054bea7d6172041fbea6ae4671b1d868a05e784358f143fa5f95efb6 java-21-openjdk-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm 9ce1cf098411b83687010ddbbb0b633deb1991de8585bdf6c71c61a61e22e7c3 java-21-openjdk-demo-21.0.12.1.1-1.2.el10.alma.1.ppc64le.rpm f09f56dcad768071f094f9328b710743d764529cfdf0e305c674963d6ff76f3b ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default java-25-openjdk-crypto-adapter-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 213a66f390f8839e19460048940cfbf1b18bd926a45952c73197dbde79268b9a java-25-openjdk-javadoc-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 22edcb22ddd71400c6ce33ba7d917b219198d7d96cf130a70552e2d55e5ca13f java-25-openjdk-jmods-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 389b5f284bca22f4fa80ddc1e45266b66d6923711b90d6623291defd12255796 java-25-openjdk-devel-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 5eaef0b9ee4053799a4faa5757422a3e46fc5b8a5403cc5510ccad3d3c82e4a1 java-25-openjdk-javadoc-zip-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 6fe4b70ef739aa73644054b37611725aca7b3be763020d7beb4206756ff1b7ab java-25-openjdk-headless-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 8312e7499b1c8882887e3bb011b785ff3f8d714dd50bb345fbaa3d7a0d34e2f7 java-25-openjdk-demo-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm 9db57ffffd54131e80b240e71730120afbf28d59cf92167311f8ced322a0d114 java-25-openjdk-static-libs-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm ac476d0e5464a996bd655eced9b50741543ef6b0ffde42db66447d32cb5bcdf1 java-25-openjdk-src-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm b2857daf230be04119bc7c0725b9e1ca6421f38865819d0661b079c7108addea java-25-openjdk-25.0.4.1.1-1.1.el10.alma.1.ppc64le.rpm ef4cea308fef74ae16d128ecacca1a56e985afaf3ce9d16d3272d5fc148656dc ALSA-2026:55855 Copyright 2026 AlmaLinux OS 0 1 Important

libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842) * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849) * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851) * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libssh-devel-0.12.0-3.el10_2.ppc64le.rpm 116074b67ddf6edb58dd70fb0131f47fd0b8965316bcd78ab36c8ba447007347 ALSA-2026:55858 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-hostfxr-10.0-10.0.11-1.el10_2.ppc64le.rpm 1aec6433bbf2dacfdbd06c7ce13181f2a8a9cd2eb2ad9554369e3d8c258da134 aspnetcore-runtime-10.0-10.0.11-1.el10_2.ppc64le.rpm 6102b00cda7613a578d0fef6051119af8628c028041ebb56aa532b35fd983909 dotnet-runtime-dbg-10.0-10.0.11-1.el10_2.ppc64le.rpm 71d61e9e70b22d1d676031eedb8a133981a54e366f9726565b33fa97bdae00da dotnet-sdk-dbg-10.0-10.0.111-1.el10_2.ppc64le.rpm 7fad490c8950581da1c97993ca35dce1d6baf80e35a9db38a61edf388abe280d dotnet-sdk-10.0-10.0.111-1.el10_2.ppc64le.rpm a54c8aafd1992211b2d152be30dd0ea6eba4c6c8ee41114f939df94a8863991b dotnet-host-10.0.11-1.el10_2.ppc64le.rpm af31968852e8817f71b2e48906ca28ae228b96a3047c104b20bc0f9f00d41653 aspnetcore-runtime-dbg-10.0-10.0.11-1.el10_2.ppc64le.rpm cbdaf21066a40420a06ffa314b77a3ed5e87afd1cc453557268b4cc9ecdd7399 dotnet-runtime-10.0-10.0.11-1.el10_2.ppc64le.rpm d238a8101dcfa3332713044966b8f05691b1ba60de9d7eaba982f423139b6f13 dotnet-targeting-pack-10.0-10.0.11-1.el10_2.ppc64le.rpm d7ed7006f547c0777f1b43d9c6e70d0e82a0eba4c7000ecf3336c732a5ea9f17 dotnet-templates-10.0-10.0.111-1.el10_2.ppc64le.rpm e0241ecebd30a43581fa104a97b264dc693c026c7263f39ba1534ca0400a84de dotnet-apphost-pack-10.0-10.0.11-1.el10_2.ppc64le.rpm e32c58644963ec7418e2121f7c3b0bdcf0ac2777f7d39889ad8c91dce1cdcf39 aspnetcore-targeting-pack-10.0-10.0.11-1.el10_2.ppc64le.rpm e5c27135886ed823604de70787e39c44adc10f42869b719a92ca75fec875e857 ALSA-2026:55892 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default unbound-utils-1.24.2-7.el10_2.4.ppc64le.rpm 114af6ee0ae1e054f4d4edb714f911b65b02a5517e75fa4dc8cf2e5c9952df06 unbound-libs-1.24.2-7.el10_2.4.ppc64le.rpm 825164e822785b0c4e5f94a93c2af2c42df82ae9cd0557468a821fc410b37bfe unbound-anchor-1.24.2-7.el10_2.4.ppc64le.rpm 8ef1b9917359daad246f3e938f2e9c66f8705d4796a11838b799da6eefc35ca2 unbound-dracut-1.24.2-7.el10_2.4.ppc64le.rpm 9ee0692784ba8a4a72b17dd8be8dfcc55d408f15cd9f711a45664a939c874155 unbound-1.24.2-7.el10_2.4.ppc64le.rpm b22bb65ba41faab479a961a0143d9d34075b288fc08bb9919f0e74056d095cba python3-unbound-1.24.2-7.el10_2.4.ppc64le.rpm ee63ded54f09be67f1495c2a3ec6561a72cbce5576abcff69ee11a807408fc68 ALSA-2026:56007 Copyright 2026 AlmaLinux OS 0 1 Important

mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:AlmaLinux-188044) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mysql8.4-errmsg-8.4.11-1.el10_2.alma.1.noarch.rpm 363b90f121ea2698cc9695f9f3309d5ffa0b6afbaa96304878cd6e0f4729dc7e mysql8.4-libs-8.4.11-1.el10_2.alma.1.ppc64le.rpm 53ed82ccf28410176b84a57c5644a283866c3e1f080cd665d1e3d701de55ac8c mysql8.4-server-8.4.11-1.el10_2.alma.1.ppc64le.rpm 81c71416df0846dc1a2a37f08d3d5f90ea2a6befccc1081f20b41a8e1f2cbbfc mysql8.4-8.4.11-1.el10_2.alma.1.ppc64le.rpm a44c73d02bdacd4dbe8c8dceab5ff3c625383482f84167fa14214c7ff2c9f1af mysql8.4-common-8.4.11-1.el10_2.alma.1.noarch.rpm c88645f04b3cebf77c1371c06af54dbc511288a9c7e60b32a1b8566680f797db ALSA-2026:56965 Copyright 2026 AlmaLinux OS 0 1 Moderate

libcupsfilters security update

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel() (CVE-2026-64611) * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libcupsfilters-2.0.0-13.el10_2.ppc64le.rpm 01851c965126ed8e7d869ae701ac80cd91e087cc37683edafb24544563f8bacc ALSA-2026:56969 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php8.4-xml-8.4.24-1.el10_2.ppc64le.rpm 128ac65943ca740e7c402692aabd17a0c74ea15a609aea6028f2f29a50528c71 php8.4-ffi-8.4.24-1.el10_2.ppc64le.rpm 139d4e26c16a5d8ca565f4a78c5e71eda87d6a2a2017b8d606dc25481a1bd4cd php8.4-pdo-8.4.24-1.el10_2.ppc64le.rpm 1509e568aeaaad7c10f8593f0fb02372fd38a14abb1cc98ecac02e599f163a35 php8.4-mysqlnd-8.4.24-1.el10_2.ppc64le.rpm 1a467474cb52c66891ba7491602c1ddd1ab6a65e0424109da3dff0c73a03b80b php8.4-8.4.24-1.el10_2.ppc64le.rpm 241bd9de748a3c06972fdf0098d61e4d094e50064344bed1ab501c2519755bb4 php8.4-devel-8.4.24-1.el10_2.ppc64le.rpm 2a2e8d051cc94c5c765783f0c1738359ee3d9bfc3efbeb7266373a5b66758679 php8.4-process-8.4.24-1.el10_2.ppc64le.rpm 2cd28dbffa6ec933efee77c9bd282aade06ea85688d0cac43a51bfa8298efe3c php8.4-embedded-8.4.24-1.el10_2.ppc64le.rpm 3a98cab2dfb864abd43fc8939c696865a038e1a80d96e481a88521c173818040 php8.4-dbg-8.4.24-1.el10_2.ppc64le.rpm 40629b472e81a50ed977eefd296566cf5143f36b827594594a966f8e132ee713 php8.4-soap-8.4.24-1.el10_2.ppc64le.rpm 416821c93747c774d28a450bdda884f893e479349bcb120f6cb0cd5e933e9fe7 php8.4-intl-8.4.24-1.el10_2.ppc64le.rpm 6eb6deaf023250536a9165a2161a1b407a6cea99fd096c518579b3367586eeab php8.4-cli-8.4.24-1.el10_2.ppc64le.rpm 8ce2b35809341cd38a36ad5604c9b38d133a2b2f63bafc2f010e49eabede4592 php8.4-bcmath-8.4.24-1.el10_2.ppc64le.rpm 8d6f57b01a1abc77538aac036f9453627d0af8267c4e5f4a4791b5473e8ce835 php8.4-ldap-8.4.24-1.el10_2.ppc64le.rpm a366cecab142945694bd86fb388b2569b5026483a404e6c1e89ba4cad0478f6f php8.4-gmp-8.4.24-1.el10_2.ppc64le.rpm a6ee0711a013bca25b5e73c1d414ae6b40fc55343b902e6dab0e1657dc231f66 php8.4-gd-8.4.24-1.el10_2.ppc64le.rpm ad40aeb292bdfb60687a95cabcb5d7a7d54aa77387c765ccd57a8d8b8b52d7f7 php8.4-pgsql-8.4.24-1.el10_2.ppc64le.rpm af3a0bef850854bd351acc296bf1972f859eb67cdc16241442bb634f5418739d php8.4-fpm-8.4.24-1.el10_2.ppc64le.rpm b28ba3ceabb33f22e6f42549724cc5ef35d219adcbcea14e2d85e81ff0a54396 php8.4-snmp-8.4.24-1.el10_2.ppc64le.rpm c8e6eda9127b0f3ae79726ef2a28f55279a6d7a5fd7f8ffde11a5e64bd13bcb7 php8.4-common-8.4.24-1.el10_2.ppc64le.rpm ca6fd7bae9650bb50f0698ebecc64b964cad9c05556e509e999cc7d4dac77090 php8.4-odbc-8.4.24-1.el10_2.ppc64le.rpm cc390391c27c122665df153d9da8a9e43d2a0360d8104fbcf715a96803015dc8 php8.4-dba-8.4.24-1.el10_2.ppc64le.rpm db3a213c67c6b35c7373ca0156c4b33ae630d94c5267b8e95b6d84ab402a5c6e php8.4-mbstring-8.4.24-1.el10_2.ppc64le.rpm e2ea5eec6d1f93a5ea860657ece579be5254b83e370fa3a83e53787b140c90fb php8.4-opcache-8.4.24-1.el10_2.ppc64le.rpm f001cf8dea9f9cde8b933328c5ced484bcda7d89edd6225d1128874026ed9419 php8.4-enchant-8.4.24-1.el10_2.ppc64le.rpm f9f5a72a618890e37afb3f8e22cf2d4f28f5f827b11bb33e48bb05f8b1135151 ALSA-2026:56971 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian calendar (the one currently in use) with full support for time changes due to daylight saving time. Security Fix(es): * perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing (CVE-2026-60075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-Date-Manip-6.94-5.el10_2.1.noarch.rpm 10d103055b714ff49d9c99838b44a6ae39437022daa8f3446516cf8eca19f1d6 ALSA-2026:57015 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.21.ppc64le.rpm 3e8a8532ab79be2eacc1aee61513432c6abfdd3177250b46c444fd4f5cb29375 glib2-devel-2.80.4-12.el10_2.21.ppc64le.rpm 776fd1cb047a2381003fb42aab12af0f6cdc5cd603e062e7a9c1be82ae7b9fca ALSA-2026:57126 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.2.ppc64le.rpm 4e1dda5e3ab1fa3cc0b1f9e73f7e23dcc2adc95f892ea8cde4796103dbaa1684 ALSA-2026:57148 Copyright 2026 AlmaLinux OS 0 1 Important

ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): * ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ansible-test-2.16.16-2.el10_2.1.noarch.rpm 278ed7a9b385cb985f51b9a6e708b16d47cae71cb98ba0d3c8d13b7c71d3f0de ansible-core-2.16.16-2.el10_2.1.noarch.rpm 9e56e424dbf2c5ad2a45a0dfbe4d711e036865c0a60139679f71bec6f32d2897 ALSA-2026:57251 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545) * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.49.1.el10_2.ppc64le.rpm 086f51a8ae33094c18f4d82710c4ec9223660ed1557eb75ff814a542213624a3 kernel-debug-devel-6.12.0-211.49.1.el10_2.ppc64le.rpm 0c338ef6e2f81aca9fe42b829896d340130a1ce09b79a3978905bc16e9e1b960 kernel-doc-6.12.0-211.49.1.el10_2.noarch.rpm 246731a322c2c865a9e626b9c0be133018206f6db8652c48453d46fdc34459d6 python3-perf-6.12.0-211.49.1.el10_2.ppc64le.rpm 24f46e7c6adffd3bff82e0323d2ea45c99efd0c2e9cf294db37c0b71535f10d6 rv-6.12.0-211.49.1.el10_2.ppc64le.rpm 434317508e9052a65213dc2af32ee6e173a1d2b6ee750c7fb02eb02ad566880b kernel-devel-matched-6.12.0-211.49.1.el10_2.ppc64le.rpm 653758e6a534eaf2be25fb1885a06f3e229af5c15f6145ec6f23b83155d082fa perf-6.12.0-211.49.1.el10_2.ppc64le.rpm d39f0a94825764a73a8bdf462333c88b739a8d7535b2294f95d3d95f491cf61f kernel-devel-6.12.0-211.49.1.el10_2.ppc64le.rpm d3bf260a75c59cad1d27f07d50b3e2821623dcbe1fe5c064828b7e7d06153762 kernel-headers-6.12.0-211.49.1.el10_2.ppc64le.rpm e331b7cdb9de3e1a67d5374d094292cd11e82967a818bf3bfc474d98f2ad5cf2 rtla-6.12.0-211.49.1.el10_2.ppc64le.rpm ff6abff1ed89e21e599b37e9379ca1b0639669cdc6304fab73776a7f21e3f29b ALSA-2026:57596 Copyright 2026 AlmaLinux OS 0 1 Important

mrtg security update

The Multi Router Traffic Grapher (MRTG) monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fix(es): * mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation (CVE-2026-72694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mrtg-selinux-2.17.10-12.el10_2.1.noarch.rpm d7555e699b1e01e77cb85e1fbe4038f3f7826311959865d40f4c38eed8aa6134 mrtg-2.17.10-12.el10_2.1.ppc64le.rpm f374f667c4244eeb729a2d36af0c28da4bc0825851d31ab4334105e23eaa26bc ALSA-2026:58571 Copyright 2026 AlmaLinux OS 0 1 Moderate

qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914) Bug Fix(es) and Enhancement(s): * qemu-kvm hung during drain after double pause [almalinux-10.2.z] (JIRA:AlmaLinux-190702) * qemu-img create/convert fails on target block device with 4k sector size [almalinux-10.2.z] (JIRA:AlmaLinux-207389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default qemu-guest-agent-10.1.0-16.el10_2.5.alma.1.ppc64le.rpm 792781fbd99f771683e7f4c21df7afcb2ca7d16729be79f7aa0151962967f1f8 qemu-img-10.1.0-16.el10_2.5.alma.1.ppc64le.rpm e207d5af891d2d04e37dfcf38ee79743be15a066d08d6a7c352f574c56f54796 ALSA-2026:58819 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152) * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs24-npm-11.16.0-1.24.18.0.5.el10_2.noarch.rpm 0b5823d155438be9e50559a2b2516af1f168e0c86471037562a2f1a8b8cc92f1 nodejs24-libs-24.18.0-5.el10_2.ppc64le.rpm 2e79872920156866c8a171721da16cb990aac23a3d1929a4cf79130392b40a6a nodejs24-24.18.0-5.el10_2.ppc64le.rpm 77ecb92756c7383c3ed7fc8bbb5c04477bfbd489d895933c2db7ec88711afaa8 nodejs24-full-i18n-24.18.0-5.el10_2.ppc64le.rpm d767ef97a2966157684948810187ae7303098e4703d8ba7ba7d295eb2b1e8b93 nodejs24-devel-24.18.0-5.el10_2.ppc64le.rpm f1c2d8c82a201735ac0cae4f6146f3493ebe21af5d3c10617969eb815607858e nodejs24-docs-24.18.0-5.el10_2.noarch.rpm f376c79686cb878dbaf4e4b6b47534b7dad0ad97bbd2d659ad2f239bdb1d023c ALSA-2026:58899 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983) * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941) * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.14.0-1.el10_2.ppc64le.rpm 0e893d6f68bb1ce2dcbafc2ba6e98347016a06960b25aa1f0693a85135bc9eed ALSA-2026:58902 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python-unversioned-command-3.12.14-1.el10_2.noarch.rpm 432002d2f2d16400a23c31dbfa20b3800372adba8054dfdfcb8877898640e6a9 python3-tkinter-3.12.14-1.el10_2.ppc64le.rpm a8307fcda68a311c51991571db824e871b350f162f36f733d8c7e1feffc1f31b python3-devel-3.12.14-1.el10_2.ppc64le.rpm de278909d1eb10e661c41114e8caf94b3794e09b109e8c098a6401c10874d470 ALSA-2026:58927 Copyright 2026 AlmaLinux OS 0 1 Important

sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sqlite-3.46.1-6.el10_2.ppc64le.rpm 126d1fa88faebbbb8d0603f7a92236f69413e6597462af871944eec7953bb9d9 sqlite-devel-3.46.1-6.el10_2.ppc64le.rpm 96b689194655ea6467b4721a82df26457fb1b389dc6b2388421b4b62227ae970 ALSA-2026:58928 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-libs-3.14.7-2.el10_2.ppc64le.rpm 917eb4120ec66d683c21cb5f985d16748cceb536f2d61004f7f91f295481a6ce python3.14-3.14.7-2.el10_2.ppc64le.rpm c2ebcb5ba041768c992e3a6c7e231c789f4cb1faffd835493868a77f47b2e360 python3.14-devel-3.14.7-2.el10_2.ppc64le.rpm e42507f6ae0907bcdcbd1941a3fbb4f0a69d1b4b09ef15e5554389e8fa2e1e76 python3.14-tkinter-3.14.7-2.el10_2.ppc64le.rpm fb9095b3548c4800474ab33c8315ade5b9e3a1fca3e8052b24619add60adf70a ALSA-2026:59097 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow (CVE-2026-18297) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-base-devel-1.26.7-2.el10_2.1.ppc64le.rpm 015f039548f5c69bc49541ea2fdcd961ba5894516ad3f7080ff94f2351f22107 gstreamer1-plugins-base-1.26.7-2.el10_2.1.ppc64le.rpm 4cf337a0a8d0541c60aee8f17d58ca81832000d87317046fa3b398078e056a17 gstreamer1-plugins-base-tools-1.26.7-2.el10_2.1.ppc64le.rpm 4d2e42e5878c5d88043ef0ae35338deeb33d6e1cfcba9da1242ceb4ff0056a7e ALSA-2026:59133 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.7.ppc64le.rpm 1db1fcc5aee72b0ff85969df5d2640a1b5e1f769e27fff3f287e201d822dc738 gstreamer1-plugins-good-1.26.7-2.el10_2.7.ppc64le.rpm ee6c2be4c2de1d77296615049468eae0734fb5540de416450151b000679f9e3d ALSA-2026:59220 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nginx-all-modules-1.26.3-6.el10_2.6.noarch.rpm 0ee1da66b42d7a7309fa3e289c5fb632caccf67d24aeab9708c03be35a50dd93 nginx-mod-http-perl-1.26.3-6.el10_2.6.ppc64le.rpm 532915172d25cffbc317559799a484ff623a70b70220b73d80ff2b37645a1f04 nginx-filesystem-1.26.3-6.el10_2.6.noarch.rpm 6a4302dfb7471b2cc3f0c8e4f7944909387b627464c4efe14fde80d576b946c0 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.6.ppc64le.rpm 7af544f63f6507d07147cdd4171723145f852408e5a629b1d806424811bc571c nginx-mod-mail-1.26.3-6.el10_2.6.ppc64le.rpm 9883eacb82099e0d4cf8dec59f0d9e13e54cb33af9386d39d397d38baca38fe7 nginx-1.26.3-6.el10_2.6.ppc64le.rpm a2c1a8e0192028610b41cf9f4721fa8f10dfdce1e3f6d69d96ce5268954fa16a nginx-core-1.26.3-6.el10_2.6.ppc64le.rpm a4270ab9e6ff5aaf91461f13a1924ddba563fb72b1617ee39cc352c01f11af1e nginx-mod-stream-1.26.3-6.el10_2.6.ppc64le.rpm baf8ad7869e1207b3979b27c8301d45678e52dae31cff5320943d6c26db7085c nginx-mod-http-image-filter-1.26.3-6.el10_2.6.ppc64le.rpm f402aca1bee99d050260ef21cd980c8a99db435c97821d2e57411c906aa02742 ALSA-2026:59243 Copyright 2026 AlmaLinux OS 0 1 Important

python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-pyasn1-modules-0.6.2-1.el10_2.1.noarch.rpm 05edb19dae2edc37e82548abae6af2808fd01ad0c9fb7d6e914cb343e2182e02 python3-pyasn1-0.6.2-1.el10_2.1.noarch.rpm 5a44c6804ccdde9b93b518b3d47f1187e4ee407ae6a058b986bc2fa52399e8bc ALSA-2026:59372 Copyright 2026 AlmaLinux OS 0 1 Moderate

assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG). Security Fix(es): * assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default assertj-core-3.24.2-9.el10_2.1.noarch.rpm 2001c3bdd1cac076d06f46697038efbcaea5ed8fff25714109166daf9b16ee5c ALSA-2026:59379 Copyright 2026 AlmaLinux OS 0 1 Moderate

pam security update

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module (CVE-2026-54411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pam-devel-1.6.1-9.el10_2.1.ppc64le.rpm 114b16b3b27b1c06749a3aee004cd26beb05b75ea6852356a2ce50f558aadba5 ALSA-2026:59380 Copyright 2026 AlmaLinux OS 0 1 Moderate

attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fix(es): * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libattr-devel-2.6.0-1.el10_2.ppc64le.rpm 478c4da5e93280decdc8e29eb67adb9a17886f220619459d731c2ed59f449f82 ALSA-2026:59972 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-good-1.26.7-2.el10_2.8.ppc64le.rpm 4081d0d80053ddfc7a8ae785b92716beae205db2645601234ffed96b85aac8c7 gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.8.ppc64le.rpm c9412d2eecfaaa301531187088fd82009689812eb940e5f5c96d7ef588961e6d ALSA-2026:59997 Copyright 2026 AlmaLinux OS 0 1 Moderate

polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default polkit-docs-125-4.el10_2.1.noarch.rpm 305e34938bffb0db90d5a6ec9e239162450d0c39bf641873dcc7b0598bf2930e polkit-devel-125-4.el10_2.1.ppc64le.rpm 413634050b7023c6b3f051a90d103f925fdc41c2184b028291a83fe71a4fe805 ALSA-2026:60004 Copyright 2026 AlmaLinux OS 0 1 Low

httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default httpd-2.4.63-13.el10_2.6.ppc64le.rpm 0eeee0a3e4f6df91d9b849fb5d0545ff8d2f81d5636f4f3507647bab6ea9ff9b mod_session-2.4.63-13.el10_2.6.ppc64le.rpm 17423450954731badfe824a43e2337323b9131452ad0076f0919bd3b03e664b3 httpd-filesystem-2.4.63-13.el10_2.6.noarch.rpm 2d887c9658de80e5f018347a72ff0e89acbb079bbd7a748b53ca6594ecae718a mod_lua-2.4.63-13.el10_2.6.ppc64le.rpm 3abe78e97a72ed84e8f4115ae1b443b969170d6bc0751d5546b7a327655d4a6e httpd-manual-2.4.63-13.el10_2.6.noarch.rpm 69567bdd1024b64882fe35313f7a8f2549cab4b9a577ea66ad31608c30f9ff84 mod_ldap-2.4.63-13.el10_2.6.ppc64le.rpm 7693209632c4dc2692109aaac62879c674170eca0777a6e3617f315ffbaaadf6 mod_ssl-2.4.63-13.el10_2.6.ppc64le.rpm 9fe23ad87df7549769671d9a123fa235079193a48c84673fbd8b938367e1615f httpd-tools-2.4.63-13.el10_2.6.ppc64le.rpm c0dc2360c86b7f0d78f69887c026a1067d1f4adc1714ab5e11556782bf03a50f httpd-core-2.4.63-13.el10_2.6.ppc64le.rpm ed0ee8d94ec598ff3a016e88969b25bcdf91af723222ad4b54a1019c5e59ced8 mod_proxy_html-2.4.63-13.el10_2.6.ppc64le.rpm f4f7166cbb7b2a0a67e5bfd08f591bc563a2f408673b110bc4709d773809c30b httpd-devel-2.4.63-13.el10_2.6.ppc64le.rpm fbd70e9095038eb6043ad5b8c23c3ef0a9076fda9757eca1827482a7455bc55c ALSA-2026:60306 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.7+1 [almalinux-10.2.z] (JIRA:AlmaLinux-246423) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default golang-misc-1.26.7-1.el10_2.alma.1.noarch.rpm 1923dd6592518a5d2f4e4eef0ff7f7bf3b611a49230e03cd40caa092e84f83c5 golang-bin-1.26.7-1.el10_2.alma.1.ppc64le.rpm 237f2f50db94c0194c4b3b7f2d9aeaf2a476d60bf77e1689ae0b2b553e98ca13 golang-tests-1.26.7-1.el10_2.alma.1.noarch.rpm 2cd7fa5d945a940c336d1817cb06f166edf8869a955ca3e7b5638d0f77886aea golang-docs-1.26.7-1.el10_2.alma.1.noarch.rpm 36167694db02b79aff2148f3934c8d4bd287c3615d93d5a40f6356796ff2e299 golang-race-1.26.7-1.el10_2.alma.1.ppc64le.rpm 3a3f82c74c0d8d301c8e6bc8dbddf18eb1657dfa7717367f28289e7f5339252c go-toolset-1.26.7-1.el10_2.alma.1.ppc64le.rpm 660d9bd1e47a61f9119dda4baa059efc461d46fdbb1a7ea85371260d34b06f26 golang-1.26.7-1.el10_2.alma.1.ppc64le.rpm ae788ac9314755828368da0a95c80f91e9b3678cf6f78ed4e22b5a96f98e9699 golang-src-1.26.7-1.el10_2.alma.1.noarch.rpm db81e8b2dcb9cce76b60048edd375ec23e8fb6a055cbceb28ee21bb48274cc6e ALSA-2026:60394 Copyright 2026 AlmaLinux OS 0 1 Moderate

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.3.ppc64le.rpm 2470d9177b775b5990f9a08a4f16f4bd2c796c0989cc85ae770672ee80654e17 ALSA-2026:61241 Copyright 2026 AlmaLinux OS 0 1 Moderate

pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: RAOP RTSP NULL Deref (CVE-2026-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pipewire-libs-1.4.11-1.el10_2.1.ppc64le.rpm 0d7c8c186b29e1f43eb06f81cf264da1a051a60f274f147895cf1ac81aea4e2a pipewire-jack-audio-connection-kit-1.4.11-1.el10_2.1.ppc64le.rpm 4a5d287fde686a176a2e39e4ee73456713215677f205b3afbd4a3a399d956d48 pipewire-alsa-1.4.11-1.el10_2.1.ppc64le.rpm 7fcf58a4bf26d193d9e473f2265f84c6e2bb3dfe987cfad8e2b7a2afe5d67562 pipewire-jack-audio-connection-kit-libs-1.4.11-1.el10_2.1.ppc64le.rpm 8315062eb816702f4d638b598eaec33280ca737484662674d08ee18be9bf9e2c pipewire-pulseaudio-1.4.11-1.el10_2.1.ppc64le.rpm 8ad47b2b974b39f64113ffb05f2e239be8514c4c43cfa94b4c75c3ce92e30225 pipewire-utils-1.4.11-1.el10_2.1.ppc64le.rpm ab24355db2ead81f88b4fc33d022ea144e04e56ab8ffcabb5f86eebfbc0ef740 pipewire-1.4.11-1.el10_2.1.ppc64le.rpm c65a5dbaf02d95cfb9da75fdeeb561d2549fe34937b41470632942b8fde579fc pipewire-devel-1.4.11-1.el10_2.1.ppc64le.rpm cff3fddc30acecaf20b28fdc4f1b5df4fffcc276a48eebd2e9751b12c778cd5a pipewire-module-x11-1.4.11-1.el10_2.1.ppc64le.rpm e38f19ce4b6368ae53aa8a2ea15114c3cb39398683af423367e5cde4aa0161cd pipewire-gstreamer-1.4.11-1.el10_2.1.ppc64le.rpm f305fe16ada5326658fa3e4ed65941101c8d1ad6f8668043a96c4dae34f8ef2c pipewire-jack-audio-connection-kit-devel-1.4.11-1.el10_2.1.ppc64le.rpm f5dd0518b238d563eeb771264530f4710e33cee836521c670dd60126fd5e9ca7 ALSA-2026:61376 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-full-i18n-22.23.2-1.el10_2.ppc64le.rpm 2b3922c24c18a0140fd43395014532e9e5a4728e9c326a6d37335e6a637c14d6 nodejs-libs-22.23.2-1.el10_2.ppc64le.rpm 601151e5a4ae7b4bb91d625324b865815befb3992580ba2f739be710ae6bcfb8 nodejs-devel-22.23.2-1.el10_2.ppc64le.rpm ab76ed85ac657b89e541005479443b941c973b63bfcdba327d77b6cdf602242b nodejs-22.23.2-1.el10_2.ppc64le.rpm aeee6820c24fd4eaa64245e1d21abc8c5377b646ca419809170f0a8c5677dfde nodejs-docs-22.23.2-1.el10_2.noarch.rpm c9f5cc58213b857b0d4326ca1f1f1fd1cda4ecc64776646fcfb759c191300495 nodejs-npm-10.9.8-1.22.23.2.1.el10_2.ppc64le.rpm f269ec8e3a2d7e475fab5c40b771290ac1c45ca9da5ede7fea229a0b00f4b8c7 ALSA-2026:61377 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs24-24.19.0-1.el10_2.ppc64le.rpm 72b7e708863d1dae7c63134c8e1ece9654ab2b37dd91eb0e9e363b07428a0579 nodejs24-libs-24.19.0-1.el10_2.ppc64le.rpm 7ae8bd8c3725422dc45a2e6efcebc58ca1117586ccda9ff4fbe1b37dfae3a72f nodejs24-devel-24.19.0-1.el10_2.ppc64le.rpm 8bb30cb5805780cc1de2a3e34d838f54b3d730ccf4840e964e2da1f0e20a1f74 nodejs24-npm-11.17.0-1.24.19.0.1.el10_2.noarch.rpm afa3166dc5e00f1d8df5f85611a54b62dab8bd37e034efff70b640de418fbf6d nodejs24-docs-24.19.0-1.el10_2.noarch.rpm d3d3383f8710db59beae06da2be66237d330acc7d4a195352659f94e3a452149 nodejs24-full-i18n-24.19.0-1.el10_2.ppc64le.rpm f58ed6c7808251693f6caf176426f51aaa5b6420a0390fe17aaefccd84b69291 ALSA-2026:61378 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297) * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296) * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304) * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298) * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242) * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241) * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.10.ppc64le.rpm 32643c8e386a76ebdc7f2dac5bb55fa369d74fbc3b0a6ccc1469cc675a6f3adc freerdp-libs-3.10.3-12.el10_2.10.ppc64le.rpm 41aed9aa5e0e67b5b33534d18c0005e19dbc5d9a6175507eefaa0bafb28fef24 libwinpr-3.10.3-12.el10_2.10.ppc64le.rpm 72303d6879223d0f3ad04c110a3bb02d7d6e75dd79edab9a53e86bdef8ae4528 ALSA-2026:61680 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (CVE-2026-71217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.1.ppc64le.rpm 455e0703de210579f8ab3f29aec98e35b78aa9011b66e90febb3d471c61dfd63 ALSA-2026:61887 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685) * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419) * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408) Bug Fix(es) and Enhancement(s): * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043) * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393) * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627) * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-perf-6.12.0-211.50.1.el10_2.ppc64le.rpm 19459f99cf8c0c9308712f03eb0f186618bc4895c2c4f1c27d6a37ae01bb7ddd kernel-debug-devel-matched-6.12.0-211.50.1.el10_2.ppc64le.rpm 3dbb429b9adedfbe8b278e9e3562cec63f79be00f1cba911c1e3486bc27da864 rtla-6.12.0-211.50.1.el10_2.ppc64le.rpm 3f77d736b51cc90a94cdc3455fc2a524bada2d1044498cb9ddf92452d16b892f perf-6.12.0-211.50.1.el10_2.ppc64le.rpm 82a7dcba1192c25e9e55d6f68fe60a3b33b6dee1cc5eef2cf67a7a36edf9c6d2 kernel-headers-6.12.0-211.50.1.el10_2.ppc64le.rpm aa3c5d9bd05657d5593c1167474a83b34b8e7cdce19cd257459b40c9aad2baa2 kernel-debug-devel-6.12.0-211.50.1.el10_2.ppc64le.rpm b22f8004fa041d98378e58968b854acb6165235b21e18d428cb3ef371907a8ba kernel-devel-6.12.0-211.50.1.el10_2.ppc64le.rpm c50bb617bdcab6e48b1521f72dd0d555425813a5c352623adb88d92da3a2e4d9 kernel-devel-matched-6.12.0-211.50.1.el10_2.ppc64le.rpm c54d88fe0d3b1273a3cf9142ea804794dc57d590e01824ab13c81f7e2fb7b59f kernel-doc-6.12.0-211.50.1.el10_2.noarch.rpm eb72790272f507b41af75641e41929887bd00929b6c72f25db62b73df90181d8 rv-6.12.0-211.50.1.el10_2.ppc64le.rpm f904d33d5560a4597e772c646b32c0063eb5c4517ba0069b2a8b31ee24384a1c ALSA-2026:62142 Copyright 2026 AlmaLinux OS 0 1 Moderate

wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fix(es): * wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption (CVE-2026-58471) * wget: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute (CVE-2026-58472) Bug Fix(es) and Enhancement(s): * wget async unsafe code in signal handler context [almalinux-10.2.z] (JIRA:AlmaLinux-220498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default wget-1.24.5-8.el10_2.ppc64le.rpm 30da80c0af429d036b51e241bd68f9465be3bdcfd02db4ec5b995dcd574a5d4c ALSA-2026:62578 Copyright 2026 AlmaLinux OS 0 1 Important

go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default go-fdo-server-rendezvous-1.0.1-2.el10_2.4.noarch.rpm 0211aa299091abf4cfdbbe76f87520827c571e8db4a3770fdd0349a146e1d8c0 go-fdo-server-manufacturer-1.0.1-2.el10_2.4.noarch.rpm 84881985faeb5b98d8a5aa9bcdf5c151015a891734684a6dfae3071d412b6e96 go-fdo-server-owner-1.0.1-2.el10_2.4.noarch.rpm df71d99ab263c33a04002cecffd3691380cb99ec2d02cac000f9c35a6af35a83 ALSA-2026:62614 Copyright 2026 AlmaLinux OS 0 1 Important

php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260) Bug Fix(es) and Enhancement(s): * Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 10.2.z (JIRA:AlmaLinux-223946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php-gd-8.3.33-1.el10_2.ppc64le.rpm 025eea5ab5bda9d64df57f1bde87753ade3efe07ce4779d4a18334f1296f9917 php-fpm-8.3.33-1.el10_2.ppc64le.rpm 1b0ceb318e93ca174c81be9a323a5ace4c5efd32287a4c6a2863bd761bee1953 php-soap-8.3.33-1.el10_2.ppc64le.rpm 1f2b01124d223a7140d0b42532f85a48b4179fec0c87f3dd4322d76a96585f9d php-gmp-8.3.33-1.el10_2.ppc64le.rpm 2cee9e2a0bad3775a258e6731d19ccd06e7bf047dd170ef8d940872429f0afd4 php-dba-8.3.33-1.el10_2.ppc64le.rpm 3c9b1ef4d4b52b6d5f35a975b4af29312558e70c06fdf89ef78d83a728f8249e php-devel-8.3.33-1.el10_2.ppc64le.rpm 407d0d6cb2f71d6a9a41d7f8a04fd91781c7ead2cadba8f952962e66444206c0 php-pgsql-8.3.33-1.el10_2.ppc64le.rpm 4c71e2f63fac797b34c06d4d488564546d2d0f7f1976973bc2532dfa5a2e72bd php-common-8.3.33-1.el10_2.ppc64le.rpm 51e6ce86d376cb33a9173d4bf70e8d161eca91073dee8eb312e031e8a652efb6 php-mbstring-8.3.33-1.el10_2.ppc64le.rpm 54b846658ef8c3518fa7f789f6f82ffaae957e4ee05947860cbbfdee4ad9e4d6 php-ffi-8.3.33-1.el10_2.ppc64le.rpm 5b779174e2e94d737c9fd12253c68cc5f4f5a573eab6fce66b95334ded2a187c php-bcmath-8.3.33-1.el10_2.ppc64le.rpm 6ba7a70e133bbb3abf02c27e2407edc6afcd4cd4d28588ff67212911c1e10342 php-8.3.33-1.el10_2.ppc64le.rpm 6c94a664d407d53daf0d8d1ae7bdb068def6428be52fe9229e46bd53a663093c php-odbc-8.3.33-1.el10_2.ppc64le.rpm 7c603f5e1bc4112f0fb7a1df127ea31f87d2a0354da437dafd3d995c22ac1529 php-mysqlnd-8.3.33-1.el10_2.ppc64le.rpm 85a79f54a4e7a7836df85c593e84cae7e931e881f6f10ee3a0ab5f315918ded6 php-enchant-8.3.33-1.el10_2.ppc64le.rpm 8e673a39c98dd10a1ca7e6dc345ed1d807c65104cebce963faaf8a2552d27b4e php-process-8.3.33-1.el10_2.ppc64le.rpm a598eb2ffb6b013c6d75b277e4671390bdf7fb1e301d3a32b881b2cac9c21d3b php-cli-8.3.33-1.el10_2.ppc64le.rpm a7be39e7c836d551ed4f2c8fa014b2272b6e12fe415656de33cbe578cf7903e2 php-opcache-8.3.33-1.el10_2.ppc64le.rpm c2af13263cf7054b9cb68e9e374a94ef3ffcb25967783f88074c3bd81bd6dea6 php-pdo-8.3.33-1.el10_2.ppc64le.rpm c37f6622db7ac1152c3868404f5a9c5e4e005b1c0a2f53c466437f9afd0a7a1b php-embedded-8.3.33-1.el10_2.ppc64le.rpm d1acad172b20d4c5390f464890bbf92af24b919162bbe8dddb8aa8eb0ff7c15e php-intl-8.3.33-1.el10_2.ppc64le.rpm dd29a7fd6f8914c12f5adf43f04d97c0b0dc9988cbaedd76d304621e58ace2e4 php-xml-8.3.33-1.el10_2.ppc64le.rpm deb33ebeb993d9d58a27d60027e9dbe1d44f0e8e028b533466c4b437fd97b1d2 php-snmp-8.3.33-1.el10_2.ppc64le.rpm ec2dadc9000db74a5bcf1df0c9ae6c9ea3bd280993f52f205fec6016782a2a2b php-ldap-8.3.33-1.el10_2.ppc64le.rpm eef80248013abc67f64772c4edd26c774f86ec82a6b74526938dd67ba2b2f722 php-dbg-8.3.33-1.el10_2.ppc64le.rpm f610877d40fe009af02bb0956dab19634f8c2dd66743216b54f966974cba1f34 ALSA-2026:62631 Copyright 2026 AlmaLinux OS 0 1 Important

golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ipp-usb-0.9.27-7.el10_2.3.ppc64le.rpm a486852e8645bb3048978edede0993975200378e9ecdc65b9779aa6b599c729f ALSA-2026:63022 Copyright 2026 AlmaLinux OS 0 1 Important

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-10.2.6-28.el10_2.5.ppc64le.rpm bf6cd86ddaae915eac81cc434f940622df5ba6c6e153c3b2b699ebc75f577257 grafana-selinux-10.2.6-28.el10_2.5.ppc64le.rpm d6c1ead704d4e9a539490855107e15ea10585f9ea7c782917ecfee933e4565cd ALSA-2026:63119 Copyright 2026 AlmaLinux OS 0 1 Important

grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default grafana-pcp-5.3.0-8.el10_2.1.ppc64le.rpm 443da1199121e4ce3d7b36dc316887714f551595ba5a9dc1c044e8394f41c577 ALSA-2026:63128 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-6.12.0-211.51.1.el10_2.ppc64le.rpm 025e3f8101288c2a5568a76e7f6599cd0e7ecd68e10957ac113fb332c81814c1 rv-6.12.0-211.51.1.el10_2.ppc64le.rpm 0c67ab637b0b382bedc8a1ca52164398e221bfadc36cf093f152b96847d3e753 kernel-doc-6.12.0-211.51.1.el10_2.noarch.rpm 2e6e4a832d51991724a1696b6c38060e1abc354ca0d461f7a161f2499a8db46f python3-perf-6.12.0-211.51.1.el10_2.ppc64le.rpm 5af6154def83d7feeedda6e1757b2d3e9de596bfb901eb3a58dcf77d7e2f9f1a kernel-devel-matched-6.12.0-211.51.1.el10_2.ppc64le.rpm 955079d22e95cb16da6f179e0bfb7cc032d634d7cf07f8b98cd217e96cd9bf32 kernel-debug-devel-6.12.0-211.51.1.el10_2.ppc64le.rpm a3fdd335208de0b66ae4b62b1c16000f1c232e9c13cde71f77496e90f809a82c perf-6.12.0-211.51.1.el10_2.ppc64le.rpm b38c5bcbccb2295efdd00e5cfc10178e830c2d610d2f5374999419596ca13cf8 kernel-headers-6.12.0-211.51.1.el10_2.ppc64le.rpm be50c418f408c373c30303ec9a9ba3fc91217988d155d7d7301fb752f9ad7349 kernel-debug-devel-matched-6.12.0-211.51.1.el10_2.ppc64le.rpm ca01eb70bd6802e8e9aab513e213e4f081ca3646144f616a83b3195868f10b64 rtla-6.12.0-211.51.1.el10_2.ppc64le.rpm d25640aa3608bb195b2f6e548954a60fc40d0c43f8ba4e9b050a6ed23d1d100a ALSA-2026:63332 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-tests-1.43.1-5.el10_2.ppc64le.rpm db488327d1a4e0ef611f1e45e0b5b9e40e1ebbd0d050e9816f9cdb783282f6df buildah-1.43.1-5.el10_2.ppc64le.rpm e29f1f5f8d061ec1fe642fbd8a54b2826597c76f25e11d0adb17f1c312d1549f ALSA-2026:64777 Copyright 2026 AlmaLinux OS 0 1 Important

buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default buildah-tests-1.43.1-6.el10_2.ppc64le.rpm 745eef301b40d6f8dd42a04f3d12e072ca716ae57feccc49107607ffcf283d7a buildah-1.43.1-6.el10_2.ppc64le.rpm 74d04a4c80b3f4674c8856924455a144e0ba06adaa669b1c72f885249e1277aa ALSA-2026:64785 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-10.2.z] (JIRA:AlmaLinux-244470) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-10.2.z] (JIRA:AlmaLinux-248770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default 389-ds-base-snmp-3.2.0-10.el10_2.ppc64le.rpm 065c98653e2826bd439f8dc7e8ad8d70fe62a97440adf96e09c676c02697368a python3-lib389-3.2.0-10.el10_2.noarch.rpm 307a5e67b7efa8839b6753d9a1070e7d39a56a06e6b646f7e9121a21f6a89d52 389-ds-base-3.2.0-10.el10_2.ppc64le.rpm 3f1b7a63b2cd7ddd7797c57202125174073417c2fc57ae71400b7e011ef83e17 389-ds-base-libs-3.2.0-10.el10_2.ppc64le.rpm 9b8d7725469801ef6940e9e1a4e0a0ad168fe05a1727202681ab9775acdb6abe ALSA-2026:64787 Copyright 2026 AlmaLinux OS 0 1 Moderate

xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xz-lzma-compat-5.6.2-4.el10_2.1.ppc64le.rpm 7212de490969c53333a82c3ac46e8cd0746840860d2563b8b1408dd2c580820b xz-devel-5.6.2-4.el10_2.1.ppc64le.rpm aa19aaefa77777060106b09236aec425d8374a995e5573954884e09c94983658 ALSA-2026:64788 Copyright 2026 AlmaLinux OS 0 1 Important

git-lfs security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default git-lfs-3.7.1-5.el10_2.7.ppc64le.rpm 7ff9af0322688cd1257ca8402caee5d07640944cf3061288668bb3bb362cf3ce ALSA-2026:64796 Copyright 2026 AlmaLinux OS 0 1 Important

valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis: Remote Code Execution via specially crafted RESTORE payload (CVE-2026-66373) * valkey: Valkey: Remote code execution via use-after-free in stream deserialization (CVE-2026-63639) * valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free (CVE-2026-56684) Bug Fix(es) and Enhancement(s): * [Tracker] Rebase valkey to 8.0.10 (JIRA:AlmaLinux-216776) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default valkey-devel-8.0.11-1.el10_2.ppc64le.rpm 6de136de7e6c393e9a83d6d4d604559e8700fecc5db3d350402464a8c47cc018 valkey-8.0.11-1.el10_2.ppc64le.rpm ad5a3bd63e4b5a36b2e9fdcf451c1748e37e591563820d12b302c6bfceeb4a1c ALSA-2026:64799 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glib2-tests-2.80.4-12.el10_2.22.ppc64le.rpm 090f60d62885c7138309ed9102fef651db12a52cc56c0beaa15b3bec229213ef glib2-devel-2.80.4-12.el10_2.22.ppc64le.rpm c5448a4cea62dd57d4ca777bd876c958eec97181d4fa16df73c3b3e8aa5445b0 ALSA-2026:64810 Copyright 2026 AlmaLinux OS 0 1 Moderate

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking (CVE-2026-50219) * expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow (CVE-2026-56132) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.3.ppc64le.rpm e768eb7f585309dca9d6b5ce19a45f67ae862b73baf3b750b3bfe9eafa20dc33 ALSA-2026:64818 Copyright 2026 AlmaLinux OS 0 1 Important

skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default skopeo-tests-1.22.2-5.el10_2.ppc64le.rpm 2b57282c3d2e2f7f054f23edd1a9a6708881a0e14dace3555cfbce877ff19e1c skopeo-1.22.2-5.el10_2.ppc64le.rpm b8289a7adc5817a2cfa41c13d52e84ef6b2bcf395f11e7df93881a4eec159ef7 ALSA-2026:65116 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default opentelemetry-collector-0.152.1-2.el10_2.ppc64le.rpm 33d41478357d71cd23ce8956fc861abdba920a18dc2e843fb1114f860c9b4a05 ALSA-2026:65159 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.14.0-1.el10_2.alma.1.ppc64le.rpm 350de67fead67971b8b94fbca2963df0c8cba0e9746e4c2b78a49e440ab64925 ALSA-2026:65162 Copyright 2026 AlmaLinux OS 0 1 Important

gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. The AlmaLinux support for this package is limited. See <https://access.AlmaLinux.com/support/policy/gpsd-support> for more details. Security Fix(es): * gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility (CVE-2026-60122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gpsd-3.26.1-3.el10_2.2.ppc64le.rpm 5987e83292b15a9ea09c3e6b94f79b1c1d59e0995f46a1b72e603d04c823a60f python3-gpsd-3.26.1-3.el10_2.2.ppc64le.rpm cca35e33be82b13c8a08a71d3f37f73115aa1a59a2d512b6892a6a36b777b951 gpsd-clients-3.26.1-3.el10_2.2.ppc64le.rpm d126341c75e8ce8d91496c9ebc8e0a6071ddc68cef5a2d9bc979d177a2e2e517 ALSA-2026:65334 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042) * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307) * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) Bug Fix(es) and Enhancement(s): * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-10.2.z] (JIRA:AlmaLinux-193027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.53.1.el10_2.ppc64le.rpm 023b715b6682978abf993515ffa24f1723c3abcf9f78003f24d5eeb7410561fe kernel-devel-matched-6.12.0-211.53.1.el10_2.ppc64le.rpm 23c4886ae273404378d5939ab0898252fd2c95cd084dffedd26e7bbb83e8f8bc perf-6.12.0-211.53.1.el10_2.ppc64le.rpm 51c75b26a277abf35c2a29409625f5cac38eae7280ebc63f5cc0c7e10a1f9bd3 kernel-doc-6.12.0-211.53.1.el10_2.noarch.rpm 695853f20bc714f3bd01366c739f95984ef9c54dd00ee1004b69189f11177cf7 rv-6.12.0-211.53.1.el10_2.ppc64le.rpm 79651f7da10b25bc1c662cdfa43ba6b8d4606fd7baf98e562891c4be075062d1 kernel-debug-devel-6.12.0-211.53.1.el10_2.ppc64le.rpm a2d08177042a7e2f94bf91a5f90214b4dddf00028ed90cf6318d474d62304116 kernel-devel-6.12.0-211.53.1.el10_2.ppc64le.rpm a816b5400970b357c81f210536213950b251c4fc1bc7c274be3c8b1fc2b77b3f kernel-debug-devel-matched-6.12.0-211.53.1.el10_2.ppc64le.rpm aa5a62143b4865566c414fbf66dc7256d6cbfd84e5e851f445fad326a53e139b python3-perf-6.12.0-211.53.1.el10_2.ppc64le.rpm c8bba048f6e145cbb5285d928e2e601ae3792bfa8fb95023f76aa4bcc18b24ee rtla-6.12.0-211.53.1.el10_2.ppc64le.rpm cc134e30d58029b93ead4e4403bc6a054733444cc0ff526d2f5404570419aa9c ALSA-2026:65816 Copyright 2026 AlmaLinux OS 0 1 Important

qt6-qt5compat security update

Qt6 - Qt 5 Compatibility Libraries. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default qt6-qt5compat-6.10.1-1.el10_2.1.ppc64le.rpm 11293c3eaef6daadf29402f3fb81c3ce89d273b931af0fa6e6ccc2a4dcf88303 qt6-qt5compat-devel-6.10.1-1.el10_2.1.ppc64le.rpm 3c5d3cc0b290b81593036ac5db6d49cc48673611159256237719f21dc468cdcd ALSA-2026:65887 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.4.ppc64le.rpm bec219199844051361a0d28e366c0501f31f23bf2fcf7f16d748bf8323be534f ALSA-2026:65899 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgis-upgrade-3.5.3-4.el10_2.1.ppc64le.rpm 4b95da788b44eac52d71d9ad9b835cc33ae3f8e1cb8c7be95e6e42b8a9681d22 postgis-docs-3.5.3-4.el10_2.1.ppc64le.rpm 6a111560f93673055a043b2cc2345d0e378b1fd800a86c577b476c1f27820214 postgis-utils-3.5.3-4.el10_2.1.ppc64le.rpm 92923cd7a34a0d415438dc4a8df0652b74d457dc59df03d0b3307e582916563a postgis-3.5.3-4.el10_2.1.ppc64le.rpm a4064bb1aad1c96a52a0dad04bd67462f853d3818609acd1d413a4a5136b7a96 postgis-client-3.5.3-4.el10_2.1.ppc64le.rpm b2272570dfe362d855e311a59bdccdc3a661c9a5d7edb5f74e4e9503f524e3fe ALSA-2026:66336 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xxd-9.1.083-9.el10_2.20.ppc64le.rpm 61ebb2fbd229022d4e7af98766e2834f522c1ca035ddac027bca04eb4d58383e vim-common-9.1.083-9.el10_2.20.ppc64le.rpm b92f6a0a590957707ae9ba5be74d079ad997d88810550c86a028174ada8af305 vim-X11-9.1.083-9.el10_2.20.ppc64le.rpm d7a1af873f226a2b7503f442f209db171d8649fc49844c232007d7555d7c429a vim-enhanced-9.1.083-9.el10_2.20.ppc64le.rpm da4f2dd06d78f4ad61e9a749929df068dd215083329e44cfd5d67ca34a06fafb ALSA-2026:66349 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.11.ppc64le.rpm 4a8768c813778d7a90570ab1aa34fe19e3a7dd28f90f202fda0cbd2532079461 freerdp-3.10.3-12.el10_2.11.ppc64le.rpm 70f31da55a22f60b8318fe8b9cd6b342d5677347ad3c8b3935abc267c2faa2f4 libwinpr-3.10.3-12.el10_2.11.ppc64le.rpm a7518168463be872f94caeb5acfac98f9dd1679d56ef95cdda411e4bd770145e ALSA-2026:66355 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.54.1.el10_2.ppc64le.rpm 1ed7c8adaf002d3a9203aa7b71c051801b52506d73829e97b8c89a1b84568ba7 rv-6.12.0-211.54.1.el10_2.ppc64le.rpm 2276743d423e87073460553a5d1178b40fb7b42feebe14e569de1f9c1005f796 rtla-6.12.0-211.54.1.el10_2.ppc64le.rpm 2903a7014701d5641f419aeb1b4a99ce43b5d5b1e12b0c15dfd21dc569331fda perf-6.12.0-211.54.1.el10_2.ppc64le.rpm 65a526336723ae3479c19dc67ba3d0f36110e1fc2e6ed364071e7ad740b9e615 kernel-doc-6.12.0-211.54.1.el10_2.noarch.rpm 7211c764f3e75c59e014b6650c3e0ec6f19553aef6819b3853a7c4b27ea7a704 kernel-debug-devel-matched-6.12.0-211.54.1.el10_2.ppc64le.rpm 820e4341a15202c0a2f6ab5d76e3d8b31f7a8f7fb7e89e8df0c7feaa8ab9f189 kernel-debug-devel-6.12.0-211.54.1.el10_2.ppc64le.rpm 8fc1557d518ac8057badf79e742250a15f0f0a29fe5e79d59d346f87227a96fc python3-perf-6.12.0-211.54.1.el10_2.ppc64le.rpm 986399b9e138eaabec568a7b395652632bbf8228675d12b98944d337ab20d8a1 kernel-devel-matched-6.12.0-211.54.1.el10_2.ppc64le.rpm d925c079f470085af4e540094821fa4120dd90a07b40d6b47f641a9557806a96 kernel-devel-6.12.0-211.54.1.el10_2.ppc64le.rpm df9525625bf34730017a56c3284beba7cd69b334c3791791fc4af28acfd82387 ALSA-2026:66392 Copyright 2026 AlmaLinux OS 0 1 Moderate

apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fix(es): * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501) * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506) * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327) * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default apr-util-mysql-1.6.3-23.el10_2.1.ppc64le.rpm 19bb5b7341dee9cd7a64e9d4f1eba8e9ffefaa50a8c3cb63a9aa459a9d692e6d apr-util-1.6.3-23.el10_2.1.ppc64le.rpm 796843219bd02888208c51467f01e187b50180c015d04de81eec2c1a1ee51184 apr-util-ldap-1.6.3-23.el10_2.1.ppc64le.rpm 8b6c418916ed72fffe57125d0597df990e477bf1cee8f17bc5c1819131a2400d apr-util-odbc-1.6.3-23.el10_2.1.ppc64le.rpm b42aaf7b92550b2cfd5e8f077c646563de6cd61c83a336c2e33fe8441b965e31 apr-util-pgsql-1.6.3-23.el10_2.1.ppc64le.rpm bafba0b0f7f1543641e89e992d28f5b464020340e5d2364494923177df206171 apr-util-openssl-1.6.3-23.el10_2.1.ppc64le.rpm bbd4ac63f267c5a630dbedde50ebddad49b79f8aa9731540069339e9e410a9ae apr-util-lmdb-1.6.3-23.el10_2.1.ppc64le.rpm c68bcf6120239878175a8bcf423074217d359005f5a3dc299acf6ae7df798fdb apr-util-devel-1.6.3-23.el10_2.1.ppc64le.rpm f657d75c5403e65e4adf46a7a07e6f7c36205a2bbbef344e34102e40ac1fd6f4 apr-util-sqlite-1.6.3-23.el10_2.1.ppc64le.rpm f9451ae1641eecb04d9aaeb2f2eeb5491eb673fda6e721b4792a6b54c4e64403 ALSA-2026:66432 Copyright 2026 AlmaLinux OS 0 1 Important

osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default osbuild-composer-worker-165.1-5.el10_2.alma.1.ppc64le.rpm 14d665821def007dc7ded246bf3e2031ec3ae56a29eb758f0e991183a0d49488 osbuild-composer-165.1-5.el10_2.alma.1.ppc64le.rpm 6213c1b8b182a5378610ea15bbbee3dbfae1e42ffd636f28e7eb43f8bebf475e osbuild-composer-core-165.1-5.el10_2.alma.1.ppc64le.rpm 9127badee0841dae0423d7b14b37c2be4354b8e1c2fee9ab98e1c8ca1720048f ALSA-2026:66460 Copyright 2026 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header (CVE-2026-85150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gstreamer1-plugins-base-tools-1.26.7-2.el10_2.2.ppc64le.rpm 2641d9af9f864ed323635e99fe9f4a22dbb3c2ff6ebc7390b5a32b3570ed74b6 gstreamer1-plugins-base-devel-1.26.7-2.el10_2.2.ppc64le.rpm 5e603ddfa99b1dfb3b7576bd2ffbcc767b35a39c10531a4c7fb598a4fa941510 gstreamer1-plugins-base-1.26.7-2.el10_2.2.ppc64le.rpm bf95cc8b1fad6c8aedbabf61f08672b69bba93b703cc35eff21866e73146ac46 ALSA-2026:67129 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.15.0-1.el10_2.ppc64le.rpm c88975805d4ec855c8d74a00da8b0ddaf0533774986b74dc1237edeef1fad648 ALSA-2026:67147 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853) * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-tornado-6.5.8-0.el10_2.1.ppc64le.rpm c500363b5643527cf09ee5ccb889073eb4a8983b4b60d1fc8540bbcf7fbf49b9 ALSA-2026:67154 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) * openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) * openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) * openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457) * openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874) * openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073) * openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074) * openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075) Bug Fix(es) and Enhancement(s): * openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 10.2.z] (JIRA:AlmaLinux-212362) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssl-devel-3.5.8-1.el10_2.alma.1.ppc64le.rpm 1c2f362167e1cb3df6328b24137a83f11f5aa9c654fcbcb2c24a82a716844a3f openssl-perl-3.5.8-1.el10_2.alma.1.ppc64le.rpm 4b6fb9abaf28db01e3fc910f7ffe905d5621193df8bb74f174f64b947e035ffe ALSA-2026:67156 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-POSIX-2.20-515.el10_2.ppc64le.rpm 05e56975a060664171b205c84cf11bf35f8fbbca9f242b69dd823aacfa322ce4 perl-devel-5.40.2-515.el10_2.ppc64le.rpm 061ffed2c30a9302f40eae715eb2d376e33e2d38c70e7a31c4644063b1a6a186 perl-I18N-LangTags-0.45-515.el10_2.noarch.rpm 069d8a8848580110635885e2c251c7423daaed882265d3fe5c2f4465f09dd325 perl-vmsish-1.04-515.el10_2.noarch.rpm 114d1690b48e176ae300aa8758eb208c31d1b490b24d8ee9e87ba6f5d21cc209 perl-User-pwent-1.05-515.el10_2.noarch.rpm 116856c6ec904a94c4b9e26465c0f24d542f6ac279c1065c986de45686011ec0 perl-Search-Dict-1.07-515.el10_2.noarch.rpm 1a7a937662f78d99a2dc924c7f668c42980aca692656cf16a5a5d1e21e6a4315 perl-AutoLoader-5.74-515.el10_2.noarch.rpm 1b540d06f1b3584f80113b6c546b8864cd617dffbb8513045b03d7132e826012 perl-File-Basename-2.86-515.el10_2.noarch.rpm 20a9f2b8c608e5b9882e2d7cc64546b067e53ccd2148bbfee2b72c0bfae4b16b perl-ODBM_File-1.18-515.el10_2.ppc64le.rpm 22ee4a449cc1fecf9896e49973553361bede5d1186053b971827f212db27abc1 perl-Hash-Util-FieldHash-1.27-515.el10_2.ppc64le.rpm 280dea6f65ab9f48ecb41ff89a29f3d2bb7f2993530f7278e8af7952811d4e54 perl-ExtUtils-Miniperl-1.14-515.el10_2.noarch.rpm 2b7283b3c5536e3fd89917266b3465b22de4dfbf604834e918ccc589888a8a26 perl-Thread-Semaphore-2.13-515.el10_2.noarch.rpm 2d138bc731d07a757d3301cd9d65f224ad3c2a96be63b1b60cd24e1c3ddfd0e5 perl-I18N-Langinfo-0.24-515.el10_2.ppc64le.rpm 2fc2007faf5ba0f8a68cdc89cd84e6b7c24cd661e93824e3c1ad9eb07bcf96cb perl-IPC-Open3-1.22-515.el10_2.noarch.rpm 2fe04d10b167fa28ece32046dc240d5132475190736ac8dda602198c8b51e0ae perl-FileCache-1.10-515.el10_2.noarch.rpm 30820f41d03438df0a89b8dea91241e253b67eacf1cf81d8fff01551dd83ab5e perl-Net-1.04-515.el10_2.noarch.rpm 32c8b627ee7e2970b1dabfa3c1024adbd59dd604b26059aa8c2dd768f3843337 perl-Thread-3.05-515.el10_2.noarch.rpm 342387b69d0d36619df2041b925e664c5a207142020f6c17137a4ef5e7f9f184 perl-Term-ReadLine-1.17-515.el10_2.noarch.rpm 41bde263dee0557bb68f9f1d2baa8d57c8d3df3fba08a5d94ecdde225220d3b2 perl-Devel-Peek-1.34-515.el10_2.ppc64le.rpm 4296ba4ab787c8dc62713d33e37a1fee3162f7f9e6428b890f4e6febae1127d2 perl-Unicode-UCD-0.78-515.el10_2.noarch.rpm 4307fa601ecd6edee189194d08a35b90113a9dc2e1e1c6a6a66195ec18e8d8ce perl-Text-Abbrev-1.02-515.el10_2.noarch.rpm 43665b451f519dbeb4b8a05f066cc6481f8b6c143cf3e594852598a3a6b222ee perl-File-Compare-1.100.800-515.el10_2.noarch.rpm 4812e8816160f70feaec391bd210415bca4a44a5155b126c3fb1ef14674b80d2 perl-Getopt-Std-1.14-515.el10_2.noarch.rpm 49e8e4357d64fff7c22f72bda9bbab91c9393e87d6b40473e2f3e03a651d79ad perl-SelfLoader-1.27-515.el10_2.noarch.rpm 4d9f02c0fedb9b29b19bc90d97045e6d723657d1f214c7e2f2490390a781c3a3 perl-File-DosGlob-1.12-515.el10_2.ppc64le.rpm 51e926d466648dbf40dd1d142ab4364ef6109f6cd96feda027ce60ed1d1fab4a perl-File-Copy-2.41-515.el10_2.noarch.rpm 52be131ea7d5f9df8f083bcaadde9c8b8cf8165b5dbba326c37eee56e9525871 perl-FindBin-1.54-515.el10_2.noarch.rpm 541141d26cff39e511d41ad2e104dbedff7ae004eb7b60a75f1d264f0da639e7 perl-GDBM_File-1.24-515.el10_2.ppc64le.rpm 5635357a92f12783eb47bbaba77b7b2d911761679746af80db63f42600c91a21 perl-Memoize-1.16-515.el10_2.noarch.rpm 568f92b74173236bcdb6ffd602c20f30d5ce36ddc15a9ef60bdd9531791e5d38 perl-libs-5.40.2-515.el10_2.ppc64le.rpm 5a44f8c07a82d8135cb63fcdd412bd9538756c6019c76c826833012764b7a2ac perl-Dumpvalue-2.27-515.el10_2.noarch.rpm 5c387af29496631904e0e4512b0042204cdfe1760561da0a1a7779cd1b9432c1 perl-filetest-1.03-515.el10_2.noarch.rpm 5ea84443d067654a9188b0fbdea88de0a413a87cca469418d8a7a2c81a63eb47 perl-Module-Loaded-0.08-515.el10_2.noarch.rpm 5ec1d001a8904f13be93731dc3ee10d52fea7b19718e01dde887e892f9d59e9b perl-Time-1.04-515.el10_2.noarch.rpm 648dff6e0b21d2c42534adf498ff6f73ddc53f26c65c64ad56180a18d42fc119 perl-I18N-Collate-1.02-515.el10_2.noarch.rpm 680f8b26caf1903d88f8d96263ad903bc239369406b6895e6bc27ed923fbae59 perl-Symbol-1.09-515.el10_2.noarch.rpm 6812dec84019716837e33bae8700473e5b2e874091c1a288a8dbb1726153c5c2 perl-ExtUtils-Embed-1.35-515.el10_2.noarch.rpm 68dcc2966462f39ae38c5ebcae4c337dc9e0b06c3ea981844a143d3995c06753 perl-AutoSplit-5.74-515.el10_2.noarch.rpm 6b59cf08fb7286fb3f4198e45cd3d4f5006406267051a10617fb5304cd5266d1 perl-doc-5.40.2-515.el10_2.noarch.rpm 6cad19426ac95604a5cd8d62f8a8ffb5a38b8e8d807a982102a412825683beb8 perl-5.40.2-515.el10_2.ppc64le.rpm 70b922f07618e440e030379c5f9e297580c76c466eef033c52077ac8d7048abb perl-Safe-2.46-515.el10_2.noarch.rpm 72689b14d3ed67db6d8a591e812f40b77b791b19725266586057351632e00fd1 perl-Config-Extensions-0.03-515.el10_2.noarch.rpm 735ba0cc433b5cf1e24d38cde1b3370a929cb3d7e9d19a4191862d988e7e06f2 perl-overloading-0.02-515.el10_2.noarch.rpm 7696783c9ba2e5642cd1a30e303621daf02bf97a44f97abb2711b7d17befd20b perl-Attribute-Handlers-1.03-515.el10_2.noarch.rpm 77b3940fa81302f640a8fc18a554e27c5a3788da8a3c05b1f3e1bc3d75795a37 perl-SelectSaver-1.02-515.el10_2.noarch.rpm 7b99d763a3936e28b58fa9304fed7b558d8c71ad7e808a5751f3969dac867a76 perl-NDBM_File-1.17-515.el10_2.ppc64le.rpm 7eccdc665bbc776fe31ecb81c9b43411ac9623e91522af64224339a06674c8b6 perl-ExtUtils-Constant-0.25-515.el10_2.noarch.rpm 873bb09b54d407b9bf5ff9c9e00e0c0053f12ca3a38e094acf6fe08c2101501e perl-Tie-File-1.09-515.el10_2.noarch.rpm 8a33b58207a8349608b744f83eb4dc94995c8d4315559c15ba26bfd0793fac03 perl-Math-Complex-1.62-515.el10_2.noarch.rpm 8dc64964e85a19776cd9190076559c2f76282a5d55cc10f9dcdfe14dae924e30 perl-vars-1.05-515.el10_2.noarch.rpm 93da3932faa665745d14ccf5a9ddd860f562d08fbe184619cd4a7b8b274fe012 perl-ph-5.40.2-515.el10_2.ppc64le.rpm 9462155f0501f2ea223db90438b36dd839205bc1add1d1c8f6b4c2f6c6127d5e perl-base-2.27-515.el10_2.noarch.rpm 9be41847f8862fdbf8b1e5c6e81cd416a80f62bffde4ab2cddf02837e9ce25ff perl-Devel-SelfStubber-1.06-515.el10_2.noarch.rpm 9bf0cebe98e3c5d7c7391fc556d152673f3f4ac637e62559e72f00322c9665ae perl-DBM_Filter-0.06-515.el10_2.noarch.rpm 9c44ff926043c1465c2b3f769f5d460af437848027936af2885671f71c45b6c3 perl-utils-5.40.2-515.el10_2.noarch.rpm 9cf990e411b795dac07fb0e455ab88d72d70095974d3606451d554b1a89ed148 perl-Errno-1.38-515.el10_2.ppc64le.rpm a26775232fce0fa740f528691a57a3d4b48b2e76dd3f96e9c2d4030150a0a305 perl-subs-1.04-515.el10_2.noarch.rpm a45bb41b5f9be010da79ffbb237a445e115026b6a66594ff029d7993071754f8 perl-Tie-Memoize-1.1-515.el10_2.noarch.rpm a59eb6b1ae8899f296df3fcf49cd61046571493289821a2c792002f2a31c4027 perl-Time-Piece-1.3401-515.el10_2.ppc64le.rpm a5d4e5245ef7e0141ad95a439a4c4bd6fdfb770b2f1092e8a32f7054761ee469 perl-English-1.11-515.el10_2.noarch.rpm a81d60d0b8acf592731701a57479d115867187afff5573bd5a82fe8b130972a1 perl-IO-1.55-515.el10_2.ppc64le.rpm a9f9235115d804d6751452a5ad28783475e4118cd7dccfcdabe6f1918d5cc50f perl-Pod-Functions-1.14-515.el10_2.noarch.rpm ac655c5595560dcb46f735702ea26b21b12051be8238ba0d5e0a38ab6f6b598d perl-Locale-Maketext-Simple-0.21-515.el10_2.noarch.rpm ae46f3e2dc6318944c86ec74827ce3532cdb6a197c6944b69e880923c4c65136 perl-mro-1.29-515.el10_2.ppc64le.rpm af5e718e7568e79040c3ce1c823e433943914fb158118415ac2e2fd3657066e2 perl-less-0.03-515.el10_2.noarch.rpm aff27fa71a37ec8dd7133ac6cfe955671da4baaa92fd1ce496e7930d188a4556 perl-interpreter-5.40.2-515.el10_2.ppc64le.rpm b3fd1af6582513e3f5f8d8bbe8f6d780a348a9e5d67fe6aea172e7d5d4028519 perl-libnetcfg-5.40.2-515.el10_2.noarch.rpm b6dd427dc290c38944e15a0c841f529374558fd9cc21cdb584dd0c8fe7bf32f7 perl-Benchmark-1.25-515.el10_2.noarch.rpm b7973b40a45771d3dfd56138ebae057d2fbaf20fda1998e379b0210fd9be01a1 perl-encoding-warnings-0.14-515.el10_2.noarch.rpm b8ecd57b3ebe7a0915a2932be16e7cefb2daa9d9c21ab1bc51e41bc4b14f252f perl-NEXT-0.69-515.el10_2.noarch.rpm b9d74ebb73608e7ae8a41f1845f6ddffbde82b348053bf57d772c4cf1298e2f4 perl-DynaLoader-1.56-515.el10_2.ppc64le.rpm bbc82d4c179f14e38114edeb15fe74d7e84c582e88252f67307d0dc7745e360e perl-Sys-Hostname-1.25-515.el10_2.ppc64le.rpm bf13503f3b6fb8736f4c9cb40d9cb0ab46a920a555084789b5ee15c8bc2659fe perl-deprecate-0.04-515.el10_2.noarch.rpm c05f4aa40a78c4f09380639cbcbbbd486d773026ea9acccf16495fcdb03be30f perl-Test-1.31-515.el10_2.noarch.rpm c070ca356ba1f71ae941a4b48c70eb6eea140fb8851e89fe70b444e7c15c5a25 perl-locale-1.12-515.el10_2.noarch.rpm c17fc22826e6adf2289f1e63d4d28f43d7938df26a23fabca9f891cd7a93313e perl-sigtrap-1.10-515.el10_2.noarch.rpm c4a150e1b3c392d2bb8602ece64c0a1216c248abcea67c2a9379cb46a1911ce8 perl-Hash-Util-0.32-515.el10_2.ppc64le.rpm c73038cf8408784cbf87cdc16e60e9f651496afb1f840b5491d1956d8fbe0e15 perl-DirHandle-1.05-515.el10_2.noarch.rpm c74ec5ab698006562d3ebd6b4dcbd879c336390d3e5cca29cb4cce85b85b5a7d perl-diagnostics-1.40-515.el10_2.noarch.rpm c8f1dc682cb1f2bf17efbda24578b0e02926b13a3e818a6d145dd4265d6ece39 perl-autouse-1.11-515.el10_2.noarch.rpm c92493fe5c4a3219b4b5313325c3ff68fc3d174cbe86b442e42cb89e470aac60 perl-blib-1.07-515.el10_2.noarch.rpm cc2a05ecd7afe0c7472aafc23a4ebe0fc7d88f744f8db7f22c533cb55779d38a perl-Pod-Html-1.35-515.el10_2.noarch.rpm cde6d99dc6bedf83080168ce89ab7278dbae79370c09def2315c05a847acf9dc perl-lib-0.65-515.el10_2.ppc64le.rpm ce92c8c81dc54d409907798bbbf04c960ee90762df78c4c78a01d9bb989b7e41 perl-File-Find-1.44-515.el10_2.noarch.rpm d2938662e54a406e838d0dd5c4ea5832760add3e33b8ef1251185069975d53a6 perl-overload-1.37-515.el10_2.noarch.rpm d3c7074b151fa50dc7404bf110e451f8a9847525e8e29fd17009086ae4ebb2e4 perl-Opcode-1.65-515.el10_2.ppc64le.rpm d4398c652199eaf5381f3a5088d5c0dc9d6b29d536d0f7f81361ea09aa0e8c66 perl-if-0.61.000-515.el10_2.noarch.rpm d81719bd35a08f147b531c2c7251abb2fdd658f32d157ad322f18d5db317b398 perl-fields-2.27-515.el10_2.noarch.rpm e70d012a4965534f70adb38c3bada5c20cbb42fc8ab2e8b685cba1d6ae51ac75 perl-Tie-4.6-515.el10_2.noarch.rpm e7694d6af15a4e0a27f0f2619e94bf0671e47509e7b2fadd52f4f6e193ada11c perl-B-1.89-515.el10_2.ppc64le.rpm edceec0d46c02396cd6ad92f46b183e720024e76e835f45e41d04b3627af6d92 perl-open-1.13-515.el10_2.noarch.rpm ef32423ccb9fb8aadb65d75956ca93b17f2d48ad869a00265d5b18e074f9e67d perl-sort-2.05-515.el10_2.noarch.rpm f00ca350e4e5d6843b1ed839dabd26abfce7f303dffa9b76559b86b7160eef9c perl-File-stat-1.14-515.el10_2.noarch.rpm f31ab167489a383653e674718b8132503908c89658587c11e60a45911165c658 perl-Class-Struct-0.68-515.el10_2.noarch.rpm f67705171349b9de0f487263220dbf6cb9e59eb628540da756ce686222c81324 perl-Term-Complete-1.403-515.el10_2.noarch.rpm f79ccfdef83bcc3d0425411387915ed8065e98f2ceb6fe02965034b5ade87dbc perl-debugger-1.60-515.el10_2.noarch.rpm fb02e587b5524c489f54e76bb0796c696e9a08765198c33a0f44aa81847457a2 perl-FileHandle-2.05-515.el10_2.noarch.rpm fb1ce05e33fb4e041f6807b80f5895d12700cc578bc662ee3681533d04d61e27 perl-Fcntl-1.18-515.el10_2.ppc64le.rpm fb3d9cb68625a3566b87f8955d00d7d2e01e8784bf53153f0797a8d9f7fdddba perl-macros-5.40.2-515.el10_2.noarch.rpm fc7b48c861b581799e1c2bfb69697896fbacdd6dc84be691b3671b469cbd76bc perl-meta-notation-5.40.2-515.el10_2.noarch.rpm fe5a31ee08cb8e227798d7a83e589736648047ac72ce10ce68043d70bf3bd8f0 ALSA-2026:67166 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile. Security Fix(es): * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql18-postgis-docs-3.5.3-1.el10_2.1.ppc64le.rpm 15962dab3e263ff251050e741da44b5e526ece7bb3db645d7f0af52674b18845 postgresql18-postgis-utils-3.5.3-1.el10_2.1.ppc64le.rpm 30d460790fe60d131a8f75caa1d10934c20e390463dd573428915574f8f2805f postgresql18-postgis-upgrade-3.5.3-1.el10_2.1.ppc64le.rpm 7fc829df1bc0e3a8be3c033d29f86fd09f8036f35a3d481ca54059a49d83139b postgresql18-postgis-3.5.3-1.el10_2.1.ppc64le.rpm a5f069fd1d62144c87d84f7fea645e4e3c43fcb45530b784a60b1278bd90698f postgresql18-postgis-client-3.5.3-1.el10_2.1.ppc64le.rpm a75b195764f5ae04cbcd3581ea08ba262f892fcd372592e4771de969dc51b230 ALSA-2026:67280 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql18-private-libs-18.6-1.el10_2.ppc64le.rpm 11cd2b14df233fe6181dcb3df3ecc1b6005a64e4437b6ae706315980d2f037c5 postgresql18-docs-18.6-1.el10_2.ppc64le.rpm 12ecab53304c4cb2d63888eebecf7508876fe93e094eba0a14bc8e56461bea60 postgresql18-upgrade-18.6-1.el10_2.ppc64le.rpm 1713bb1476e170c36ca103a11be729a7b11c34e3ae85ddb72ba2a448f365fd82 postgresql18-contrib-18.6-1.el10_2.ppc64le.rpm 256db3f5276ff6754f73bebfa74051f6707cd9f945f0ea94dc6f2ef4bbdf1e1d postgresql18-server-devel-18.6-1.el10_2.ppc64le.rpm 324f99b79f4fd00343eb03c5a5eee44502c9bd4cf0dd7bee745c8871a366c67e postgresql18-18.6-1.el10_2.ppc64le.rpm 42da6d994052b67e21df4ab584239659ba077d235970d216eefa45082b873923 postgresql18-static-18.6-1.el10_2.ppc64le.rpm 42e51f730cc2e84c31f07653560f4edc54251d30e79b041275ff25c4ddf60690 postgresql18-plpython3-18.6-1.el10_2.ppc64le.rpm 74d320f039c0923d89eaf22f7c78166b360bb646dfd2e2a30bf727985f87fb25 postgresql18-private-devel-18.6-1.el10_2.ppc64le.rpm 75586b14ff9b0243322ee63baa0af8619c7a2f90c11f2d3613e9949a6d711d1d postgresql18-upgrade-devel-18.6-1.el10_2.ppc64le.rpm 7e3bda893f7db83fc15560a15c0b3b187bb0f7c76b162a1dda3a88f85563d0f0 postgresql18-plperl-18.6-1.el10_2.ppc64le.rpm 852ff0bf15120718b5829f9f33fbd492be346c63db94b5ecfccc10246af4e9db postgresql18-server-18.6-1.el10_2.ppc64le.rpm 88fc27160107a7eb8e694291f257288f13460756e39536ecfd9dea9365a109fc postgresql18-test-18.6-1.el10_2.ppc64le.rpm e3efc667426e63b2ec36774e5fc4386975ee246fa665f9ffb03e9bb1e2b6fb0d ALSA-2026:67286 Copyright 2026 AlmaLinux OS 0 1 Important

rust security update

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es): * libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server (CVE-2026-53587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rust-std-static-wasm32-unknown-unknown-1.92.0-2.el10_2.alma.1.noarch.rpm 0138e6cca138e3a8bd6140d713af45cad285722fdf927f02ee745a5170eaaf11 rust-debugger-common-1.92.0-2.el10_2.alma.1.noarch.rpm 066364c3cf81426f4483e19c67d727520f30fb4946106f8163cb8d7ef1b57c3e rust-toolset-1.92.0-2.el10_2.alma.1.noarch.rpm 076c2a9168005bc63f127403b7ba6ed47e6888351515f4e711c7257770e7a693 rust-toolset-srpm-macros-1.92.0-2.el10_2.alma.1.noarch.rpm 0ceeb326c7211eeb9140d0ea6d45b8d21a41469f24b87463f3b664fe7fd67c4d rustfmt-1.92.0-2.el10_2.alma.1.ppc64le.rpm 24219697f9ceef9a961ea49b0edf8331e7872756af4503daa130799f0be16a72 rust-gdb-1.92.0-2.el10_2.alma.1.noarch.rpm 36416c11e35f5a7ed2f73b8fd1e17ac9c268d87e61a02b736141c00f43e837d0 rust-src-1.92.0-2.el10_2.alma.1.noarch.rpm 3a191c97568b6ef7689a8161ad1e6f84a2c0b0d8d589b9b2c435126799f2afce rust-1.92.0-2.el10_2.alma.1.ppc64le.rpm 5d16425d3ebe2ab59280844e91593192cf21ee54fff7dd93dcc7eb2aa347f471 rust-analyzer-1.92.0-2.el10_2.alma.1.ppc64le.rpm 60e2787ee9900b66d8e12cd2c2f59ef04498e05725bc014bedc014c4d386c1aa rust-std-static-wasm32-wasip1-1.92.0-2.el10_2.alma.1.noarch.rpm 6b59c9879cc5f8495b5c0dd0629cda1e72584f6b770fba245605007f4c8b070b cargo-1.92.0-2.el10_2.alma.1.ppc64le.rpm 7488eddbca64ca65fe8e894654a8110733a426802874fb68a88bf32a72cdfa45 rust-doc-1.92.0-2.el10_2.alma.1.ppc64le.rpm 8e410c1cdb766bacb83fcb084af14cc377a53e2521af2420033cc05e80c73912 clippy-1.92.0-2.el10_2.alma.1.ppc64le.rpm b20ac9b962f0e0506546e65af70fff9eb84f19378e25ff5b1ba1d12e9b8fa933 rust-lldb-1.92.0-2.el10_2.alma.1.noarch.rpm b5fd5f65f431e4ce5bf5b35b1763ab998bd818db537d321ba792bf0a1f0ed29c rust-std-static-1.92.0-2.el10_2.alma.1.ppc64le.rpm e25d0a59f63711d5958ce8ecdd7bfb898c647da2542c6a1223189d2bf82c38be ALSA-2026:67314 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nginx-mod-http-image-filter-1.26.3-6.el10_2.7.ppc64le.rpm 20247d460638cc880ede3120dfbe97cff362fa95c898fde2b2d18c2d79827e35 nginx-mod-stream-1.26.3-6.el10_2.7.ppc64le.rpm 3229622d9e125d39d32498042e0e756dcae211f755c460fd9aca5261f38f49fd nginx-core-1.26.3-6.el10_2.7.ppc64le.rpm 6f641d3404c10a9e4fe4db4e146c369d6b3b01b91975f574c211106084f65eb0 nginx-1.26.3-6.el10_2.7.ppc64le.rpm 95555585736188a311fecffc9615ce4c86291ea6820295682fffcfdef7f35c21 nginx-filesystem-1.26.3-6.el10_2.7.noarch.rpm 9e02356ee55819abf5dd9f44929c35a20fae932d02ce8934f7cf4b184f83edfa nginx-mod-mail-1.26.3-6.el10_2.7.ppc64le.rpm a6f15c5f0d0ecb6d251b7ed9b0feb9a2779c4a8dd79ea55ffe429feffe7a1df2 nginx-all-modules-1.26.3-6.el10_2.7.noarch.rpm c401bf9f42c3bc11357a0635ba27b08076df988c187958490043e82bcf9ca248 nginx-mod-http-perl-1.26.3-6.el10_2.7.ppc64le.rpm c56d0f8939626dfa7d3f37b705de7f0f773c87e955f1df11052a1f4906a45f30 nginx-mod-http-xslt-filter-1.26.3-6.el10_2.7.ppc64le.rpm e39835676f56af3f3555565e6620b807e8f4ce00f4453cb89603322df0c9422c ALSA-2026:67463 Copyright 2026 AlmaLinux OS 0 1 Important

rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455) * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457) * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461) * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802) * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785) * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783) Bug Fix(es) and Enhancement(s): * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsync-daemon-3.5.0-3.el10_2.noarch.rpm d9eeb4e538648566b7bc50ebdf47325f2158a1f110be3d5a1451d1dbf7b786e9 rsync-rrsync-3.5.0-3.el10_2.noarch.rpm f379c5d18d7e720110d224d854c2e2796f7af861e7e3c5b78903eaadc9caa299 ALSA-2026:67471 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035) * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233) * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731) * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.55.1.el10_2.ppc64le.rpm 16552ac96826c7d36933062a9ff63942e7b49ae7e51c7222049bf0b857926d0d perf-6.12.0-211.55.1.el10_2.ppc64le.rpm 17854030c0f4ddf5f9aa4909cfdeabb5febb4037bb896bad0089c7167b3d0a20 kernel-devel-6.12.0-211.55.1.el10_2.ppc64le.rpm 3c16a5580ab9da085654da866d5cd6f785954af06359727053aac9a2ced22522 kernel-devel-matched-6.12.0-211.55.1.el10_2.ppc64le.rpm 3db079fedde8edfe113a40f9d00d99c58e6eeeade9cd0ffc1ad74c26a95b0be0 kernel-doc-6.12.0-211.55.1.el10_2.noarch.rpm 417f2ca88de88049f750692aed24d02c1aae2bdedac4761c6e14342603e41806 rv-6.12.0-211.55.1.el10_2.ppc64le.rpm 467553736bbb782da83a7b0d99a16d212f07fad9537ae79972bdf9b8d4f59440 kernel-debug-devel-matched-6.12.0-211.55.1.el10_2.ppc64le.rpm 764faa6afd8b350a4086ea5a84cb03d9dad7c4241ec2490a67bfb82338db58d5 kernel-debug-devel-6.12.0-211.55.1.el10_2.ppc64le.rpm 90ee67413c4dac7441b60d09baa3f820718c7c820ccb4fa572be3824f45657d2 rtla-6.12.0-211.55.1.el10_2.ppc64le.rpm c9045315298374eb37b9a6f9b4a3afd97bd1a70f44098c456483bb5508158311 python3-perf-6.12.0-211.55.1.el10_2.ppc64le.rpm d2f55a926d7e33f181161de9ee919ee18baed3525ac9efd2ce0bb615d85468bb ALSA-2026:67525 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-10.2.z] (JIRA:AlmaLinux-252248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-runtime-8.0-8.0.31-1.el10_2.ppc64le.rpm 00b000dc780e25e1eb09d5e87482c5fbcd20e64752f195c227749f0536d80970 dotnet-sdk-dbg-8.0-8.0.131-1.el10_2.ppc64le.rpm 0fa1fcacc1a94a672645e7b6a2017ac2206bca66d6f3359b3cd5068fdec0e9ec dotnet-targeting-pack-8.0-8.0.31-1.el10_2.ppc64le.rpm 11f1631e3f7680d5753347d7f4c857360e547f4d6c7ce7800df25c28752e36e5 aspnetcore-runtime-8.0-8.0.31-1.el10_2.ppc64le.rpm 531efa8698c3844f48bcad205610071abe8dc7aed2b197f9ed8abe337b2053d3 dotnet-templates-8.0-8.0.131-1.el10_2.ppc64le.rpm 557216b4bee7058a41ef00bccfa22b55a36331fbf56509f4bfae9d2be5119c85 aspnetcore-runtime-dbg-8.0-8.0.31-1.el10_2.ppc64le.rpm 60d4d28636dace7f613b02f24ccc4d708304e8218fe56efffac10044dbef434b aspnetcore-targeting-pack-8.0-8.0.31-1.el10_2.ppc64le.rpm 812d573185f9492c0742b33465987bbde12503f119ce775bfd07fe7075d7bd54 dotnet-apphost-pack-8.0-8.0.31-1.el10_2.ppc64le.rpm b43c293cb2f6fa6ca136c3307a0847d4bb31e9ce324bfeacec98b632b040bd8b dotnet-hostfxr-8.0-8.0.31-1.el10_2.ppc64le.rpm c5d5296bfaa8da50bdafdb289ce83e73954e079e1310e2dcb5bff1891c7e6736 dotnet-sdk-8.0-8.0.131-1.el10_2.ppc64le.rpm e0e34c710d0851e648f3b10559520ebb1a017da13d49f9cc6efe099dd12abca7 dotnet-runtime-dbg-8.0-8.0.31-1.el10_2.ppc64le.rpm e25569a83ad8473738bac3752511dccbfce706fe6c6988b067eaa7a4c1e2171e ALSA-2026:67528 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-10.2.z] (JIRA:AlmaLinux-252279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-targeting-pack-9.0-9.0.20-1.el10_2.ppc64le.rpm 1dee661eb32a82c6eb66a45dea1430b286b3b1ef19cba71c520c89a4bae4555b dotnet-runtime-9.0-9.0.20-1.el10_2.ppc64le.rpm 25a6dc7966ec809f79bd2d5020f398829bd16a76523e05f35c459e3574272385 dotnet-templates-9.0-9.0.121-1.el10_2.ppc64le.rpm 2ac2c91287fd6fc17fa4e1e0aaccb97a641f41d4a7e6e0a3e5c505cf91447810 dotnet-hostfxr-9.0-9.0.20-1.el10_2.ppc64le.rpm 31ccd8362c6dc19ab767afed91cc008ca03162e80b11bebd44c5c5e7dfee46da dotnet-sdk-dbg-9.0-9.0.121-1.el10_2.ppc64le.rpm 4a4b47f1b3e8a8e5b8c6120b46ebb7b5e0816388b576e2efcdabc40861dcaef3 dotnet-apphost-pack-9.0-9.0.20-1.el10_2.ppc64le.rpm 52e59f17d52e41778d470eece5c99f62a543f006d4ababff52a9cebc46a0cdd6 aspnetcore-targeting-pack-9.0-9.0.20-1.el10_2.ppc64le.rpm 6156bfc5e3438acb470d05f20c15ca92c6200f6acde1764d87618948f8fbfbd0 aspnetcore-runtime-dbg-9.0-9.0.20-1.el10_2.ppc64le.rpm 94a0b9b04fcfcaadbaa1af86837a3fd63c35a44cd550f4ad64131ba71fba40aa aspnetcore-runtime-9.0-9.0.20-1.el10_2.ppc64le.rpm c37f08973199450cf1014e8c0d02f13a8bc32e4fcb96ab91a0955b87ec130719 dotnet-runtime-dbg-9.0-9.0.20-1.el10_2.ppc64le.rpm cc1fddb4ba7ec7fb031b9bfaa3e063be6c90a9f4306d5e512b53aa56136d63f3 dotnet-sdk-9.0-9.0.121-1.el10_2.ppc64le.rpm d481c28a0e748621ffdf4f3a41ad41adbce0c49e56e88f6a89068a7310f2782c netstandard-targeting-pack-2.1-9.0.121-1.el10_2.ppc64le.rpm f7d6c69bc179668a27920fa5a5d5c442a8a6a6530d9e420da477c1ce95ff16e8 ALSA-2026:67530 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-10.2.z] (JIRA:AlmaLinux-252320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-runtime-dbg-10.0-10.0.12-1.el10_2.ppc64le.rpm 1e427bfbacabf3eb64ab884f4acfba90f8c4f6c868aa9a0fe4f516d2b8fc1c18 aspnetcore-runtime-10.0-10.0.12-1.el10_2.ppc64le.rpm 31fe4a7f7630709150fcc4e1b14ea7727da8af7d3c064028237c8f751fb4f93c dotnet-sdk-dbg-10.0-10.0.112-1.el10_2.ppc64le.rpm 53a4b78f7fba1f0a78f3bc92bfcab188a5d04170e0812ffd84174162fe311551 dotnet-sdk-10.0-10.0.112-1.el10_2.ppc64le.rpm 670f63cbbef51602c073583eb211ff5431d845d7cd7639835883ef0de2bcf143 aspnetcore-runtime-dbg-10.0-10.0.12-1.el10_2.ppc64le.rpm 761ff14feed07be03e63a2534d438d3653318b7c88fb93b37b011d0afa9bd8c9 dotnet-apphost-pack-10.0-10.0.12-1.el10_2.ppc64le.rpm 7fed3451a3ad61a7c0f36c31ababd54fd1957b73b0e5fa54f41f93d6e33c35d5 aspnetcore-targeting-pack-10.0-10.0.12-1.el10_2.ppc64le.rpm 862aead748d2dcf7c068d9902f2b4309628b6045a553c5063ba886f71402527b dotnet-templates-10.0-10.0.112-1.el10_2.ppc64le.rpm 98494ee6020b747c9b358d80d064ed49bfa269bccd4e433cd12acc3d8774a426 dotnet-runtime-10.0-10.0.12-1.el10_2.ppc64le.rpm 988603aa115295f93585cd0e35d873de739e0bd12f1d5ec04954433a64bd3a22 dotnet-host-10.0.12-1.el10_2.ppc64le.rpm c5b732e3c0315ef5c0109a59e490e03a50b90ee01c1de7da2ee831d9d5095430 dotnet-hostfxr-10.0-10.0.12-1.el10_2.ppc64le.rpm c61a5c2ed9a35621daa28adc958030bbd7b0ad350bb01fffbd455250208002a4 dotnet-targeting-pack-10.0-10.0.12-1.el10_2.ppc64le.rpm cbe848b776fcbc74833323fb72eec5737ae9acd7d0e7f32339face6f2b201aff ALSA-2026:67584 Copyright 2026 AlmaLinux OS 0 1 Moderate

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsyslog-pgsql-8.2510.0-5.el10_2.1.ppc64le.rpm 0fe96d5e4fa43a158c5e86ba2b9594c11d1aac9721046045858da8f445c96699 rsyslog-mmaudit-8.2510.0-5.el10_2.1.ppc64le.rpm 1922fc928a8d294b6b36fb4b93969a48e0ec4ccc35aaafe6fabc27bfa0ff49ea rsyslog-gssapi-8.2510.0-5.el10_2.1.ppc64le.rpm 2e3db8a03f0303213c329a46d244fec99c11aa168ea62767da40a24dc4bddde2 rsyslog-udpspoof-8.2510.0-5.el10_2.1.ppc64le.rpm 3bf0e82cce3848f72342b06315bdc3b5cdafc4836765e338e81fb7b66d580de3 rsyslog-elasticsearch-8.2510.0-5.el10_2.1.ppc64le.rpm 3e1e72a633dd2ed74a8414ba62900aa741436ccf75fdfa5b2088ef624165db50 rsyslog-mmnormalize-8.2510.0-5.el10_2.1.ppc64le.rpm 403eaae25d8390f47b18444b50620e806336eaee239bd060bd124621a7a2da0b rsyslog-openssl-8.2510.0-5.el10_2.1.ppc64le.rpm 50302d7d7863fe33d48183948679f687cbfafd22a6cdb0d914f19b78f7222986 rsyslog-doc-8.2510.0-5.el10_2.1.noarch.rpm 5eb376ccbd5574465d95f79c551faadf1b77b055b2e397074abdf8290145b706 rsyslog-mysql-8.2510.0-5.el10_2.1.ppc64le.rpm 6e2d50bcfd1d553bc206191389e8235ea4c5bbc2a793a6e2efb47c4b39254925 rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.1.ppc64le.rpm 7e2806012ae93b55f70c797e985d25e73c61109e390bd34e3b0237d5b8dfd1e6 rsyslog-mmfields-8.2510.0-5.el10_2.1.ppc64le.rpm 8595aed40f398ff2187e19b3474f0762cbd58b31403e423d96a05ca5f886bf99 rsyslog-omamqp1-8.2510.0-5.el10_2.1.ppc64le.rpm 98a56860c6f316651150a00954e7d7fe44fdfff7eb14ce2158d99db00a98bf43 rsyslog-mmjsonparse-8.2510.0-5.el10_2.1.ppc64le.rpm ae5d377aa55af1783be7c4fb540c00d37f988696c458a6235a52d1c5cdbe1599 rsyslog-kafka-8.2510.0-5.el10_2.1.ppc64le.rpm b5d47a9805acb6245c26b4b6d5973b9e1a669f342e35b2fec3ad47cd0e0d5eaa rsyslog-snmp-8.2510.0-5.el10_2.1.ppc64le.rpm bb811822116c6b5b55a25707d008ad4e11755b7123a4b998bc4317b7185892ea rsyslog-relp-8.2510.0-5.el10_2.1.ppc64le.rpm c8bb40453ac17cbac049369baf81dadc80ab95793941bdbb827d00b218129a81 rsyslog-crypto-8.2510.0-5.el10_2.1.ppc64le.rpm d5685dbd515e3b7d34fc2467e434af977d8e595a80c7babd1c3fc3fa82c9a01f rsyslog-gnutls-8.2510.0-5.el10_2.1.ppc64le.rpm d6abec5be398a21d718f930f31d9cc21ac1f650c59e366b90ca1d5e80507cf82 rsyslog-mmkubernetes-8.2510.0-5.el10_2.1.ppc64le.rpm db919c5511f99b6f93c6d32950e26f3c242a9023f32f72bf453d0df0e63d8b32 rsyslog-8.2510.0-5.el10_2.1.ppc64le.rpm f1cbc140d74f6a2b09ff70b976eb49639ec46199c0690276e498bf59632d9325 ALSA-2026:67872 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default corosynclib-3.1.10-1.el10_2.2.ppc64le.rpm 9cd229b3d7686abd6ad101d93895c54e2334c536922ecff31d73fc22975fdf74 ALSA-2026:67909 Copyright 2026 AlmaLinux OS 0 1 Important

libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fix(es): * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385) * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libevent-doc-2.1.13-1.el10_2.noarch.rpm 8f97e5ea7d9bd2f38f36ae5c546a1143c2438ea22193be05cfb08d3a9e3159b3 libevent-devel-2.1.13-1.el10_2.ppc64le.rpm d009564e64e138c5114c59b2b5ad90faabe88d3b8e59670866051a9a836cf155 ALSA-2026:68235 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709) * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711) * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload (CVE-2026-85197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.14.ppc64le.rpm c422e5b216c60b01d4398d7bc437c8d9c3e1b643faf1261cd3796b9514abaf97 libsoup3-devel-3.6.5-3.el10_2.14.ppc64le.rpm d0eb95d23f7bbcc93697fac6a3a0213f0288d50d90a13ad169c653d9df2d48dc ALSA-2026:68291 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-unbound-1.24.2-7.el10_2.5.ppc64le.rpm 06ff28fc258893cce3df7f04a9fd6e6e94f78ff143cdb5912419eccad4902ca0 unbound-utils-1.24.2-7.el10_2.5.ppc64le.rpm 3b2c14766cf5fdc704c0a818775aa8591dad897fe0ac583d427d0cd1a5da660b unbound-libs-1.24.2-7.el10_2.5.ppc64le.rpm 561e5df306ffbc1da54a874452d4c6891d095df6ee212f15bbcf6a96955d4ae7 unbound-1.24.2-7.el10_2.5.ppc64le.rpm 94ffc193d0bbcd8b334f3ec35ff60707d41431db6272c92830d0d61c2148361c unbound-anchor-1.24.2-7.el10_2.5.ppc64le.rpm 9af62a8b50842f267d4575339daeb307066fe5cbcde9dbc9a232d08e1e49e049 unbound-dracut-1.24.2-7.el10_2.5.ppc64le.rpm ead93084d3272c7fcbefd9ce1a321e4f86ab29c92903c05b0666d5b129bebe12 ALSA-2026:68507 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: netfilter: handle unreadable frags (CVE-2026-64414) * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) Bug Fix(es) and Enhancement(s): * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z] (JIRA:AlmaLinux-254105) * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225) * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516) * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518) * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-6.12.0-211.56.1.el10_2.ppc64le.rpm 53f8d73ff79eefea13c60f4c23855c7f6cf2f1e29d222ce3b26e6faa7ecd8bf2 kernel-debug-devel-matched-6.12.0-211.56.1.el10_2.ppc64le.rpm 6c89b72ad6578afe0707e2bf88eaf1827b1f82bfd98aa23269364b1f3b9132f6 rtla-6.12.0-211.56.1.el10_2.ppc64le.rpm 7d860866021f718a8740280e6a5c43ccb21d6ea9d03a9bce046c5183cb59087c kernel-debug-devel-6.12.0-211.56.1.el10_2.ppc64le.rpm 8ad17ce07be26d9e64ff0251d39f20a8aaaaf0622904a4df144c3ef8cf8bf69d perf-6.12.0-211.56.1.el10_2.ppc64le.rpm 8e5a5b9bcfbb44e21ffee01ba36216c2ff988d6a4c0d24849f44639f4ac6f8e3 kernel-doc-6.12.0-211.56.1.el10_2.noarch.rpm 9ac495690b0f89bc57aec2d253ec27914f0238abd009f57c498b6a2668c73807 rv-6.12.0-211.56.1.el10_2.ppc64le.rpm c24962030e42068c7fbc42d771231822332ca51ad04067da513a4121ae05151b python3-perf-6.12.0-211.56.1.el10_2.ppc64le.rpm f488bc7ffeba8cdc1cca1e6dd46865749e5d4320bca023797cccb09cb0b569e2 kernel-devel-matched-6.12.0-211.56.1.el10_2.ppc64le.rpm fa85994e129b9186d951b28202d86aa537a3f55d976b9211dda06609a68ff1c1 kernel-headers-6.12.0-211.56.1.el10_2.ppc64le.rpm ff8e798204cb16414677660c59013a04c6606f376129b9c304af251221089cb0 ALSA-2026:68651 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat9-jsp-2.3-api-9.0.120-1.el10_2.alma.1.noarch.rpm 079235eb90790724bd53fa760599c4fabc2ca146f0df04dc03b825473f6929f0 tomcat9-el-3.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm 127036aa147028de0c591c915f5913b3c80dbbbb60b91558081f3842befb9deb tomcat9-9.0.120-1.el10_2.alma.1.noarch.rpm 4345bedf4762f697d7820e4c40e33db6d512fbb7bb3aa1bb1736a9517eb26bb1 tomcat9-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5438a76184cee45e329a47afa3263e09dfcd6150cbd0ff81c9aa64f29718fbaf tomcat9-admin-webapps-9.0.120-1.el10_2.alma.1.noarch.rpm 5abf8cce64844d9b8d793f656ee9059ff88d5778b36b2132610327becea70b50 tomcat9-docs-webapp-9.0.120-1.el10_2.alma.1.noarch.rpm 8f39945c344abb46ae48edaeeb08c9422248d21b0fa78a5168faae09fb3f81ef tomcat9-lib-9.0.120-1.el10_2.alma.1.noarch.rpm c47704f2da56adf112c8a1acc1d7fe27bb3e7896bbfcbcdff7dcc0673fda1877 tomcat9-servlet-4.0-api-9.0.120-1.el10_2.alma.1.noarch.rpm ddabae1dd27c35dd4cee5c1eae2a7f3dd9d8d1aa22810be1c19a7df07b7d56ed ALSA-2026:68692 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security, bug fix, and enhancement update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Policy bypass allows unauthorized program execution via execveat (CVE-2026-82474) Bug Fix(es) and Enhancement(s): * Use canonicalized path if user path contains ".." (JIRA:AlmaLinux-212546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.6.ppc64le.rpm 43bdea08defbaf5dd4c0dfb3572ae3e1f58b8f557c1c6af46c7493a6d6f5b6e7 ALSA-2026:69099 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-worker-package-manager-0.2.3-7.el10_2.8.ppc64le.rpm a1dc823e27dc5ddac000f16a7a18c409c80cc049f5f9035e781701a842749e8c ALSA-2026:69125 Copyright 2026 AlmaLinux OS 0 1 Important

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.6.ppc64le.rpm cc725b6ddc1c9752a6360358d6b36133a4d565114e8e52e30b78c758b3c6a5a8 ALSA-2026:69129 Copyright 2026 AlmaLinux OS 0 1 Important

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995) * openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999) * openssh: OpenSSH: Tunnel forwarding restriction bypass (CVE-2026-73283) * openssh: OpenSSH: ssh-agent allows remote execution of local operations (CVE-2026-73281) * openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssh-askpass-9.9p1-27.el10_2.alma.1.ppc64le.rpm 0328cf3a0c80f5e32a6bc4faeb20061a0b2cf872ec726a347f254f1f1997923a openssh-keysign-9.9p1-27.el10_2.alma.1.ppc64le.rpm 5a63324c0d22b79976f28ac712c0328001248a5e2a93b933f9e0ef24eb216538 ALSA-2026:69259 Copyright 2026 AlmaLinux OS 0 1 Moderate

tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tomcat-10.1.49-4.el10_2.alma.1.noarch.rpm 05f66cc8b41b005142502d651ba514eded6e74fadebc4bdc6c0d92950d6879df tomcat-lib-10.1.49-4.el10_2.alma.1.noarch.rpm 1ef407ca747b0004e12dfb23f976be66e723a1e587ab0958cba13bdb751f2505 tomcat-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 3039facea1830d6007abf1fdc9482c06d32fcb2fb13da8d1c71963066f81e351 tomcat-servlet-6.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 3b705c8b7203a1082a75a9137b187f792afaaf227daf36911e2dbeccf5e0f1b1 tomcat-el-5.0-api-10.1.49-4.el10_2.alma.1.noarch.rpm 4df179b81ca2db0f43fec568ccc75a8679fffe363fec2fb6561e4f02955b8ae7 tomcat-admin-webapps-10.1.49-4.el10_2.alma.1.noarch.rpm 7c7acfc2c6790f4c32d6cdaf0b0ebdfa664f793a282af54ec03f3852621bb52f tomcat-jsp-3.1-api-10.1.49-4.el10_2.alma.1.noarch.rpm a6fc4fb2bc554f7fe792d34fef93212e54a6708c02ec0a9ef3f40adf76158df1 tomcat-docs-webapp-10.1.49-4.el10_2.alma.1.noarch.rpm d77aa50850c7291ba9872ee696549bcb39f63510d6dcf156bfa5d47ae3113c12 ALSA-2026:69308 Copyright 2026 AlmaLinux OS 0 1 Important

yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default yggdrasil-0.4.9.2-1.el10_2.3.ppc64le.rpm 4bd1f89dcc5bc9cde01b425de0d3ee4312f5e704c7b8d833fe0ea389e2cacc9c ALSA-2026:69461 Copyright 2026 AlmaLinux OS 0 1 Important

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default firefox-140.16.0-1.el10_2.ppc64le.rpm 1ab410ce1eb3fd70ed6195c0e441be7014baf0388ba52d2f28923e213f9d371f ALSA-2026:69541 Copyright 2026 AlmaLinux OS 0 1 Important

rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsyslog-mmfields-8.2510.0-5.el10_2.2.ppc64le.rpm 0112e5986e982a7cf286e72c34112c1bbe29b35bbc08cc87db12caef11209e2f rsyslog-gssapi-8.2510.0-5.el10_2.2.ppc64le.rpm 0d3bcd570414674ef678641d4d265c9e12c03aa271c651cfa068f80922bdef9c rsyslog-mmnormalize-8.2510.0-5.el10_2.2.ppc64le.rpm 1b8641462c3a3201451cf8977ad7cab229210e6623ed4372ed5c8acee2f0195e rsyslog-mmjsonparse-8.2510.0-5.el10_2.2.ppc64le.rpm 2de4318d7118462e4e7db63ddec738b4f53a0e7da9fc939908309ee1a23baa48 rsyslog-crypto-8.2510.0-5.el10_2.2.ppc64le.rpm 390a38602aa558c3d14bc5aafe609b5de2e76a86a86b3e817a6eb10a9899148d rsyslog-omamqp1-8.2510.0-5.el10_2.2.ppc64le.rpm 418a76a58de516b091ef26335fcb86953d1826866e1dca9f49cd58ee60d5c8bb rsyslog-mysql-8.2510.0-5.el10_2.2.ppc64le.rpm 587ebdc77c12c4e8fbd37847b663f2c1d96d974af9c58641cbe08ea723751f7e rsyslog-openssl-8.2510.0-5.el10_2.2.ppc64le.rpm 5f944dc42bbe5db35e70b27537f18a4f8c731bb3d8b3f2b4df347003ea8a9642 rsyslog-udpspoof-8.2510.0-5.el10_2.2.ppc64le.rpm 68c734659ac5ca0318eb85965403991064dc2e9d02631e9ce4fcbd318d0d7b25 rsyslog-kafka-8.2510.0-5.el10_2.2.ppc64le.rpm 75b76f66b62d1e4261cb93d0a70dfbe2b09c288214361257b2d6f43999cd940f rsyslog-snmp-8.2510.0-5.el10_2.2.ppc64le.rpm 80bd6d233e7ee595f1562d92141fd3d92761f302e0aa3286b8790b33ed84ef83 rsyslog-gnutls-8.2510.0-5.el10_2.2.ppc64le.rpm 8ec902148ce7f97487eb1600048977b3b783cbe4e2ec4f08151e7bce5aa28078 rsyslog-mmsnmptrapd-8.2510.0-5.el10_2.2.ppc64le.rpm 9492ef1130f29b3b1d4031655235384aed116331112cb9ab64f6611798a680ca rsyslog-8.2510.0-5.el10_2.2.ppc64le.rpm 99bc19c62dbc7afd7ef0c56b24e448de7d0b708b86ac8fd21e1e11205e5ee1ce rsyslog-mmkubernetes-8.2510.0-5.el10_2.2.ppc64le.rpm a5f0070cab383a4683b65903a811797b82f1a6992ee08ce8d6681f2b6ae289e3 rsyslog-doc-8.2510.0-5.el10_2.2.noarch.rpm d0db75ed47fc8d888cb8c7c423f927c07b67ef296633a799feaa348cac1a5e74 rsyslog-relp-8.2510.0-5.el10_2.2.ppc64le.rpm d51ee1e0fcf87feb5ebe962b2783b8fd6230171a795c7fe9a493f8474f194871 rsyslog-elasticsearch-8.2510.0-5.el10_2.2.ppc64le.rpm e9409a77ca1a74664b38a5b0a6c945d6e6c57c6c8c19e46a3911266741ffaaa4 rsyslog-pgsql-8.2510.0-5.el10_2.2.ppc64le.rpm ec57e4011d8a0c1bb6489d0c1ae27d2c95ea4e92e93639fca22fdaa5f94eb62c rsyslog-mmaudit-8.2510.0-5.el10_2.2.ppc64le.rpm f8dbcbfe4ae3313eb09de2ae42ed926e8cde851eaa5a5bdb6d57bfe1a60e8e07 ALSA-2026:69553 Copyright 2026 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028) * libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libarchive-devel-3.7.7-11.el10_2.ppc64le.rpm 557cbcf0c544b4661dd5c5c8290bbb4cd0a24b261e160ad6004860172a8fdde0 bsdtar-3.7.7-11.el10_2.ppc64le.rpm cc9405e3f01fa655d682c5f273ef59b2bd5edecb08e923ef878f716cc2dd1de9 ALSA-2026:69609 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openexr-libs-3.1.10-8.el10_2.4.ppc64le.rpm de955519282475c0306171c25570a61ea9c6cdd7864fde2a6318fde145d630cf openexr-3.1.10-8.el10_2.4.ppc64le.rpm ea3337943474b9895685e5f65b2adbebb2dab0a68ebcfa5ea1f9cb5d0513bbb9 ALSA-2026:70186 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default postgresql-16.15-1.el10_2.ppc64le.rpm 0d0149cef55ffe6b46942857cd9a167364d6ccc787bde79efd02e178fc6e89b6 postgresql-private-devel-16.15-1.el10_2.ppc64le.rpm 138184536e251b21456bb50b6d7a72d65838432e473009218c8936bcdb8828f8 postgresql-upgrade-devel-16.15-1.el10_2.ppc64le.rpm 15d18bef339da71f9053dc12eadf9769b8ebe62c1a4c77da55d78be43e871952 postgresql-test-16.15-1.el10_2.ppc64le.rpm 318c9fbda3b35e6da814c97d1ffe418ed2f5d85f0c795c8ea5257dfe397d2cf1 postgresql-static-16.15-1.el10_2.ppc64le.rpm 323bfbda8f7afc960fc51fad1ddd8e107f17b3b589190e0e257e41fbcd1346ed postgresql-plpython3-16.15-1.el10_2.ppc64le.rpm 4737354c44192aebb11dd45af6bfd6d80fe9bdebeb4e212643ecc8e7187f5c8b postgresql-docs-16.15-1.el10_2.ppc64le.rpm 48d7f24ca57430e75bae5d048aa1447b42947a095e1fc358103d1208dcb05691 postgresql-contrib-16.15-1.el10_2.ppc64le.rpm 530bc12aed5a8bf1dfa783d6d17c5050e5afe8e9df2640e97f9e015013e97431 postgresql-pltcl-16.15-1.el10_2.ppc64le.rpm 72226d943a68ff2ce9602aef73df84232d813ad4f4bf673cbb3406c8661d2f72 postgresql-private-libs-16.15-1.el10_2.ppc64le.rpm 85b2069e184d4ffbac5f2f39078dc5c5138a8b948d0339e172542af4032c4575 postgresql-server-16.15-1.el10_2.ppc64le.rpm 976fdc4c5f31f37921f7b77516832717edecf7c46d01db58d4e4c07b8db722a8 postgresql-plperl-16.15-1.el10_2.ppc64le.rpm c8f269fb8f854fd3b035c8c84f9844ffc1ad2ea46b58d282c49b060c38708c2c postgresql-server-devel-16.15-1.el10_2.ppc64le.rpm d2597f1b184fa0054349210f0f0c612a18cd59fb53d12a15bfbeb659eb7e2dae postgresql-upgrade-16.15-1.el10_2.ppc64le.rpm f574fe4bfc04ba2bd9f4091ce650a890323d7c05131753375228af8cc74ad98b ALSA-2026:70201 Copyright 2026 AlmaLinux OS 0 1 Important

podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730) * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default podman-5.8.2-9.el10_2.alma.1.ppc64le.rpm 061f997db43456a60bb396b2d63e89689980454d3a5b173810d56c7a5f57034f podman-remote-5.8.2-9.el10_2.alma.1.ppc64le.rpm 40f5a45ad8bb7e68540651b4c09782a39c4e82c5c23679c8a1ecdfecf0a85aae podman-docker-5.8.2-9.el10_2.alma.1.noarch.rpm f46c4a2f1c8d19490236bd31637b67ed406bf45d03eeaf0ed986334693a23e6a ALSA-2026:70498 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478) * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-doc-6.12.0-211.58.1.el10_2.noarch.rpm 2759cf0eebab0e931daf54293a7fa911cfd7d55cdb55ae2d2ad8d9f0fc021217 kernel-debug-devel-6.12.0-211.58.1.el10_2.ppc64le.rpm 2aaefb996b131a75fad54527c976b59accd5573a342eaf22ddeb942bc9e25546 kernel-debug-devel-matched-6.12.0-211.58.1.el10_2.ppc64le.rpm 6b4a790354c15faa8fa44ee7b099919ff6cdc68bd51b49e44d920346c07cdeb5 rv-6.12.0-211.58.1.el10_2.ppc64le.rpm 6beb19415276a4e9e961459338b603b98a7ebfeed6cd719566be98f442a7bd71 python3-perf-6.12.0-211.58.1.el10_2.ppc64le.rpm 73bee63d1989096e1cb5747b1867bc18d9afc71e8e7f0a962dc5c98f68250a1a rtla-6.12.0-211.58.1.el10_2.ppc64le.rpm b2c195600b5f5cf0ec3b27406f65b4801dde27a720cf5a8a15727b7a3a6304b2 kernel-devel-6.12.0-211.58.1.el10_2.ppc64le.rpm b3c442c5707610da02df4942672f78e9caaa7b155328322ab964b2b9a118499a perf-6.12.0-211.58.1.el10_2.ppc64le.rpm c597552a461097d703f093c9d397d4225097a81152308ee01ddd6dd45b5b39d3 kernel-devel-matched-6.12.0-211.58.1.el10_2.ppc64le.rpm e97af63f43399838274530172e0504eef2ac99da0043a883750456e20d471d17 kernel-headers-6.12.0-211.58.1.el10_2.ppc64le.rpm ecc25de27ffe88ecd9ec6e2b9d345389e1831aaa0324a9849c5cfca4a03bc7fa ALSA-2026:70753 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder (CVE-2026-73194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.6.ppc64le.rpm c5afbfd46950aa18bea4dabf6fa4df2bb875f57bb226200facc6f46eb08156b3 ALSA-2026:71233 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846) Bug Fix(es) and Enhancement(s): * kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298) * sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247) * [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283) * RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.59.1.el10_2.ppc64le.rpm 3c2bd03b2d65ccf5859f473cd03fa4aef072f6ba4daca4a1b61d7bcd38131844 kernel-devel-matched-6.12.0-211.59.1.el10_2.ppc64le.rpm 4f387ccabb652c45e6355d4c8e0f0a91def04981cba237f19b11e59967ae7322 kernel-doc-6.12.0-211.59.1.el10_2.noarch.rpm 570136fba25a6b0e607b32762ab0b5f9a1bf9803cf7c18d367189ed301f9afbc kernel-debug-devel-6.12.0-211.59.1.el10_2.ppc64le.rpm 7e6bda9bf1de614f11511a2cbdae56ba258e1b6ed08e82022cb9b11220299589 python3-perf-6.12.0-211.59.1.el10_2.ppc64le.rpm 80f32c70b523e08e606844ea5c8d0a270efe6d5b167ac16bf0cfabc4ed3b8251 perf-6.12.0-211.59.1.el10_2.ppc64le.rpm 8140180abfd8bf57f3499bda28058f08dcde89d1bf4285351add4870f67bb8c1 kernel-devel-6.12.0-211.59.1.el10_2.ppc64le.rpm 82254bb7112ad4a20da8bb89a5a6a42cdb813400462544b0eed40b7f36ec5ad2 kernel-debug-devel-matched-6.12.0-211.59.1.el10_2.ppc64le.rpm bdbc1a26d402fef0e5c4755a6471f5fb3163ac4b39195fadc218659a5b865711 ALSA-2026:71419 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default unbound-1.24.2-7.el10_2.6.ppc64le.rpm 2606fa635522e4d267f6604eb542e51e2757ab6a34b2d98a6bdb0324d1468612 unbound-anchor-1.24.2-7.el10_2.6.ppc64le.rpm 43dc3d5f6442af7739eaa855f5c83f9a8e62ed7e674af170d067a460550fc446 python3-unbound-1.24.2-7.el10_2.6.ppc64le.rpm 4a7863dcd734cb759eeb72747b238bee6043321f4eafc7be0ef7bc3d0539cf94 unbound-utils-1.24.2-7.el10_2.6.ppc64le.rpm 5befd6e6304a470ccc0e930f9c64a88a358b4dbd93a032d82f50ea5989ffe314 unbound-dracut-1.24.2-7.el10_2.6.ppc64le.rpm 5f4e5ccb56ef2b00b6a7479893cd601fcbcebba01e08c477ac44e9648b796341 unbound-libs-1.24.2-7.el10_2.6.ppc64le.rpm b5b7bbb19169c085832816dbf4e268f0238bd3db84ce5f93da92e69fd4bd43ad ALSA-2026:71543 Copyright 2026 AlmaLinux OS 0 1 Important

cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fix(es): * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899) * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975) * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172) * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cockpit-image-builder-94.4-1.el10_2.noarch.rpm 6d46bc65678588738897e9833c8b0821f6f410eb59d37f70469150a20636cb8a ALSA-2026:71586 Copyright 2026 AlmaLinux OS 0 1 Important

libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138) * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143) * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140) * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142) * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144) * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libxml2-devel-2.12.5-10.el10_2.4.ppc64le.rpm db1116349c8fc0bdda8a0a813bd2ea1ac16f75991b7cae5f6cfd3bfbcdacd0cc ALSA-2026:71602 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481) Bug Fix(es) and Enhancement(s): * Bypass DMA APIs for coherent allocations for pre-mapped memory [almalinux-10.2.z] (JIRA:AlmaLinux-252331) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-devel-6.12.0-211.60.1.el10_2.ppc64le.rpm 28adc367bfe0c3d2dad80c8eddb23ade91b69e731a44ee30e938be1c822f4082 perf-6.12.0-211.60.1.el10_2.ppc64le.rpm 4fbf6d8ebc031f4ebcfee4bc1b5c05ceae19463829abc6fc3fcc7537eab7a400 rtla-6.12.0-211.60.1.el10_2.ppc64le.rpm 66e7d3266aca2d2bdb9ffd629290074d351d0bba94ba420304e77761f398eb6c kernel-headers-6.12.0-211.60.1.el10_2.ppc64le.rpm 6843465f0461788107058935a723f6f8f3d6b7408dbb58a3783f3c9acd4145db kernel-debug-devel-6.12.0-211.60.1.el10_2.ppc64le.rpm a6cbffd5310d1c5fdb146a4845fafb3ada11445fd4867b7518595263109022e2 kernel-doc-6.12.0-211.60.1.el10_2.noarch.rpm bbbe1ee1c8c000232e1f59ed8256dab96ac04d67ae9d73b4bf3a15fc22954391 rv-6.12.0-211.60.1.el10_2.ppc64le.rpm cf50a4e1f96aba45457c74c50c070e9a79e308b97c339ca4673e70747ecc5503 kernel-debug-devel-matched-6.12.0-211.60.1.el10_2.ppc64le.rpm d47f91b5678617b12e3297f4df6ade6da031043e970b7d2d7f8451c619543573 python3-perf-6.12.0-211.60.1.el10_2.ppc64le.rpm d9676194d926d659582434a34fd8d2c6cbc8fbeb8f3965a2c86e3705d8dd7d6a kernel-devel-matched-6.12.0-211.60.1.el10_2.ppc64le.rpm fea809672bf144544ca8170f0ccebbeca6b352e29ce88f318ed5ddf5333d23ca ALSA-2026:72279 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2] (JIRA:AlmaLinux-173375) * WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510) * ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z] (JIRA:AlmaLinux-238522) * ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673) * ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z] (JIRA:AlmaLinux-240768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-ipaserver-4.13.4-1.el10_2.noarch.rpm 0fd7500513d74955796c1d0fee7ecba945a8e28ace17bbdab27b6aaa886ae8c1 ipa-client-4.13.4-1.el10_2.ppc64le.rpm 35133ed4e8b30c05e789be041d7a43e81e4bc81daa633a134ffaa81cc030ba83 ipa-server-trust-ad-4.13.4-1.el10_2.ppc64le.rpm 3684a627cc2ca7688177132dc0797a7ff672189eb045bea8fbcd3b03bd609db7 ipa-selinux-4.13.4-1.el10_2.noarch.rpm 3bbaaa21c4182fda1a5241bb0f5fc945b4dd8f1295609aea9cabfc4dc827688a ipa-common-4.13.4-1.el10_2.noarch.rpm 4144c11a83aecac08226230567deedacef7facf17ce0a31efefe1a2ad9aaa0a1 python3-ipalib-4.13.4-1.el10_2.noarch.rpm 4becc4f5c6c2c8d32741a3600b8b75f350754d326439bba74ab74eec92cbbde3 ipa-client-samba-4.13.4-1.el10_2.ppc64le.rpm 4d52b69b4a3468d46db5854b6bb0d1d4b32d7ff28be5a46bb74101b6a54d9cd5 ipa-client-encrypted-dns-4.13.4-1.el10_2.ppc64le.rpm 53b99d691b089155fc1f03a31a90f8349d1d9dd2707c445a23e9fcd761f2111f python3-ipaclient-4.13.4-1.el10_2.noarch.rpm 75d3397f9faa033046ebf837c3173a3b93b02cb7b7be5d66ee746e74cea35086 ipa-server-4.13.4-1.el10_2.ppc64le.rpm 81b6c1cf8ab65a04226f16b20ed42c2ae5e2427518f5e13eef0f7b6e8736c434 ipa-selinux-nfast-4.13.4-1.el10_2.noarch.rpm 898e7d3623722553f2ba1cd2b4a473f852a3e0790749aa320403d269e7a0a24a ipa-client-common-4.13.4-1.el10_2.noarch.rpm 99ad0482c8eaf5ea6a943447eaac1ba10950f97cd551e3ce6c2793f1832e41a8 ipa-server-dns-4.13.4-1.el10_2.noarch.rpm b51948fbd1e5414a345dd9a8a33d2f5c4e174fa72168bdc2518a48180e3894e1 ipa-selinux-luna-4.13.4-1.el10_2.noarch.rpm d6c79b60b49a1f8f4c6f9bdf660fa53d2910a7593dbace5e93e486cb87b288ea ipa-server-common-4.13.4-1.el10_2.noarch.rpm e77c01557668023ac072b330d723c4dd1555495797742ca39c2e7fef063bc959 ipa-client-epn-4.13.4-1.el10_2.ppc64le.rpm eab850d1c7720c87c156bb19c3aaa82c75a3f139f10b9c6057b5875fc3815059 ipa-server-encrypted-dns-4.13.4-1.el10_2.ppc64le.rpm ff876ac294778749625ab02a376a815db261996b207e7ab1f87fec1158244e07 ALSA-2026:72427 Copyright 2026 AlmaLinux OS 0 1 Important

ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ruby4.0-devel-4.0.6-37.el10_2.ppc64le.rpm 02ea06f86b18c7aae2624316e2ca37bddf3889fced34f693054a33c6a24c8cfb ruby4.0-rubygem-pg-1.6.3-37.el10_2.ppc64le.rpm 1881c44a8d057e91559801965eb62283c1a0aebea02f3632e299de4607b0e575 ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.ppc64le.rpm 8b4d0555d1e432cd5dcc68746c3d3877f8af006c6b202b300fe197ed4361e8ae ruby4.0-4.0.6-37.el10_2.ppc64le.rpm c527c2453e967f237eea5e05a348f0ae591c7eb81acf5569ce7492279a4ccdd9 ALSA-2026:72624 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076) * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480) * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-10.2.z] (JIRA:AlmaLinux-188661) * crypto: xxhash64 should not be fips approved [almalinux-10.2.z] (JIRA:AlmaLinux-254943) * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:AlmaLinux-260402) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.61.1.el10_2.ppc64le.rpm 2eca86cd2c2a0a5c80bc6cbf95fd14cc5ce032ce5fe83dec017577238bf702c3 rtla-6.12.0-211.61.1.el10_2.ppc64le.rpm 2f5952f82cab65a5a29121e568e4ae4baa78b567a713e9e53a0522f5b85e6b5f kernel-headers-6.12.0-211.61.1.el10_2.ppc64le.rpm 439b6e90314d6f6dbe5655ea670a3a70e9163f66459b1b9cb7327a927e42a67e kernel-doc-6.12.0-211.61.1.el10_2.noarch.rpm 6d745d7d315fc5f6d99298e2a1473d86795b33684aeb63850538eb9f248208c2 kernel-devel-matched-6.12.0-211.61.1.el10_2.ppc64le.rpm 7b06b6a131d1933c1d3edc020e1f018f2b56c8683cf9039d054d51a2c3dbe0cb python3-perf-6.12.0-211.61.1.el10_2.ppc64le.rpm a99284743f4fe05a6d1faf5d5c551a2dd92eeebf6853635960725c1913d70d7d kernel-debug-devel-6.12.0-211.61.1.el10_2.ppc64le.rpm be79165d5af4f1f76ad91ebb881ec628eb5633bc8c9549e9e2062164ce27b8ee rv-6.12.0-211.61.1.el10_2.ppc64le.rpm c9763d2516c4c51d7dc5a7e1806f34e9ba5506ec5660625d48790e3ee2ce5084 kernel-devel-6.12.0-211.61.1.el10_2.ppc64le.rpm ed480f96234ce8a6a19782f0ee53e9c53cb0b3a6b96ce9a039eb0abdc5a12375 perf-6.12.0-211.61.1.el10_2.ppc64le.rpm f761981015c5a703d6f861e69c1b65cd5a3cdce042753a284df6856123900837 ALSA-2026:72785 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rubygem-irb-1.13.1-15.el10_2.noarch.rpm 109ed4ad1eaa45bf5dd31e4d43f1ae7d8d990a2c4d7eb7d161005b447b9cfc31 rubygems-3.5.22-15.el10_2.noarch.rpm 11349eba9345d9f2cc94bf421e58373e1d5458cbb9114f92d6b98d8207922418 rubygems-devel-3.5.22-15.el10_2.noarch.rpm 492612048da0e57f477983879982cb57b3eada4308202c6d3fee92d24838f1e5 ruby-bundled-gems-3.3.12-15.el10_2.ppc64le.rpm 6c171f48e5799d09c53b1c20b5b3ff7dacbc65c2b60d297ace24a5a4b7e353c4 rubygem-rake-13.1.0-15.el10_2.noarch.rpm 6c4b9241ff9efa450aa5d3329a216aa37da225de270e1a5fe3f5f832b872e5ad rubygem-power_assert-2.0.3-15.el10_2.noarch.rpm 854289d012a71949ba1daef7ada1a60911e03ba7ba8676153267c548b6ad62e4 rubygem-racc-1.7.3-15.el10_2.ppc64le.rpm 86801d7df9ac73779c92d736fce5ab148a9d49747eb01ca2c7ec83eaa2851f40 ruby-default-gems-3.3.12-15.el10_2.noarch.rpm 9155f150b9f91e2dafb16414991ca13c36df3f4aee6ca777ca785c0180a1f86e rubygem-minitest-5.20.0-15.el10_2.noarch.rpm 981707b75742760cc5c109ab99fa4285d4062bb296b498d5b21eb4ff7869c5fd rubygem-test-unit-3.6.1-15.el10_2.noarch.rpm 982aad6d4f946198793b11b68f74cc897cad5306f4398bac99c666a1c85bdf92 rubygem-bigdecimal-3.1.5-15.el10_2.ppc64le.rpm 9b827fcc3843ca5417ec5afc81cc34d228fcea86a4e2ae407018de96ce27edac rubygem-rbs-3.4.0-15.el10_2.ppc64le.rpm a576f39cf5fea799c21612c36133bca110575065e863e6fcb5d6fed169909df7 rubygem-typeprof-0.21.9-15.el10_2.noarch.rpm a685c24c2adbb428ee0cbfe323eb4e6a3c6c342892b6be21a0290944b16acf89 rubygem-io-console-0.7.1-15.el10_2.ppc64le.rpm b0cb5187c09351d0a48dacc150e6c7066ddf9cfe1e6a8470f90e9a7f62fa9f99 rubygem-json-2.7.2-15.el10_2.ppc64le.rpm b164eb25c7d982abf7a176edb5a05438f84a86be1c78168f2982414649be9fa9 rubygem-psych-5.1.2-15.el10_2.ppc64le.rpm bad0ba699c2a91a8e35bafcce28b0567495808606ec92e813a59b30d89ffe6a4 ruby-3.3.12-15.el10_2.ppc64le.rpm c4a0bf499ae954a282132865203881b229712b0dd8c59c568ad1ba7b09415440 ruby-libs-3.3.12-15.el10_2.ppc64le.rpm d71a983e3bfff378ab72b1f91a3cce219cda95df51fc354f3dc898cdc54b86eb rubygem-rdoc-6.6.3.1-15.el10_2.noarch.rpm da102fb3c095a3ec1f34f5f5a2ac9fd136e78f9fb8ae0ed3b5f70b5e93856125 rubygem-rexml-3.4.4-15.el10_2.noarch.rpm e05b865f8e326502a6561acbfe24e18752a7487792d727bb1f7154f70d471abb rubygem-rss-0.3.1-15.el10_2.noarch.rpm f72093880d7151f2ac3049b0131eef30043c09b0a89c1ef075bae97585e288eb ruby-devel-3.3.12-15.el10_2.ppc64le.rpm fd5820b4a8cc72082dde8545f7e95cda4cdb0002a09a0ceb9785619a08406302 rubygem-bundler-2.5.22-15.el10_2.noarch.rpm ff78ada1e367ca1dff09e79265bf4cff6a89438532915087f337c77c7cd2923f ALSA-2026:73130 Copyright 2026 AlmaLinux OS 0 1 Important

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Privilege escalation in the DOM: Workers component (CVE-2026-16365) * firefox: thunderbird: Sandbox escape in the Remote Settings Client component (CVE-2026-75874) * firefox: Sandbox escape due to use-after-free in the DOM: Security component (CVE-2026-84121) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (CVE-2026-84145) * firefox: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-84119) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84120) * firefox: Privilege escalation due to invalid pointer in the Graphics component (CVE-2026-84131) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-84124) * firefox: Use-after-free in the Audio/Video component (CVE-2026-84122) * firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (CVE-2026-84143) * thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639) * thunderbird: Information disclosure due to malicious IMAP server response (CVE-2026-84641) * thunderbird: One byte overflow read in mail parser (CVE-2026-84640) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024) * firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019) * firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031) * firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011) * firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028) * firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013) * firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012) * firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014) * firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) * firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021) * firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008) * firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007) * firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025) * firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029) * firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023) * thunderbird: Out-of-bounds read in IMAP response parser (CVE-2026-92240) * thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line (CVE-2026-92239) * thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers (CVE-2026-92238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default thunderbird-140.16.0-1.el10_2.alma.1.ppc64le.rpm 05dc2ed6a6fc658b59a3dff01035c0fbccc08e6e79da29b5faa233d1c1ab0c58 ALSA-2026:73427 Copyright 2026 AlmaLinux OS 0 1 Important

gdb security update

The GNU Debugger (GDB) allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and printing their data. Security Fix(es): * gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF (CVE-2026-13732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gdb-doc-16.3-3.1.el10_2.noarch.rpm 39dce27fc5099ec9272403ef4efccf67f2543fb0057041caf17d6dd68cc06eb9 gdb-headless-16.3-3.1.el10_2.ppc64le.rpm 6dfa4615216c33622d1073603c472cf4d388d845e7e8773f6325c1ad82af81ba gdb-16.3-3.1.el10_2.ppc64le.rpm 7fc45244554f1c43282176d1f1dc36e05a79a90258db40d84796c6f51e1aba49 gdb-minimal-16.3-3.1.el10_2.ppc64le.rpm 9d81c0ebe804775493a077aa861f24dfb0c97ba1c5d94320438d698523e8fde4 gdb-gdbserver-16.3-3.1.el10_2.ppc64le.rpm ccfc1ba6be2fabb5ca2988d5b6a6c4145c57f29f793e213da66a66a1f0ae10c1 ALSA-2026:73428 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10] (JIRA:AlmaLinux-249187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs24-24.21.0-1.el10_2.ppc64le.rpm 130900c6e5d1716ea177dc3118eae2ea8077c69bb8f548f1a13da62d1a73595f nodejs24-docs-24.21.0-1.el10_2.noarch.rpm 3c0582da0fa349b5c85a8671a5ccff46d1d89830e1e263672e2e93e4eb5161c5 nodejs24-libs-24.21.0-1.el10_2.ppc64le.rpm 46327a3b3c4efa1784a547e9ecf3d4a95feb35c8f148fbba3066faf6202b5d65 nodejs24-full-i18n-24.21.0-1.el10_2.ppc64le.rpm 50abe5f25732a5567048fb4f218c228e1c044004b4e9a7080187d33223615d59 nodejs24-devel-24.21.0-1.el10_2.ppc64le.rpm ad676237903b9b640613a988312f9bf8d8557119e32593c4d0c76563e9513c8f nodejs24-npm-11.19.0-1.24.21.0.1.el10_2.noarch.rpm c33582aee585c85053bce7f5822e3f7bccd46c315de9ed48e5522daeeeec7080 ALSA-2026:73429 Copyright 2026 AlmaLinux OS 0 1 Moderate

gawk security update

The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs. Security Fix(es): * gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468) * gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service (CVE-2026-40553) * gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gawk-all-langpacks-5.3.0-6.el10_2.1.ppc64le.rpm 3fa0892bc5f176c819bf721ac3625e196b466e55044aa8ad6c5219909b5c653c ALSA-2026:73765 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561) * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default idm-pki-java-11.9.0-5.el10_2.alma.1.noarch.rpm 0cdf052ebc4a0c8e950bbeca80d0f2c7c6760d139c66043c04ced088658411e4 idm-pki-ca-11.9.0-5.el10_2.alma.1.noarch.rpm 222cd95d6a7904a983de39241895dd9acb151c45c8a7491e9550adc37bd65352 idm-pki-base-11.9.0-5.el10_2.alma.1.noarch.rpm 582d387b6396d8e4e698857b48390f3d102d7ac512738e3cc874874c5c912711 idm-pki-tools-11.9.0-5.el10_2.alma.1.ppc64le.rpm 9f9c8d19b0ebbe5c911621f2281e82f222e59358661604e65d2803776d9d802d idm-pki-server-11.9.0-5.el10_2.alma.1.noarch.rpm b0f00e34f7b8789bf4cf070694a5cd3513616af2667ab61700b8c68820ad419c idm-pki-acme-11.9.0-5.el10_2.alma.1.noarch.rpm b5bef02548113c0fa533f73999506eb0f9f5ed8060cc5870f5a024cfe04b38f8 python3-idm-pki-11.9.0-5.el10_2.alma.1.noarch.rpm df55263895dce79bb1709226dd320f18f208f120a85e935cfa2ab9bc787fdda0 idm-pki-kra-11.9.0-5.el10_2.alma.1.noarch.rpm e5fda389acc85e9115f766d485557babdcf49b10683904f1114a8015fcfe0ae7 ALSA-2026:73954 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay (CVE-2026-60001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssh-askpass-9.9p1-28.el10_2.alma.1.ppc64le.rpm 6084569c46af7c7034b56d318a54a7d2a29cebd4c18459f28c23f82da5f46caa openssh-keysign-9.9p1-28.el10_2.alma.1.ppc64le.rpm 6462c1d41b10fa6a6ba78fb2684b95421b51bf100f60196d1b8ad465dda3367e ALSA-2026:73979 Copyright 2026 AlmaLinux OS 0 1 Critical

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-libs-3.10.3-12.el10_2.13.ppc64le.rpm 0ff380c2c936f41b0c29dc3ece7583ca8e38f61fe7c4c4d286eb3bfe6892eae3 freerdp-3.10.3-12.el10_2.13.ppc64le.rpm 3b9284331c4809c9db7dc8e9bb9c1a5b363adef21a1a96c1bccfeb4927b507ed libwinpr-3.10.3-12.el10_2.13.ppc64le.rpm 9f66639d9657054c59d93b91786f3b72eed5d5de83ca05f574b3ff047ff93c03 ALSA-2026:73998 Copyright 2026 AlmaLinux OS 0 1 Important

gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer. Security Fix(es): * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gvfs-goa-1.54.4-4.el10_2.1.ppc64le.rpm 2236a90f81b18bddba7e26b846d7e6a560e4d9fbcae26b371398bb24e5f9fde2 gvfs-smb-1.54.4-4.el10_2.1.ppc64le.rpm 405710f28bd7ac0659e12f70cf3da4655a439c9ce85eeae7d6ab8289222d4677 gvfs-client-1.54.4-4.el10_2.1.ppc64le.rpm 4840f2ce0b5b16f4c05d5b1d9a73c902ef9aff91831f13e66c2bccec8cac70e8 gvfs-1.54.4-4.el10_2.1.ppc64le.rpm 6a90b1d0a0058496a288fe06882b66c03749bf2ef3442bd8d152638ab7105007 gvfs-fuse-1.54.4-4.el10_2.1.ppc64le.rpm 7f61e7a7600549e1426030e665aec9c74de4cffb6c8ab4654628dde812dade67 gvfs-gphoto2-1.54.4-4.el10_2.1.ppc64le.rpm 8a11111c61cc779cb566b6b80a7121231284e91c4896fbfd73f136f17a213fba gvfs-mtp-1.54.4-4.el10_2.1.ppc64le.rpm e403363871e1457faaa80031d6857aeba614296b9f076089e21faa52d9b9cf20 ALSA-2026:74001 Copyright 2026 AlmaLinux OS 0 1 Important

expat security update

Expat is a C library for parsing XML documents. Security Fix(es): * expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default expat-devel-2.7.3-1.el10_2.5.ppc64le.rpm b3c0ff526cf0098eb2fc3631bef504b3173d83e556de77ce33c074b8c7358872 ALSA-2026:74464 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ghostscript-doc-10.02.1-16.el10_2.1.noarch.rpm 617175f855bb442ae2b330cea4f12398f5b091a7d462994c072769221b20c59e ghostscript-tools-fonts-10.02.1-16.el10_2.1.noarch.rpm afeee0186e3b8fc2a1465593bc73b907e5983363ee869023e04bdc397fa74493 ghostscript-tools-printing-10.02.1-16.el10_2.1.noarch.rpm c49fc8445ae5065659355a423f7eff2b5067e08b45ae02b7062620618b3b5cb2 ghostscript-10.02.1-16.el10_2.1.ppc64le.rpm db69ca824b961638ab6c5ba137ceb11bf82f7edca4e2e20130e6d15946402b68 libgs-10.02.1-16.el10_2.1.ppc64le.rpm ef1e286c1cbf3a8b113aa36ac3ac65eddfdf04ff1ff5d77ce01eb8afd6afcc68 ALSA-2026:75570 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) * FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default freerdp-3.10.3-12.el10_2.14.ppc64le.rpm a03451438f1c274340ea9d5297e7fc1158e223a3fa7603538495e67f73eb7ab5 freerdp-libs-3.10.3-12.el10_2.14.ppc64le.rpm b26d5638e767f0b872230836009dfd59b2feaadd1074b8e78b5b92013f55c900 libwinpr-3.10.3-12.el10_2.14.ppc64le.rpm c151137b2d0d6f06cbec54411643e78e99c4f63cc755334fd3cc01e393270816 ALSA-2026:75576 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * gve: backport large queue depth patches [almalinux-10.2.z] (JIRA:AlmaLinux-219261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.62.1.el10_2.ppc64le.rpm 412a892d8ae249b4ac1fae9692e3b959f28af781de8e9dce1b14765f5688cb2a kernel-doc-6.12.0-211.62.1.el10_2.noarch.rpm 4651096af1f2c0d1dadca18c541eee91d0617eff4471a68b40d10def0058f9c3 perf-6.12.0-211.62.1.el10_2.ppc64le.rpm 483fe1ec8153c7f23dd8c954a4c18863d67a8ee23b01d50c9c6694eb1b4266b2 rv-6.12.0-211.62.1.el10_2.ppc64le.rpm 49c04930be8a35df3ab56b35da39584525b5f88b7210860076814dff2f996349 kernel-headers-6.12.0-211.62.1.el10_2.ppc64le.rpm 4bb2f66c98b79aa6372c92fc96def22f5a23d554e09a5c8263a9844ea93bb106 python3-perf-6.12.0-211.62.1.el10_2.ppc64le.rpm 5e4fc9fb8bbd927bad93b214ad072379dc5d46a2ca1b170d29980081aca5b5f4 rtla-6.12.0-211.62.1.el10_2.ppc64le.rpm 7cbedace2a76ab6d6f2c51c0eacc2c33bb4847deef151ec673528a66b5f445bb kernel-debug-devel-matched-6.12.0-211.62.1.el10_2.ppc64le.rpm ae0a8e71788f4136575366af334c124e7b3438f7af1103690aeab6367faed3cf kernel-devel-6.12.0-211.62.1.el10_2.ppc64le.rpm d1e1ecc33b72188dd07d082974d55ea39743b4c0ac68cdcac9b8279200cc6e0f kernel-devel-matched-6.12.0-211.62.1.el10_2.ppc64le.rpm d2a973a90497d6ba228eef70fff569dbff0c49d9935c6784c110a5102b3ab87e ALSA-2026:75577 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default bind-libs-9.18.33-15.el10_2.12.ppc64le.rpm 6adc954ce873a38325b614f8ea77834b7678e6fbf3c5949baf3ae2d7949fbb75 bind-chroot-9.18.33-15.el10_2.12.ppc64le.rpm 6de42e08a319c3c2ab38ebaf419558f95538ac31897972b8aba98da11ad826f4 bind-9.18.33-15.el10_2.12.ppc64le.rpm 7b25afe5a5035d050da0db7f72adf62b69e5af0e24b2a9fa6873499bcd8633d3 bind-dnssec-utils-9.18.33-15.el10_2.12.ppc64le.rpm a0bea827e2256208563aa79849d5ed633913093a903cda505a754e365d779887 bind-license-9.18.33-15.el10_2.12.noarch.rpm cf3c504a9857ffd2222e1db77e1c60344ac788c5662696ad6ef92bbac52bdf0b bind-utils-9.18.33-15.el10_2.12.ppc64le.rpm f862604d701bf82e5d0aaea3c5d7b12f5e1284c735dd6397ce948af37ad761ec ALSA-2026:75579 Copyright 2026 AlmaLinux OS 0 1 Important

sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sudo-python-plugin-1.9.17-10.p2.el10_2.7.ppc64le.rpm 99dd2de1e1990d7cf007963051c67128370b93265a31fd70cc77d9674d67f2ac ALSA-2026:75581 Copyright 2026 AlmaLinux OS 0 1 Important

mod_auth_openidc security update

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing (CVE-2026-54789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mod_auth_openidc-2.4.16.11-1.el10_2.1.ppc64le.rpm 18d554a08e61228dc2de4e54486e86d476b049b5d24ddcb63f0f5c9cbbede8fd ALSA-2026:75583 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-10.2.z] (JIRA:AlmaLinux-186019) * virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [almalinux-10.2.z] (JIRA:AlmaLinux-191267) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-10.2.z] (JIRA:AlmaLinux-224982) * Expose guest-get-devices in libvirt-api [almalinux-10.2.z] (JIRA:AlmaLinux-243305) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-10.2.z] (JIRA:AlmaLinux-242547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libvirt-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 0c8a0aea7648d95a4d1a09e8b9b99f4414e08d446be97b9160ca07d84d260865 libvirt-daemon-driver-storage-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 187a5d694d1da33b52679e2c9f7062b597478addf559b5d443c2b3c70e7dadda libvirt-daemon-lock-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 1eaaa7f97944b03234cc9bbf663062abe0dbc9aac00bc299d60700adaa4b1a50 libvirt-daemon-driver-storage-scsi-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 2c4bbd57a6e215dc12048baaed1dfb43fe3b295b7ba2311367f99ce9b75e476d libvirt-daemon-driver-storage-rbd-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 345abab2b861ac5e101fb2df2f834ad5304920c0c93256002cacfb2bcc671228 libvirt-nss-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 4282f5088bdd1683ba23d9bdef8c54a5a9494eed4dacbf27013cce944a218158 libvirt-daemon-driver-network-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 4c4b809a1da416715c50e734b1c500580b83b6885260ee5ae3eab43b71b23fa7 libvirt-daemon-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 4f444938208d400e6612f8717d368fe23247399bca2f110bc97ea73d54b26e4b libvirt-daemon-proxy-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 545eaa8628ce05b65964f6a0feee3093dc30b755b8413e7be97ce6de8d505afa libvirt-daemon-config-network-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 5e323e6176db3b7d066b04fb5c78c3a77c806826f5e4afa582589deddfb6af86 libvirt-libs-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 5e8603217b071972707be876f711d9b9f40bd0cfe7d9e9c4fb8c6cacea7d9cd3 libvirt-daemon-driver-secret-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 5eaa1a1d14255b5628d4151705c222848755fde8ed61944c1472af40bef55713 libvirt-daemon-driver-nodedev-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 6050cb711e7b8e6d116bd7327fbfb944f0a7868b37d471d3f837f788e360dc14 libvirt-daemon-driver-interface-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 60581db56190d8a453ada977ca52bd62f9a9a17d4c7ddbdfba2300feed65f6f3 libvirt-daemon-driver-storage-logical-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 60eb16313261a64757c1251a4b010d8d860379dda9dff841034d02238e823334 libvirt-daemon-log-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 685b2b629c356cfa5238911e58ab3a95147597d928e9f242f96c407529ac8b51 libvirt-daemon-config-nwfilter-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 79b35f1dd63aeecbc1bec6393b5b889aaced41917fe9840105ba64f24979840c libvirt-daemon-common-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm 9723d8474f1c20bf37c5ab7b364ea286644e474fe5bc38c53e8419ad0e1e8c31 libvirt-daemon-driver-storage-core-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm a70508e87d9aebc62870531bacce4749f6abe4ce120750ae8ba2b3da7efbf0af libvirt-client-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm b4530cc7a118ad2aef448f574be3622973d1af1d991606a443a01ff4796c9440 libvirt-daemon-plugin-lockd-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm be70a8f74510df619ae184d40b36755e4a423e976c0d7e773a08df0c16dfd54c libvirt-daemon-driver-nwfilter-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm db30ca109e442b51dc4cafd3fa016263058f400a457d0f78335a9b59846a2f88 libvirt-daemon-driver-storage-iscsi-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm f2a1c8bdf764c52bb5fb829dd7faf1649b023e795ab92bf92531c5525f9730cc libvirt-daemon-driver-storage-disk-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm f3eb0ab7aafe0414c0d73ea49b39ecc034aac5181cef6d57eb73e94ce9e96eaf libvirt-daemon-driver-storage-mpath-11.10.0-12.9.el10_2.alma.1.ppc64le.rpm ff976e5920ddbb4c5a5b2b76d01b89d5f5c59b63ad42d19eb347f9cfff6bf805 ALSA-2026:75769 Copyright 2026 AlmaLinux OS 0 1 Important

vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-73073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default vim-common-9.1.083-9.el10_2.22.ppc64le.rpm 01cd582d8d0baaa0c06ec6c599fa8725dba6252ae7464afd55c7e378f36f873c xxd-9.1.083-9.el10_2.22.ppc64le.rpm 01fc98266428cf7de5f8ae673aa0c3e8b343e53ffe820322fde5f5e821e44a92 vim-enhanced-9.1.083-9.el10_2.22.ppc64le.rpm 4d8ee9acdf0f761cea9b9ce081887cfaf039d6e0e12b6cf615217e5cd1cb58a5 vim-X11-9.1.083-9.el10_2.22.ppc64le.rpm f88b257cbeeda157e48d7162ca2f0d7f3943449768c86a97797884d63381b420 ALSA-2026:75864 Copyright 2026 AlmaLinux OS 0 1 Important

nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default nodejs-npm-10.9.8-1.22.23.2.3.el10_2.ppc64le.rpm 20d2071e5506af16bb45e8f9eec3726fc75a9237aab06770a7c3611b0ba52c2d nodejs-docs-22.23.2-3.el10_2.noarch.rpm 214fba9be3d9a6ef94f9450d61364b06af4c6aa7e8bf11fcc46229596bed6a07 nodejs-libs-22.23.2-3.el10_2.ppc64le.rpm 3ed4c542f94a7319bf71a019f5482abfd36e732b59e5f06ce4625a3060c4d872 nodejs-22.23.2-3.el10_2.ppc64le.rpm 414c918319f148d9381a94f36067c0598c200306ad8bd203c4a6784bd8057e6e nodejs-full-i18n-22.23.2-3.el10_2.ppc64le.rpm b9523c239e243c1b196a87e06d9b7f82ac71b94a09042b7055417709f9dd41f9 nodejs-devel-22.23.2-3.el10_2.ppc64le.rpm e899dcd8642aaf170cde2e79ff875812d96e36f69c1382990fce74ab244366f8 ALSA-2026:76735 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sqv security update

A simple OpenPGP signature verification program. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sequoia-sqv-1.3.0.2-1.el10_2.ppc64le.rpm 2b735a0b048ad856bc9141c870d5b12adbb175da6974d07a86d2a07e7b348ac2 ALSA-2026:76737 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) Bug Fix(es) and Enhancement(s): * Unbundle capnproto from sequoia-sq [almalinux-10.2.z] (JIRA:AlmaLinux-177547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-2.el10_2.ppc64le.rpm 32b3c53426100b4901b772eac640290f9e13ccd58c58bcd92743f5bd8f91905c ALSA-2026:76738 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:AlmaLinux-257457) * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-perf-6.12.0-211.63.1.el10_2.ppc64le.rpm 08ab335a53a1aafd40bb61dcb0fa39d3efbdc611f636cca5fcb9ecd9f6ef9c67 kernel-debug-devel-matched-6.12.0-211.63.1.el10_2.ppc64le.rpm 2352d5122bd3280c86ac690c053fe997c05896748f254a03ff8f09dbf9285edb kernel-doc-6.12.0-211.63.1.el10_2.noarch.rpm 4e40163bf75706368e25c8afc3979c308c7fb0ca59fb79c24d6c10fe3130f8f9 rtla-6.12.0-211.63.1.el10_2.ppc64le.rpm 787c0f407c05d626872f12828f51818afe9bf70d420cab24913fee3f2c819b98 kernel-headers-6.12.0-211.63.1.el10_2.ppc64le.rpm 8e5936c5fd19857489cf01e94b6173c8209ec176d5e2707cd83aa2ec09beb0e2 rv-6.12.0-211.63.1.el10_2.ppc64le.rpm a9a1a6b3eca866a133a8292fbc77a6d18e5bfb3baf8f78ce7cf9652bb8f69409 perf-6.12.0-211.63.1.el10_2.ppc64le.rpm aa385c01955b34a2c750dc420ec46e465beb3a5147c6124751cb96aef685a6b8 kernel-devel-6.12.0-211.63.1.el10_2.ppc64le.rpm ab22772199ab7c44f02050a55267cf75bf223827a6582da73d6409677601cd45 kernel-devel-matched-6.12.0-211.63.1.el10_2.ppc64le.rpm b2257ebf6ebb56bdf315758fc5fd2e55f82e890b8f7ecb198f998fa4266992d2 kernel-debug-devel-6.12.0-211.63.1.el10_2.ppc64le.rpm f14864947ba134581e30d0157dd09200e8e608aafb0299c05f821f47fce68da0 ALSA-2026:76743 Copyright 2026 AlmaLinux OS 0 1 Important

opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default opentelemetry-collector-0.158.0-1.el10_2.ppc64le.rpm ce360ca1e388e82e3b28f28c8f567a93de5dfc5d64a1743dddef53983a1ba9dd ALSA-2026:76762 Copyright 2026 AlmaLinux OS 0 1 Important

perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-DBI-1.643-26.el10_2.7.ppc64le.rpm f0b89c97c13eb74191c5115b640e932295c136c9b5e3228d72216ab12a6364d5 ALSA-2026:76781 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: Buffer Overflow in strfmon right-justification padding (CVE-2026-19499) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) Bug Fix(es) and Enhancement(s): * The iconv utility no longer returns exit status 1 after a successful //TRANSLIT transliteration * A counter overflow in __wcsmbs_clone_conv that occurred when setlocale was called has been fixed * A fcntl.h header conflict when compiling on AlmaLinux 10 has been resolved * Minor documentation improvements have been picked up from upstream For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-locale-source-2.39-142.el10_2.alma.1.ppc64le.rpm 291b94a0dcd9ec2385f50cd3b080fc0584912fadf25a65e3635f347661395db4 glibc-utils-2.39-142.el10_2.alma.1.ppc64le.rpm 4de033feef3d2fd3972823b03dd9eb0bd6ec5cd60e7281c666fddbffb209bfb9 glibc-doc-2.39-142.el10_2.alma.1.noarch.rpm 9ff671a257df14b19f73a58d114b8b73bcc77d16d5944e412b42babfd68bffd5 glibc-devel-2.39-142.el10_2.alma.1.ppc64le.rpm c5df44dfe1606fa54e5f3fdf4954a838df9020adbd4e0c3f5d862e06ed1cc913 ALSA-2026:76918 Copyright 2026 AlmaLinux OS 0 1 Important

openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssl-devel-3.5.8-2.el10_2.alma.1.ppc64le.rpm a2b978fd02ff1f84354c4c0b117d9c53966e289e26acc2c29083fa0dd8c01b0f openssl-perl-3.5.8-2.el10_2.alma.1.ppc64le.rpm be0ffc9d7e207e858069e323072bc425e1cb4d86b9ceb5c4603a052546d23c2f ALSA-2026:77018 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-tkinter-3.14.8-1.el10_2.ppc64le.rpm 0d8b51e73cc07547e8e66ad81714113f60e087a76d74b49501c1877a2246d939 python3.14-libs-3.14.8-1.el10_2.ppc64le.rpm 6390f98cef2e3871dfe77266e3cf1f85eb165c8d106aa7e65465c113c8400b79 python3.14-devel-3.14.8-1.el10_2.ppc64le.rpm 6ce72c47ffc4ad76df64722b7f1b589237977dc9e11dcd9ba7ce0b39313d38dd python3.14-3.14.8-1.el10_2.ppc64le.rpm c28bd0654ac0e66c7fb4cb9ae7e2d216bc83cf3a76d815afaf4b4761028e3511 ALSA-2026:77020 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python-unversioned-command-3.12.15-1.el10_2.noarch.rpm 8c7ff57dbefad31a537c80cf34212f88d1136e20c2922150444565e58eb8d223 python3-tkinter-3.12.15-1.el10_2.ppc64le.rpm af83cf160bdcc125ccab9a91188f10aa932cc745ef031a130267385d89664fc1 python3-devel-3.12.15-1.el10_2.ppc64le.rpm fcefe944b600300316b30969fd88a640d101e7b607a730eff945a74a229ba296 ALSA-2026:77534 Copyright 2026 AlmaLinux OS 0 1 Moderate

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sssd-idp-2.12.0-3.el10_2.2.ppc64le.rpm 3c130edeea26e105527fafce7a6dd6d973a7da12dca1e7141c126abcd50010d5 ALSA-2026:77648 Copyright 2026 AlmaLinux OS 0 1 Important

dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default idm-pki-base-11.9.0-6.el10_2.alma.1.noarch.rpm 08cad358e01aeaea12f186ece0391cb7e0364ef41ceeff79643cc2483d3f898a idm-pki-ca-11.9.0-6.el10_2.alma.1.noarch.rpm 29d3862dababdb52efd6b9b8d0372dc5651d36ee8ddf03be663bce826f8057f7 idm-pki-tools-11.9.0-6.el10_2.alma.1.ppc64le.rpm 7275e13763eab0db094de79304535485586fc77b8061bc1e903fe50a54434132 idm-pki-acme-11.9.0-6.el10_2.alma.1.noarch.rpm 7f0b192b8db647fca321e71a6b228288db085e67440a44ed2a3b091c5afc2756 idm-pki-kra-11.9.0-6.el10_2.alma.1.noarch.rpm 980108ca4a2ba723015accc088c6d78c8156b9f1376730f10dcb357a939fa7b6 python3-idm-pki-11.9.0-6.el10_2.alma.1.noarch.rpm d22e7c708f2b9d42c11a0567e3ec0d29b0d6c46728b35bb961574ffc6c76b8d2 idm-pki-java-11.9.0-6.el10_2.alma.1.noarch.rpm e127ae2fe0297a6c06dbbd9e5f26fe945b6221de37834b8e268f77e123acb422 idm-pki-server-11.9.0-6.el10_2.alma.1.noarch.rpm e3e12ed856ec63faff76d4dccd1667fa768ec21c075cca9878222449ea115cbc ALSA-2026:77690 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675) Bug Fix(es) and Enhancement(s): * mlxbf_bootctl: driver update to Linux v6.16 [Nvidia 10.2.z FEAT] (JIRA:AlmaLinux-212709) * [GNR-D] missing interfaces tspll_cfg [almalinux-10.2] (JIRA:AlmaLinux-273805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-headers-6.12.0-211.64.1.el10_2.ppc64le.rpm 018a6a98a8c4dc82faf462c1644798574309641a7382664ae74488d6e862f6d8 rtla-6.12.0-211.64.1.el10_2.ppc64le.rpm 0f30972121cf97dbb2ae36b93e97bdcf9e84a403a13aa1185296bec858f35984 kernel-devel-matched-6.12.0-211.64.1.el10_2.ppc64le.rpm 41b0289c76c9a550ca347aada2320e001dba00ed7989fc3fcbc850d49ae7a18e kernel-debug-devel-matched-6.12.0-211.64.1.el10_2.ppc64le.rpm 5049a6a5fc34c3c81a6dbbb51119abcb4442e747ac62bd48bc5d2bee0bc47bc2 perf-6.12.0-211.64.1.el10_2.ppc64le.rpm 51a4c4960f3aa8fa2d0b3c5c9b12c6ad4a01fa9937a39d891c8a00f9aa31a4ff python3-perf-6.12.0-211.64.1.el10_2.ppc64le.rpm 6b3bc674c64b440684f41b8c8f433242765c5b26c053701e26724f192d1a0d7d kernel-doc-6.12.0-211.64.1.el10_2.noarch.rpm acf673cac34caad11b9a79021df322d42655a2b4d8c23977bfc8bd93706609ff kernel-devel-6.12.0-211.64.1.el10_2.ppc64le.rpm e61cee6a9576d09b69bb9184b90e537d05a9aa6ce5455ae2a20b855b702fa7dc kernel-debug-devel-6.12.0-211.64.1.el10_2.ppc64le.rpm ebb6e3bb3fcec6ed6040f62bd7491fe5dfca62c8fb8931936e9627cb6c86ec86 rv-6.12.0-211.64.1.el10_2.ppc64le.rpm ecf7d9811d98337c56e8b7f7e76ec79ebc7355aa87bbe401a24fd994cfc15ed7 ALSA-2026:79122 Copyright 2026 AlmaLinux OS 0 1 Important

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.1.ppc64le.rpm 792e4529f69d0473b2d673bd5d4d76252d2b23513f4bf5b604e7c3470feddef8 ALSA-2026:79371 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dovecot-2.3.21-19.el10_2.8.ppc64le.rpm 56b31c9b9f6537c795c3f845ad6b552eb3b11d10a24dd6f3fd92dac00b980262 dovecot-mysql-2.3.21-19.el10_2.8.ppc64le.rpm 586255a5cf92c7fcc31d88f76fbe284befcbf7efb6d42df165779f09d88b895c dovecot-pigeonhole-2.3.21-19.el10_2.8.ppc64le.rpm 9b85de391248063893b2391b190bb4d6d2205d0920441f0141753546f2a33599 dovecot-pgsql-2.3.21-19.el10_2.8.ppc64le.rpm ef3478f07e0431a0801fc3714c821c59f6de5b8c35aef741d4c13ec6692620ff ALSA-2026:80495 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default flatpak-builder-1.4.4-1.el10_2.1.ppc64le.rpm e57c03985544be4f054f955998dc6125f009e6c104e168f4448fd63d6568f6a9 ALSA-2026:80498 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm 172e1711504e739522ae1206e914d28afb7a6412e2819c17a2f06a084ed5aec3 flatpak-session-helper-1.16.0-9.el10_2.4.ppc64le.rpm 22419efca82bbfcbe69519bc36eefee7e7cb0344cbe6c264267a985c06276522 flatpak-libs-1.16.0-9.el10_2.4.ppc64le.rpm 7cd9ec44afa425f097515c458db0a6a77797967f7ec0721df84ea56d521b66ae flatpak-1.16.0-9.el10_2.4.ppc64le.rpm 9ddfefb5d1eb7864bcb7bb593b7e1f844cc7b76f12e39ff1c36e5505d80360e2 ALSA-2026:80512 Copyright 2026 AlmaLinux OS 0 1 Moderate

curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253) * curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545) * curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429) * curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168) * libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libcurl-devel-8.12.1-4.el10_2.7.ppc64le.rpm c8f9b3644bb7aeedc70f940c2bf4270c25f13cf1be4d1d1ec2bf38d9f0acce01 ALSA-2026:80605 Copyright 2026 AlmaLinux OS 0 1 Critical

cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cjose-0.6.2.2-7.el10_2.2.ppc64le.rpm a1a95eb32c7ec9cea4ffdc745f9bbac5bd947ba34dfcbb42fcf95b913b1f27ca ALSA-2026:81406 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508) * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507) * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123) * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521) * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970) Bug Fix(es) and Enhancement(s): * net/tls backports for 10.2 (JIRA:AlmaLinux-275027) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-perf-6.12.0-211.65.1.el10_2.ppc64le.rpm 37299bff474767d673c4b29c86706d4ec6f8c2bf19cf8ef6451ba5d86b7521b4 kernel-headers-6.12.0-211.65.1.el10_2.ppc64le.rpm 645ab579e70ca0fe4398872046f8971e4ccf4bd79f6717faca7ea3448b19b7c6 kernel-devel-matched-6.12.0-211.65.1.el10_2.ppc64le.rpm 7733aba8355c462616b87e20c5fe9b5f9f7dea3046bb8e320ac9823deeb7478a kernel-debug-devel-matched-6.12.0-211.65.1.el10_2.ppc64le.rpm 8cde6153e53b2b148e81176f5b4d3662b104aead6e3d15760578432a6cbeb665 perf-6.12.0-211.65.1.el10_2.ppc64le.rpm 9768a67cc092fdafeeea2f5d203fcc1007ca660f5e2fc6d25a3d7c456ca1fa55 rv-6.12.0-211.65.1.el10_2.ppc64le.rpm acd346b9a4beacccc5b939740721d6f9b470945ce8a443e094082631a72d6f14 kernel-doc-6.12.0-211.65.1.el10_2.noarch.rpm b35f6a677826f22ce14c1a40eace7076869d953b08049e8332f8de56535432ee rtla-6.12.0-211.65.1.el10_2.ppc64le.rpm b5095a71e08c04a5223b5a18c8a8378d8cd4e5191a2ba5aa8b498d92d713b1c5 kernel-devel-6.12.0-211.65.1.el10_2.ppc64le.rpm d9893140dadf713259a33fd3ae056350b43534c6c660e27bd6fad8355462d463 kernel-debug-devel-6.12.0-211.65.1.el10_2.ppc64le.rpm f51e1ac0562d956b2e7741755c271c81234f5e1d39874b2df4692a5eead66f2f ALSA-2026:81518 Copyright 2026 AlmaLinux OS 0 1 Important

gd security update

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. Security Fix(es): * libgd: buffer overflow when processing specially crafted GIF file (CVE-2026-9672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default gd-2.3.3-20.el10_2.1.ppc64le.rpm 4d19a235f6e9c18d0290c0883ae8a0fd0badc53887890af0253a7689b2ede1a3 gd-devel-2.3.3-20.el10_2.1.ppc64le.rpm a189035e98a8e0da7f805aaccbd4c9c24d71a1e0da184b6168061c7e80ce22a3 ALSA-2026:81522 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default pcre2-utf32-10.44-1.5.el10_2.ppc64le.rpm 71ce095ee9ec4d315751e6c799288c2bd5111bbad1075c72d405fc76bfa6218d pcre2-utf16-10.44-1.5.el10_2.ppc64le.rpm 931dc615914049a6cceae7b752882505892fb167f2bd726dd4502ddaf76bb384 pcre2-devel-10.44-1.5.el10_2.ppc64le.rpm b5834aeab1b324da4474681f6ae53a195f82146eee55ca89366adca7a847865f ALSA-2026:82041 Copyright 2026 AlmaLinux OS 0 1 Important

python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient (CVE-2026-103262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3-tornado-6.5.10-1.el10_2.1.ppc64le.rpm a0ac1b7c8d93d64dec7e91848acb51495e76ce29042300d184335efe2bb534d9 ALSA-2026:82280 Copyright 2026 AlmaLinux OS 0 1 Moderate

tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine. Security Fix(es): * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default tftp-5.2-50.el10_2.ppc64le.rpm 057d45d9b863f77628cfa48a98dc8fce16ebfd19fe8391271eb322bc9e62ba0b tftp-server-5.2-50.el10_2.ppc64le.rpm 471f0e7d4490dc97ea8c63cfc24744cbbef06da6bc6cc9e3522f223390cbbf06 ALSA-2026:82883 Copyright 2026 AlmaLinux OS 0 1 Important

hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023) * hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098) * hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097) * hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100) * hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104) * hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105) * HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102) Bug Fix(es) and Enhancement(s): * [IMAGE-MODE] missing /var/lib/hp on image-mode [almalinux-10] (JIRA:AlmaLinux-266547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default hplip-common-3.26.6-1.el10_2.3.ppc64le.rpm 1a4a3451fd96ee1a9b708b7984b101eda761e6077d51c1ac84ee76c685170840 libsane-hpaio-3.26.6-1.el10_2.3.ppc64le.rpm 82a64995c62fb9aed603b1e15f14c9a18edc3197a79a33ce41fa066fbfacec0a hplip-libs-3.26.6-1.el10_2.3.ppc64le.rpm 8ff1078e17115ed3ec8ed09a011e574a149006fc7c0e75c01522662da0743754 hplip-3.26.6-1.el10_2.3.ppc64le.rpm 91749f76dce7b713b289562194120aa810e1f163d98d6a22e4ffa7b675be9e8a ALSA-2026:83207 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859) * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) Bug Fix(es) and Enhancement(s): * cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410) * ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-matched-6.12.0-211.66.1.el10_2.ppc64le.rpm 2e11b3fee29af053e3c4d9bad4e2ddb9eac5d2da0e946a288f201f7cc64b3e30 kernel-devel-matched-6.12.0-211.66.1.el10_2.ppc64le.rpm 43a453fb5c73cd4194572997222c3f32687626a860c335d689f9f4c0b55a4da0 perf-6.12.0-211.66.1.el10_2.ppc64le.rpm 6b364b094424060edfc786c602cba59465290fa76ba7a84568defa6db4b1c1d3 kernel-doc-6.12.0-211.66.1.el10_2.noarch.rpm 6f301a5976e15068aa2b07d6ae8075aff2544160af41ef58a535c64c538e8b53 kernel-debug-devel-6.12.0-211.66.1.el10_2.ppc64le.rpm 7b07119b8235710cf1bf670b578dcaea0bd2c624ea77ea27326a5c6e1807935d python3-perf-6.12.0-211.66.1.el10_2.ppc64le.rpm 7e6b2ee3b9446c4a0d5364dae4d67ff250f1b08a2eaca10ccf268173c8e9a263 kernel-headers-6.12.0-211.66.1.el10_2.ppc64le.rpm 84503fd2f7dfee1ab6c9bf108ce92f9c894e17a1937d9e02ff52e1f1bb41ed82 rtla-6.12.0-211.66.1.el10_2.ppc64le.rpm 9d5ea1ae4275fcf2350d912dc314c7ae1ec157cae6d2de7cc119b626439d8796 rv-6.12.0-211.66.1.el10_2.ppc64le.rpm af84f29c2771bed06a378016b72dfcaa28bd6e8840bb6ce1bf4f0ba792d62b15 kernel-devel-6.12.0-211.66.1.el10_2.ppc64le.rpm f479903a4e7dca9a2bd54e25654e564a6e888e409708173b044bcb3f32171b07 ALSA-2026:83551 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default ghostscript-tools-fonts-10.02.1-16.el10_2.3.noarch.rpm 2f11201ed712d8c66100867af2653f448d74381381908688fdc39f52910b7722 ghostscript-doc-10.02.1-16.el10_2.3.noarch.rpm 31dd0cac798502cb49a1a9259e5c0dcebf08e0e8ea0f2a893da972d2c6ca75d3 ghostscript-tools-printing-10.02.1-16.el10_2.3.noarch.rpm 6dad220e750d8b49fbcb9d4ba86f2c36b7071dd78d13d0856dff27d76ac4cf46 libgs-10.02.1-16.el10_2.3.ppc64le.rpm a32a79c40c76e543d64f1fd2590803317de00e7a8f8672dbb51edf0714d2ceac ghostscript-10.02.1-16.el10_2.3.ppc64le.rpm c4f23a628246920b948833fae2b4018b883985e2bdfa0d68297155ef83ba1333 ALSA-2026:83618 Copyright 2026 AlmaLinux OS 0 1 Important

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding (CVE-2026-102555) * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default libsoup3-3.6.5-3.el10_2.20.ppc64le.rpm 4e6113f48de0349fb3b06512886c81ed9bb459e182c00d9c167822bcceba8888 libsoup3-devel-3.6.5-3.el10_2.20.ppc64le.rpm d05f0f8af2536db7d6f4ade4474f163b61b3196550910432fc242c2243f31fd5 ALSA-2026:84578 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default python3.14-urllib3-2.6.3-2.el10_2.6.noarch.rpm f85520901dd8eaee108473d77b0f023b36fd8cbd327d8e82e253a0e60f981482 ALSA-2026:84587 Copyright 2026 AlmaLinux OS 0 1 Moderate

perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default perl-URI-5.27-3.el10_2.1.noarch.rpm 611eb7e29299e3e8f52bb171d6d8f6443251979af86b7d673d597c26e07700b3 ALSA-2026:84591 Copyright 2026 AlmaLinux OS 0 1 Important

emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default emacs-29.4-14.el10_2.3.ppc64le.rpm 07846449c2cbf89c66321427f74594273d709abdc468b168e806a76921d2a13e emacs-lucid-29.4-14.el10_2.3.ppc64le.rpm 578a42190464288fa5e3cb7b8efed096336bcfd9d7b76ea5ad3a8c5fdcc259f0 emacs-common-29.4-14.el10_2.3.ppc64le.rpm ec172a271cf7ff53be85ecb8506fbfd1bd7779a00cd09dd68736356cb814fc95 emacs-nw-29.4-14.el10_2.3.ppc64le.rpm fb11c80decb8de04545ff2f79099e40fe5d15d0d8af7e6ade89647271a10395a ALSA-2026:84721 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default wireshark-cli-4.4.2-10.el10_2.8.ppc64le.rpm 8bc561bfc20ea3dc03cc9e9f002fffbed174d59d7a78657aef69c83177f8447d wireshark-4.4.2-10.el10_2.8.ppc64le.rpm bdde2d49cd82808f1206b764b0ede6d64eae7e74e81bf4228f1f5ebe38fa3018 ALSA-2026:84753 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glibc-devel-2.39-145.el10_2.alma.1.ppc64le.rpm 79bbf56aec05fa5c39dc84b601bb4b058e41eeb958e39a1f655e52de64d548e0 glibc-locale-source-2.39-145.el10_2.alma.1.ppc64le.rpm a101b543474ad00359bee1d6c39b6925e6172de2b2a22b32b1f5216a32e6fa09 glibc-doc-2.39-145.el10_2.alma.1.noarch.rpm c1c6d8b798e7e9695a6bc003ad236d37961e0f8401f3349a7e892ca0785f46f8 glibc-utils-2.39-145.el10_2.alma.1.ppc64le.rpm c9da7b2d4dacfb6a512e8e67ef0a7c7d1c99439448e65694f3d0a4c299e6a9d8 ALSA-2026:84795 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default librabbitmq-tools-0.14.0-3.el10_2.1.ppc64le.rpm 23d61dbc23f963d9c14db89996fa771d6d2d77db12b67a2ea137fa2545dd288a librabbitmq-0.14.0-3.el10_2.1.ppc64le.rpm e38bf38cbd210760714c0f60c6525052250b81edc7888a079d69361865eb1efe ALSA-2026:84796 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * OpenEXR: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openexr-3.1.10-8.el10_2.5.ppc64le.rpm 0268066ba58be3f8255ccb99bb6028c9875788ffa8d69933f52a84c1e8b8e6fd openexr-libs-3.1.10-8.el10_2.5.ppc64le.rpm 3c6161f3eec5a0f4fb042fa963754802c915129de281a5e65e798d72acbd7105 ALSA-2026:84799 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default mariadb11.8-embedded-11.8.8-2.el10_2.alma.2.ppc64le.rpm 0e8ac97c9e9f5523312c1ae3d6621e29d10024042eedc178172d4f6c9c344e20 mariadb11.8-client-utils-11.8.8-2.el10_2.alma.2.noarch.rpm 12129a48fbf0bf75af7db9ec51b44577a01a5f68033e0afc2926050dfbd4b09a mariadb11.8-gssapi-server-11.8.8-2.el10_2.alma.2.ppc64le.rpm 2c510bf2119d597eb7851fbd07cbcb1bb31de846adcc36ce8147eff7e6a1935f mariadb11.8-11.8.8-2.el10_2.alma.2.ppc64le.rpm 34b6e98633624034ae833c3a4cf9d4fa327829641befab8ed5b1c49949288914 mariadb11.8-devel-11.8.8-2.el10_2.alma.2.ppc64le.rpm 3cbe9633820b5f232e124073c6b6ddfc66a840e13fcc4e02db34a0624b0bf4ba mariadb11.8-oqgraph-engine-11.8.8-2.el10_2.alma.2.ppc64le.rpm 5c19c6a09ce745691a5b95d0800809a0f5dd72a1bd7fe1f1ba015d29d8945667 mariadb11.8-pam-11.8.8-2.el10_2.alma.2.ppc64le.rpm 5db79ce66b7ac37fe27295fc617c3390fb45527c446d2fbc7701ba164076f56c mariadb11.8-server-galera-11.8.8-2.el10_2.alma.2.ppc64le.rpm 7c35dc9e839a707b4f1117e3591e6d590527000ebe174eeb24b1f2afe4d2a033 mariadb11.8-errmsg-11.8.8-2.el10_2.alma.2.noarch.rpm 8d642bace1bba11ccca8ea2c8a11a03bd79c79e1f8e1bb0d1c61760ee1505e1b mariadb11.8-embedded-devel-11.8.8-2.el10_2.alma.2.ppc64le.rpm 93cea79e4541cb1c80b9bd960f06adbbd4221c2e4a104624468f5432b53af953 mariadb11.8-test-11.8.8-2.el10_2.alma.2.ppc64le.rpm cd3050cf3f2df6950dedc72c8d6f40ecd9c3be74bc2aba84b9dfda0fe06ce8a5 mariadb11.8-server-utils-11.8.8-2.el10_2.alma.2.noarch.rpm eab081636282b63c450ea09a5a2d58ccd71c89eeef2705c6dc97af3c8ebe9c55 mariadb11.8-server-11.8.8-2.el10_2.alma.2.ppc64le.rpm edb125613821f11330342fb28c4132d4bf51ba00635390ce0094f085c2242874 mariadb11.8-backup-11.8.8-2.el10_2.alma.2.ppc64le.rpm f847e4daa65827a0b3f2ba7ef000fbf6142ddb7cdbbe4d46daae64e16a5ed415 mariadb11.8-common-11.8.8-2.el10_2.alma.2.noarch.rpm fad75cb8cb6a19b23db136f4f44c4038fddc3718e190afa3a73c8f04192d30ba ALSA-2026:85191 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default xorg-x11-server-Xwayland-24.1.9-4.el10_2.4.ppc64le.rpm 7aa7fdb9a9feb85591cfffbd24a8186191d4eeb92de5b9117b2503cfdbed1fab ALSA-2026:85276 Copyright 2026 AlmaLinux OS 0 1 Moderate

hostapd security update

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default hostapd-2.11-3.el10_2.ppc64le.rpm 3f94560cceebc26b7c6a9d2eb8bdf96739399d8d680a534921f16ee14d104fc6 ALSA-2026:85321 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: signal: Prevent exec() race (CVE-2026-98256) * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) Bug Fix(es) and Enhancement(s): * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:AlmaLinux-181987) * [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z] (JIRA:AlmaLinux-245336) * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678) * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228) * Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038) * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-10.2.z] (JIRA:AlmaLinux-280590) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default kernel-debug-devel-6.12.0-211.67.1.el10_2.ppc64le.rpm 0a1ec452ae77a9a9617b05174edad2257015d3d37cd54fa87f4ca68494d1d777 perf-6.12.0-211.67.1.el10_2.ppc64le.rpm 2fc630d09bbe61c922037f401b0ea493a0dddf82ec17d4abdbda4b3b76c85257 kernel-devel-6.12.0-211.67.1.el10_2.ppc64le.rpm 35588bf538d128657bcb0815bcc60af01d9eb0a0c3fceeec100ca0bb1c74018a rtla-6.12.0-211.67.1.el10_2.ppc64le.rpm 4776c0a72556e4c0f493129c65abe6686d9bd4c5bb25e01de0adb5d1891df661 rv-6.12.0-211.67.1.el10_2.ppc64le.rpm 69eb8284b3cf4cb92a402b02a9646f9ae75ac3344a09bf7d634cbed3ff9b75a3 kernel-headers-6.12.0-211.67.1.el10_2.ppc64le.rpm 8ff6af04639a534f649bbe33c8a45d28a212b92114921f9d6020695524d9eacb kernel-doc-6.12.0-211.67.1.el10_2.noarch.rpm 9caff7cead81e13e3372f4e55e542a9d645c00d414b73c690cfe3a97d7add266 python3-perf-6.12.0-211.67.1.el10_2.ppc64le.rpm b65a4dcccf2b16933115e504ab32f7e44bbb7760c404d6af287be31067bd3a0a kernel-devel-matched-6.12.0-211.67.1.el10_2.ppc64le.rpm dc18cc1c19796a491809ed2590ef665d5fc7a85df03911c9ffff3dff10feb259 kernel-debug-devel-matched-6.12.0-211.67.1.el10_2.ppc64le.rpm e533f2e7bafe465bdb0a4c027d3421f184ae27610f42acbda6c0738ac0cc1a8c ALSA-2026:85847 Copyright 2026 AlmaLinux OS 0 1 Moderate

openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default openssh-keysign-9.9p1-29.el10_2.alma.1.ppc64le.rpm 0a077e214ea34d2ded00ab9cff38401a52f85b5da98b5dcd0c1af611ad3635f0 openssh-askpass-9.9p1-29.el10_2.alma.1.ppc64le.rpm a45693765293ccddb2fac459ae24135e8e07aa201b50529e07675fb530dd883f ALSA-2026:85848 Copyright 2026 AlmaLinux OS 0 1 Important

rust-sequoia-sq security update

Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default sequoia-sq-1.4.0.1-4.el10_2.ppc64le.rpm 1b771007b581a9d0f2d45a29d71df3ab9425b88ee28022976c7775fe7b36bb72 ALSA-2026:85959 Copyright 2026 AlmaLinux OS 0 1 Moderate

fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default fetchmail-6.4.38-3.el10_2.1.ppc64le.rpm 24eb63390a65712d7fcaa175401ee69efa373af7b2ad53e964d719746b4f4c9f ALSA-2026:86093 Copyright 2026 AlmaLinux OS 0 1 Important

golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default golang-docs-1.26.10-1.el10_2.alma.1.noarch.rpm 2d79e769efee24206777297d81950a59cd8f92825199a4b095bd00a11b65fe72 golang-src-1.26.10-1.el10_2.alma.1.noarch.rpm 43d81a2ae0e8050075f42624aeeb87c9923f73d9eff287c06c6f5161f582dddc golang-race-1.26.10-1.el10_2.alma.1.ppc64le.rpm 4669d103ecdc543df988b7d4bb54e7baee2b6ff4413999c303f613a1cc12b0f8 golang-tests-1.26.10-1.el10_2.alma.1.noarch.rpm 8564845c95e3ad9ae431701bfc86844c9f231174349f09fa3bf96764c9e304bb golang-misc-1.26.10-1.el10_2.alma.1.noarch.rpm 9cca556f68ec191e90e65a5ff40a7482d60e4866fea7a72fa75649b2f73a01f7 golang-1.26.10-1.el10_2.alma.1.ppc64le.rpm c0f923ffd684dc9887634ddf4d2230abc47d8856562d21ccd8e8bc95fc138f62 golang-bin-1.26.10-1.el10_2.alma.1.ppc64le.rpm f394ea4e1f6f6538ec9074065723c2497dca8bd64ff41117c8adc3f9e832d105 go-toolset-1.26.10-1.el10_2.alma.1.ppc64le.rpm ff29956d0f409ec7cfff99bacf6d38ebe60e7ff9a53d86528e3d797e75f98ed4 ALSA-2026:86168 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-hostfxr-8.0-8.0.32-1.el10_2.ppc64le.rpm 4340a9599f2703c34fe927de8a20cccaa93a5ee265f0e3522a6c27ec9ba8a6b3 aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm 478321798bd17a05d5d16fc2ebdf5db9c8b2586aecc5317dc436835d4d3d6f11 dotnet-runtime-dbg-8.0-8.0.32-1.el10_2.ppc64le.rpm 50a499e73be559673f353f0727bcf67b998f8d2a62889f4305e31172d01feb71 aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2.ppc64le.rpm 80375766b84e92ec5fcb390892ea05ed6a995e2e7d7b5e0e084a73fd198e5bdf aspnetcore-runtime-8.0-8.0.32-1.el10_2.ppc64le.rpm 83b9ece34612919dacdd9c11a430debfae884bd68410fc8d6a214b3a36910ba7 dotnet-runtime-8.0-8.0.32-1.el10_2.ppc64le.rpm 8984dfc83737fec3d0bc61db80a284a646584107514bd25d5fdd65ae98cb8b7d dotnet-templates-8.0-8.0.132-1.el10_2.ppc64le.rpm aa84e225a86e11a1d843a19fd3159ef5cd8a76b3f3dfa12d46d01f7335d6e88d dotnet-sdk-dbg-8.0-8.0.132-1.el10_2.ppc64le.rpm d06d71c35715ffb9d4aff36ff049bd9b9d1915d99b69ef7c16b65ab7411b43ac dotnet-apphost-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm e87e96b240d55401f163e0879935dcdbf7d8f42d1391249d638c9ebcffa1b955 dotnet-sdk-8.0-8.0.132-1.el10_2.ppc64le.rpm f21fcc9f7fa0c5be10226960c750580dd5f56eebc33292ae48d069b6c5f3c224 dotnet-targeting-pack-8.0-8.0.32-1.el10_2.ppc64le.rpm f6ba7fe7c4e3036bfe3892bd928a2628d3badf55a74cc673dadeebd0fde1bc52 ALSA-2026:86172 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default dotnet-hostfxr-9.0-9.0.21-1.el10_2.ppc64le.rpm 3b93dbd819c72e6ffee3d4e8a415e7bdedf62abebf234bd4694221ee8a711f5c dotnet-sdk-dbg-9.0-9.0.122-1.el10_2.ppc64le.rpm 437d77eb766d4b022e012add9f73ab0038266d7f9b66b387d398220d9fd670d9 dotnet-targeting-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm 4b53906e047e606e04b0e0c5263cbb251373de2a163d4f56e13022773f0e9856 dotnet-runtime-dbg-9.0-9.0.21-1.el10_2.ppc64le.rpm 5960b44ba7403447a1e24bcabb84a495c962f41b34d8b9a05019e318f13d25aa dotnet-apphost-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm 60a18f1b7508ad1797e39eae039fc68668296521c84be12f28ab92412c8314ef dotnet-runtime-9.0-9.0.21-1.el10_2.ppc64le.rpm 7dc46ea7e4effeb1c6294e589f9f11bae067d49fc042317a06423171c22de2bf dotnet-templates-9.0-9.0.122-1.el10_2.ppc64le.rpm 927451603cad80320b565d3029f3fa6ceceb87f6b73a79666935ced86f8a86eb aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2.ppc64le.rpm 968044290577077337b2c8330e64fbd4b1d0641e3e78dc86d030d468307b92cb netstandard-targeting-pack-2.1-9.0.122-1.el10_2.ppc64le.rpm ae2d990c158d3f51e3b620c67f0683a5a5692d73e2a1047ef47c23cdf8336169 aspnetcore-runtime-9.0-9.0.21-1.el10_2.ppc64le.rpm b297b3519ac95adf24843372e5dc344553050b080433f608cad17c8dce63cb57 aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2.ppc64le.rpm eb801aed695cab06932a09234e20cf05fcc0d810288e449c6b49f730d2f4b389 dotnet-sdk-9.0-9.0.122-1.el10_2.ppc64le.rpm f02a9e5cd80e6d8ac1959682ea6678554da9156be5e85761a1e8f7b64da8cda0 ALSA-2026:86195 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2.ppc64le.rpm 3bd378baec8d2e91f9341ec9e121b68a9dcb8aaae063fd289b68b191639e0846 aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm 5d6bf48478f4c0c4766d467ddbae93afd61f67236cdf54d34ca8659f1656d801 aspnetcore-runtime-10.0-10.0.13-1.el10_2.ppc64le.rpm 7009db68f59e8849d89993f04e723290718a0bcaeb50c1b3b705ae73b422f9e2 dotnet-host-10.0.13-1.el10_2.ppc64le.rpm 729e1e2bbb88b904d659fad17438e706940be02963ce1e80a1f26bc39435e13d dotnet-hostfxr-10.0-10.0.13-1.el10_2.ppc64le.rpm 73deb4cdfc2e2933d73cc26fb3aafcbae5480412ca74ce944a6af8db4a2366a2 dotnet-sdk-10.0-10.0.113-1.el10_2.ppc64le.rpm 8407a723c32ef04b154f7b0660407198341a863dec3b8deed1f6b2c312ec00af dotnet-runtime-dbg-10.0-10.0.13-1.el10_2.ppc64le.rpm 9c65102a32d818d825edacdfcc7ab28403cab6f2a3c533cb03352ed432faa5c1 dotnet-runtime-10.0-10.0.13-1.el10_2.ppc64le.rpm a4246d5b9734f9a422ded41d62f14ae2d76607cbd35f849793ff99d2e32f7865 dotnet-apphost-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm a87103ec6d2790a0de9f8fd16b0414b8dcddad759f8e628b316e8a6e753343e0 dotnet-sdk-dbg-10.0-10.0.113-1.el10_2.ppc64le.rpm ce6845ff421c6e10ab8f3825e6f43a8aadbbac331f18efdd6491edfeff9ba231 dotnet-targeting-pack-10.0-10.0.13-1.el10_2.ppc64le.rpm d05b09027b8f7f6c3a81bd32d1f89dcf61f72e100e9afbacc63886a32cf7db81 dotnet-templates-10.0-10.0.113-1.el10_2.ppc64le.rpm db3f509bda5dbd99432a0c1156a695162605ddac16cf5515695e433cc8ee5e97 ALSA-2026:86331 Copyright 2026 AlmaLinux OS 0 1 Important

glycin-loaders security update

Sandboxed and extendable image decoding. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default glycin-loaders-1.0.1-1.el10_2.2.ppc64le.rpm 29115f71353e0f9a85ef9b1a8a729aa1ed500ffefe7ba4ac284099edd51a5c38 ALSA-2026:86841 Copyright 2026 AlmaLinux OS 0 1 Important

librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default rsvg-pixbuf-loader-2.57.1-9.el10_2.10.ppc64le.rpm 138db801e5e710c5047ac877d057de5125f1f9ef739ed8fcc997b7e9e00beb4a librsvg2-tools-2.57.1-9.el10_2.10.ppc64le.rpm 23a95e04db691a083844d910c02c68202a1a7945a99fdd3fa4ac2550927c2060 librsvg2-devel-2.57.1-9.el10_2.10.ppc64le.rpm 3ae142d81c424d9371b278cab39258952f526b858277f47e2a412219db79b037 librsvg2-2.57.1-9.el10_2.10.ppc64le.rpm eb772b32535e0a34ad3d84e9bdd74a708d8594ffcd541630a53486cd0bee2d73 ALSA-2026:86971 Copyright 2026 AlmaLinux OS 0 1 Moderate

cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default cockpit-machines-348.1-1.el10_2.noarch.rpm f07522ae8bce2750b2d0a9b32d8b9b159a43988af1d1d59a1c3ed9655cf017a5 ALSA-2026:87070 Copyright 2026 AlmaLinux OS 0 1 Important

php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php-gd-8.3.36-1.el10_2.ppc64le.rpm 1289e2f3e25b4cd8c57ac907388716bf65418a63a0e560f7c108adcea4078afd php-pdo-8.3.36-1.el10_2.ppc64le.rpm 17cb3103bdd9636f5fa9ae3f81e880f69ad81db999b08f29a2183594b0caf1e1 php-xml-8.3.36-1.el10_2.ppc64le.rpm 24cf919248939b50339b76b76e092fbe5d7669e234091b4ec415ba8433ec9b78 php-soap-8.3.36-1.el10_2.ppc64le.rpm 27c80bdcaa10f66070d59fb38786f66eb89484e4e7a70c262822d82edfa6cfac php-enchant-8.3.36-1.el10_2.ppc64le.rpm 377a8a929fd6527522919d69273254b0e4b2f0a72c100edb3da72a6dfd080461 php-devel-8.3.36-1.el10_2.ppc64le.rpm 41453985c20a91c8901ef8eac63c28f4515c89b654cadd963fbb37bc798fe4b1 php-odbc-8.3.36-1.el10_2.ppc64le.rpm 5017230c322e56b0311a2301fa6c56fdba52b20d82c89633732e10a2d2eca975 php-snmp-8.3.36-1.el10_2.ppc64le.rpm 5606d3e4677deed45774daecd25d5e968044b6dabe556fbe251741ec0e9bc939 php-dba-8.3.36-1.el10_2.ppc64le.rpm 58c343f99b7eac5ac8660b12a9e2da01308772d8b3c4f8c5a56481dd2cb9c3a7 php-8.3.36-1.el10_2.ppc64le.rpm 6523173687b26385a0a56fc140ac272cb34aeceb18f1afaf821ab24ab4b4ab2e php-opcache-8.3.36-1.el10_2.ppc64le.rpm 6db00e7e819401a6c6786169f05429460bc5c14893283dd96381f029be02160d php-process-8.3.36-1.el10_2.ppc64le.rpm 6fec2f228c0b63eb332a8ac21881283d9b44e43ea8594328c7462fc0f20e93d4 php-intl-8.3.36-1.el10_2.ppc64le.rpm 711eb8683b13ec56237d8270f83422c5f15245b09b0921d36ad3ce2192508516 php-mbstring-8.3.36-1.el10_2.ppc64le.rpm 776967dbeeabebb4d894d646a6e8e2f452b83d9e70e6b146514a1f49f22e47bc php-bcmath-8.3.36-1.el10_2.ppc64le.rpm 790a49804409cc2b4e688362872166034e4a86c07572572466bb20e84deb9b9e php-ldap-8.3.36-1.el10_2.ppc64le.rpm 7c27272e4c3784d1cfdf3143c2cfb057de04e93f2f1c32b2e07efaf076aed8ff php-dbg-8.3.36-1.el10_2.ppc64le.rpm 9e67a39ecba7920e1da610981a6395e22bb095349adcabbc3e9e5cb46a7d4a8f php-cli-8.3.36-1.el10_2.ppc64le.rpm b158c1aa388305367a36d52a23bf0afa810082a4abd1680ab0459ae350198558 php-fpm-8.3.36-1.el10_2.ppc64le.rpm b5e7b0a3ea32cc954e6aff207ae355939a16db628e7972f3e42c073653d69f38 php-pgsql-8.3.36-1.el10_2.ppc64le.rpm bfec8aa020cd49cf7a4bd5f3da37f4051198ebfbee6e652a72f003f3db84fe1a php-common-8.3.36-1.el10_2.ppc64le.rpm d7500db906fd5e4bdc3ee517cfd049d9b86f85cd0e508aaf998865ef5189ac68 php-mysqlnd-8.3.36-1.el10_2.ppc64le.rpm db09e7b263f5ff69b36f4fda3abdf05ee870afc44bafd7cb4adbe2909022ef52 php-embedded-8.3.36-1.el10_2.ppc64le.rpm e24e76cd8e187489239782d567cec4f7f83d92042e4aa68dab0c30fd58310901 php-ffi-8.3.36-1.el10_2.ppc64le.rpm fd82048d63e870bc97e4dcf4b4ea4b7af7eaccb10b4670b2e9f4cb96cd3dda54 php-gmp-8.3.36-1.el10_2.ppc64le.rpm fef47f162b9a044b3c91c704ad619e767903523ce8cb05ad657d3101cdd659d8 ALSA-2026:87071 Copyright 2026 AlmaLinux OS 0 1 Important

php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default php8.4-dba-8.4.27-1.el10_2.ppc64le.rpm 2633035b038a7289258f170f6628dadba01b76efc26b917395d368ba7f098dbc php8.4-ldap-8.4.27-1.el10_2.ppc64le.rpm 29d4c224328f5f478955fe115446fd1d67551fcd4cd63ca8d59a6741314d269c php8.4-ffi-8.4.27-1.el10_2.ppc64le.rpm 399c79115b5bcb40de7cb993477310cb682c6885de3800a14aa562f0391896a7 php8.4-soap-8.4.27-1.el10_2.ppc64le.rpm 4b81e2db54bf0a8baf424aeef0c2391539fde0b492667e01efdf2228adf0b814 php8.4-8.4.27-1.el10_2.ppc64le.rpm 4c72b71e7219455ec7557dc4460f7bd8dcd7fd1d3dfec98e7816b1ee943944a5 php8.4-bcmath-8.4.27-1.el10_2.ppc64le.rpm 54917cc760cca57dee8d96047e4bdc473814628699208c9b3c134f868a601b6b php8.4-gd-8.4.27-1.el10_2.ppc64le.rpm 5f982c6b6ee4d233d8727483398b060fab4bdd9971972905d9233a95d7674f52 php8.4-intl-8.4.27-1.el10_2.ppc64le.rpm 669cf03c3b53a8dd8f703339f96c844e1c0f5c4f44a2cf6a61582937a27e09c4 php8.4-process-8.4.27-1.el10_2.ppc64le.rpm 78863d58c3d483c74dbe1f47c0f298f496a3c7d9e65365544f3e83329484d6d4 php8.4-mysqlnd-8.4.27-1.el10_2.ppc64le.rpm 7fe402eef20478771b754a927d96849daefadd682cdc13e774601a51a80c3597 php8.4-gmp-8.4.27-1.el10_2.ppc64le.rpm 8c4a25c0869fc0fb4a12f43b8d194267b81871b98a5381b84d0f4215814baca2 php8.4-common-8.4.27-1.el10_2.ppc64le.rpm 8cb3f7a7ef8229c00d0bbef450f8acb191f296f52aa044034290ac58b31c1855 php8.4-pgsql-8.4.27-1.el10_2.ppc64le.rpm 8ec995b6517ffedccebebebc914d9b94af5a988a0454453abc3496c5c6683143 php8.4-enchant-8.4.27-1.el10_2.ppc64le.rpm 922e28bf97df01a593021b46451fbbdbe278d60fd20dada5116c4fee11207d48 php8.4-fpm-8.4.27-1.el10_2.ppc64le.rpm a741fec2e4948816943ea8589a0fe01dbd49a4a6b6275d8ffcd1d29134522b1b php8.4-dbg-8.4.27-1.el10_2.ppc64le.rpm ab0c752b498671f6b6a795d49082cb136e61a2fa8ce2078c5fec5d1e83d0d074 php8.4-devel-8.4.27-1.el10_2.ppc64le.rpm b330bfd981295a9649fa57758a3c405b3c79efde68cdd3f2ed23852869f680d5 php8.4-snmp-8.4.27-1.el10_2.ppc64le.rpm deb490f6366c916afc46895387ff7084e54534cb953e88d7c8666b84f18a1dc9 php8.4-odbc-8.4.27-1.el10_2.ppc64le.rpm e25fe27ae0c4d93654fda37f11f138c03b11ab2f7637d763e2d87e19d14048e4 php8.4-cli-8.4.27-1.el10_2.ppc64le.rpm f0ebaa5abd7a62aafd5aab8c1bc820be38d4b689fe2fae8b1f48de8220d8c85e php8.4-mbstring-8.4.27-1.el10_2.ppc64le.rpm f6cb73b019a7509283dc6c2da9f34671880221373ed6df0756e357b1ae714ddc php8.4-pdo-8.4.27-1.el10_2.ppc64le.rpm fe7daabd8982489250744dcccc71802178dd09e807d5466cae3a9087fa5dc627 ALSA-2026:88207 Copyright 2026 AlmaLinux OS 0 1 Important

iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-10-for-ppc64le-appstream-rpms__10_0_default iperf3-3.17.1-6.el10_2.2.ppc64le.rpm ba5f7fd12bc4b24f0598ca5813bd323c39b03c2515a4b74cf2fb31a1e1eba047