<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18134</id>
    <title>Moderate: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-06-08 10:12:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
  * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
  * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
  * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
  * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
  * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
  * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
  * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
  * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
  * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
  * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
  * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
  * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
  * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
  * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
  * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
  * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
  * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
  * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
  * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
  * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
  * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
  * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
  * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
  * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18134" id="RHSA-2026:18134" type="rhsa" title="RHSA-2026:18134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56633" id="CVE-2024-56633" type="cve" title="CVE-2024-56633"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-21839" id="CVE-2025-21839" type="cve" title="CVE-2025-21839"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-37980" id="CVE-2025-37980" type="cve" title="CVE-2025-37980"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38015" id="CVE-2025-38015" type="cve" title="CVE-2025-38015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38097" id="CVE-2025-38097" type="cve" title="CVE-2025-38097"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38166" id="CVE-2025-38166" type="cve" title="CVE-2025-38166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38202" id="CVE-2025-38202" type="cve" title="CVE-2025-38202"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38267" id="CVE-2025-38267" type="cve" title="CVE-2025-38267"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38275" id="CVE-2025-38275" type="cve" title="CVE-2025-38275"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38279" id="CVE-2025-38279" type="cve" title="CVE-2025-38279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38345" id="CVE-2025-38345" type="cve" title="CVE-2025-38345"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38346" id="CVE-2025-38346" type="cve" title="CVE-2025-38346"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38405" id="CVE-2025-38405" type="cve" title="CVE-2025-38405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38441" id="CVE-2025-38441" type="cve" title="CVE-2025-38441"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38470" id="CVE-2025-38470" type="cve" title="CVE-2025-38470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39866" id="CVE-2025-39866" type="cve" title="CVE-2025-39866"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40034" id="CVE-2025-40034" type="cve" title="CVE-2025-40034"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40134" id="CVE-2025-40134" type="cve" title="CVE-2025-40134"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40210" id="CVE-2025-40210" type="cve" title="CVE-2025-40210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40257" id="CVE-2025-40257" type="cve" title="CVE-2025-40257"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40320" id="CVE-2025-40320" type="cve" title="CVE-2025-40320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23040" id="CVE-2026-23040" type="cve" title="CVE-2026-23040"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23111" id="CVE-2026-23111" type="cve" title="CVE-2026-23111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23210" id="CVE-2026-23210" type="cve" title="CVE-2026-23210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23243" id="CVE-2026-23243" type="cve" title="CVE-2026-23243"/>
      <reference href="https://bugzilla.redhat.com/2334549" id="2334549" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2350585" id="2350585" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2367614" id="2367614" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2373343" id="2373343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376060" id="2376060" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376065" id="2376065" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2376382" id="2376382" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379178" id="2379178" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379187" id="2379187" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379199" id="2379199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379237" id="2379237" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2379239" id="2379239" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383399" id="2383399" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383478" id="2383478" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2383906" id="2383906" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2396940" id="2396940" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2406782" id="2406782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2414468" id="2414468" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2416307" id="2416307" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418880" id="2418880" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2419945" id="2419945" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436806" id="2436806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439687" id="2439687" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439895" id="2439895" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448594" id="2448594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18134.html" id="ALSA-2026:18134" type="self" title="ALSA-2026:18134"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.7.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c3612aaf2cc26626a014a10d495e8c59b82da6845507d18dab56504bad2897ff</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.7.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.7.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.7.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">f8dee937eeb34c7a2021e63f0824b1f856ba8ddd6ee487652bc93e28cd406aa4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18142</id>
    <title>Low: NetworkManager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>NetworkManager security update</summary>
    <description>NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.  

Security Fix(es):  

  * networkmanagr: NetworkManager File Access (CVE-2025-9615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18142" id="RHSA-2026:18142" type="rhsa" title="RHSA-2026:18142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-9615" id="CVE-2025-9615" type="cve" title="CVE-2025-9615"/>
      <reference href="https://bugzilla.redhat.com/2391503" id="2391503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18142.html" id="ALSA-2026:18142" type="self" title="ALSA-2026:18142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="NetworkManager-libnm-devel" version="1.56.0" release="1.el10" epoch="1" arch="s390x" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-libnm-devel-1.56.0-1.el10.s390x.rpm</filename>
          <sum type="sha256">009f10999049d3d52af23280b69a6c660c404a4d55714b1d951a2ee31e347e62</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:09"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libvirt security update</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.  

Security Fix(es):  

  * libvirt: Denial of service in XML parsing (CVE-2025-12748)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18326" id="RHSA-2026:18326" type="rhsa" title="RHSA-2026:18326"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748"/>
      <reference href="https://bugzilla.redhat.com/2413801" id="2413801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18326.html" id="ALSA-2026:18326" type="self" title="ALSA-2026:18326"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libvirt-devel" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="s390x" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-devel-11.10.0-12.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">371ed5cad0899981a2bbb73c5aacddd13b764194192db4a0db68d0f5c66e6ae6</sum>
        </package>
        <package name="libvirt-daemon-plugin-sanlock" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="s390x" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-plugin-sanlock-11.10.0-12.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">42381c84388b281680ebb4a505b20ebdd2a84370aa8f04c50bc871a6fbcce5e0</sum>
        </package>
        <package name="libvirt-docs" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="s390x" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-docs-11.10.0-12.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">9ecc6219f596c095ccd4b4ef9146d9bb258eaffc7145b0957327e541837e01f9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>luksmeta security update</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux.  

Security Fix(es):  

  * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18421" id="RHSA-2026:18421" type="rhsa" title="RHSA-2026:18421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568"/>
      <reference href="https://bugzilla.redhat.com/2404244" id="2404244" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18421.html" id="ALSA-2026:18421" type="self" title="ALSA-2026:18421"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libluksmeta-devel" version="10" release="1.el10" epoch="0" arch="s390x" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-devel-10-1.el10.s390x.rpm</filename>
          <sum type="sha256">dc1cef2ec515512e10e1ca857d409fac0a1e729c8b8c9af53869337f2ea472e9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>edk2 security update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="rhsa" title="RHSA-2026:18465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296"/>
      <reference href="https://bugzilla.redhat.com/2420637" id="2420637" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18465.html" id="ALSA-2026:18465" type="self" title="ALSA-2026:18465"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="edk2-ovmf" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">0440f37c3dfa7d8ed89074f19a592ec31ae69caf218c9c023a8e521cbedd1c05</sum>
        </package>
        <package name="edk2-aarch64" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">661e753247f1f87f60b2ab15a15e98b65bd5218f23543c33c5087b94428cc7aa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: DNSBomb vulnerability (CVE-2024-33655)
  * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18556" id="RHSA-2026:18556" type="rhsa" title="RHSA-2026:18556"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411"/>
      <reference href="https://bugzilla.redhat.com/2279942" id="2279942" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2405706" id="2405706" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18556.html" id="ALSA-2026:18556" type="self" title="ALSA-2026:18556"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="unbound-devel" version="1.24.2" release="7.el10" epoch="0" arch="s390x" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-devel-1.24.2-7.el10.s390x.rpm</filename>
          <sum type="sha256">be0928f089ff5547a4f6505a0c4a3fe3af2cd7cd7c4eadcb525a12eb25d787a3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql18 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)
  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19009" id="RHSA-2026:19009" type="rhsa" title="RHSA-2026:19009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007"/>
      <reference href="https://bugzilla.redhat.com/2439320" id="2439320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19009.html" id="ALSA-2026:19009" type="self" title="ALSA-2026:19009"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="postgresql18-test-rpm-macros" version="18.3" release="1.el10_2" epoch="0" arch="noarch" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-test-rpm-macros-18.3-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e9147c3a255628bd463c0f2320a7d06550e3494a0ceb08582a56325aabc74712</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19010" id="RHSA-2026:19010" type="rhsa" title="RHSA-2026:19010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19010.html" id="ALSA-2026:19010" type="self" title="ALSA-2026:19010"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="postgresql-test-rpm-macros" version="16.13" release="1.el10_2" epoch="0" arch="noarch" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-test-rpm-macros-16.13-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d4481b8a457194d72857697fc9d4be3eea8b3c7d0946949734ed60169bef4a82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="rhsa" title="RHSA-2026:19017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19017.html" id="ALSA-2026:19017" type="self" title="ALSA-2026:19017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="podman-tests" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="s390x" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-tests-5.8.2-1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">c6fc254c0c378fffda819e4951a516502a309d9b66bf64ad117ec4e6e24261c4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19019" id="RHSA-2026:19019" type="rhsa" title="RHSA-2026:19019"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2431367" id="2431367" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458239" id="2458239" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19019.html" id="ALSA-2026:19019" type="self" title="ALSA-2026:19019"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3.14-freethreading-devel" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-devel-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">0cd7e038659fab95079fda97854e6983aacad5c7371fdabf4a442f4831ffc1bb</sum>
        </package>
        <package name="python3.14-freethreading-debug" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-debug-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">1b194f4ca3d64854b671685ae7f4d1a35761fe5297c7483c12f288fd9d2a6c66</sum>
        </package>
        <package name="python3.14-freethreading" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">2b3a0e7d7611cb45a6b2339d87aa6e489b441cdc612bdc8c2cec01a905ce8fc5</sum>
        </package>
        <package name="python3.14-debug" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-debug-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">339e497afd6286d1033a286e65f6b41b4fd3a7642069620028165751568ed146</sum>
        </package>
        <package name="python3.14-freethreading-test" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-test-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">4fc998584bd750a96d4e3669cd84e78fce443dbc11cc30272a6014afb7138e64</sum>
        </package>
        <package name="python3.14-test" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-test-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">7ec954454d967ef490024776bf62f10c4a93fb821935666955fa4579f621fa08</sum>
        </package>
        <package name="python3.14-freethreading-idle" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-idle-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">d2350bcd20e68bb7aeed5659dce9b744340aa8fe2878161dc7c8ac34f674ea4e</sum>
        </package>
        <package name="python3.14-freethreading-tkinter" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-tkinter-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">dc5671202d2a8b4b1ba9580659a495ec108f13fb35eb42562ed713c359c63704</sum>
        </package>
        <package name="python3.14-freethreading-libs" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-libs-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">dd8761f66ccd571c3fd9417d1c3ad8f1aff3c898c0448c8ea24d99f59348d2a1</sum>
        </package>
        <package name="python3.14-idle" version="3.14.4" release="2.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-idle-3.14.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">ec228012d1c1a7194dcd680816b7614354632972b7e36538f56440883c2a5b2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19024" id="RHSA-2026:19024" type="rhsa" title="RHSA-2026:19024"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085"/>
      <reference href="https://bugzilla.redhat.com/2447490" id="2447490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447492" id="2447492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447495" id="2447495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447496" id="2447496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447498" id="2447498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447500" id="2447500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447503" id="2447503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19024.html" id="ALSA-2026:19024" type="self" title="ALSA-2026:19024"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-devel" version="1.26.7" release="2.el10_2" epoch="0" arch="s390x" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-devel-1.26.7-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">34a3b8ad2fb0bcd851d33acdd85a7d3f85dc4fb9b1b2b212f21a649137aee186</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19043</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-07-15 10:03:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>corosync security update</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.  

Security Fix(es):  

  * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)
  * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19043" id="RHSA-2026:19043" type="rhsa" title="RHSA-2026:19043"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092"/>
      <reference href="https://bugzilla.redhat.com/2453813" id="2453813" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453814" id="2453814" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19043.html" id="ALSA-2026:19043" type="self" title="ALSA-2026:19043"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="corosync-vqsim" version="3.1.10" release="1.el10_2.1" epoch="0" arch="s390x" src="corosync-3.1.10-1.el10_2.1.src.rpm">
          <filename>corosync-vqsim-3.1.10-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">79447b5ac56d61449ebf959204e43572a3237eb8315ddfb27106fe7555e4b19b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19053" id="RHSA-2026:19053" type="rhsa" title="RHSA-2026:19053"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554"/>
      <reference href="https://bugzilla.redhat.com/2450778" id="2450778" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19053.html" id="ALSA-2026:19053" type="self" title="ALSA-2026:19053"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="freeipmi-devel" version="1.6.17" release="1.el10_2" epoch="0" arch="s390x" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-devel-1.6.17-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">15274b7a51416987e359312cd4909bba087ee36a00feeab0f6ecfaf46429b993</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19061</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
  * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19061" id="RHSA-2026:19061" type="rhsa" title="RHSA-2026:19061"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4437" id="CVE-2026-4437" type="cve" title="CVE-2026-4437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4438" id="CVE-2026-4438" type="cve" title="CVE-2026-4438"/>
      <reference href="https://bugzilla.redhat.com/2449777" id="2449777" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449783" id="2449783" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19061.html" id="ALSA-2026:19061" type="self" title="ALSA-2026:19061"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="glibc-benchtests" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-benchtests-2.39-121.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">0ce4bf4f0e32b09fb276eb8ba12ae0a78a563ee86c5c2752447efc5efcc2217d</sum>
        </package>
        <package name="nss_db" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>nss_db-2.39-121.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">5dc275abcfad86b7c6228e403be03bf6954003fe43768af8dec636f1f7e2b5f8</sum>
        </package>
        <package name="nss_hesiod" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>nss_hesiod-2.39-121.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">6cf12fca09590e2211c5c39e7be8ee68ada663107a5af2e616e5cc697f4098bd</sum>
        </package>
        <package name="glibc-nss-devel" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-nss-devel-2.39-121.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">a22cefe8fc05c9673cc9b2cefe41f8699803a187dadfd93ec0642679fe451a2b</sum>
        </package>
        <package name="glibc-static" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-static-2.39-121.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">e2ec3b381514c88f19d9a385c001f7b60f96a61a94fef9e863d68506aa8d9bc9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19064</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
  * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
  * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
  * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
  * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19064" id="RHSA-2026:19064" type="rhsa" title="RHSA-2026:19064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13837" id="CVE-2025-13837" type="cve" title="CVE-2025-13837"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15282" id="CVE-2025-15282" type="cve" title="CVE-2025-15282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59375" id="CVE-2025-59375" type="cve" title="CVE-2025-59375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6075" id="CVE-2025-6075" type="cve" title="CVE-2025-6075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0672" id="CVE-2026-0672" type="cve" title="CVE-2026-0672"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2395108" id="2395108" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2408891" id="2408891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418084" id="2418084" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431366" id="2431366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431374" id="2431374" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19064.html" id="ALSA-2026:19064" type="self" title="ALSA-2026:19064"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3-test" version="3.12.13" release="2.el10_2" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-test-3.12.13-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">52f71b62bd69e1ee40072b82c66ca471783372b48a5d498efea7f3f6596840b0</sum>
        </package>
        <package name="python3-debug" version="3.12.13" release="2.el10_2" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-debug-3.12.13-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">8dfec4cac37b274b04aebf0b0b7ba16a367919b1b7358846684604440c163a52</sum>
        </package>
        <package name="python3-idle" version="3.12.13" release="2.el10_2" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-idle-3.12.13-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">980a1a2a672f26df14691dde698e0b7f367e0bc009cb98c2a3a7c6994aaa23b2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19074</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:46"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060)
  * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
  * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)
  * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19074" id="RHSA-2026:19074" type="rhsa" title="RHSA-2026:19074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23060" id="CVE-2026-23060" type="cve" title="CVE-2026-23060"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31431" id="CVE-2026-31431" type="cve" title="CVE-2026-31431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31677" id="CVE-2026-31677" type="cve" title="CVE-2026-31677"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://bugzilla.redhat.com/2436779" id="2436779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460538" id="2460538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461763" id="2461763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19074.html" id="ALSA-2026:19074" type="self" title="ALSA-2026:19074"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.7.3.el10_2.s390x.rpm</filename>
          <sum type="sha256">af32a1101b12bfea140e88c8a283cc565dd3235dbe75a534a32e77e1693d7154</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.7.3.el10_2.s390x.rpm</filename>
          <sum type="sha256">e5ae031cbd72d088038d8677c9534f5798e8d42ff13220dd3942daa1d06cb110</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>xorg-x11-server-Xwayland security update</summary>
    <description>Xwayland is an X server for running X clients under Wayland.  

Security Fix(es):  

  * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
  * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
  * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19125" id="RHSA-2026:19125" type="rhsa" title="RHSA-2026:19125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003"/>
      <reference href="https://bugzilla.redhat.com/2451106" id="2451106" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451109" id="2451109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451113" id="2451113" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19125.html" id="ALSA-2026:19125" type="self" title="ALSA-2026:19125"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="xorg-x11-server-Xwayland-devel" version="24.1.9" release="4.el10_2" epoch="0" arch="s390x" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.s390x.rpm</filename>
          <sum type="sha256">b726ca8177e4e9dddef6036683353c30206537ea41ab82b5e5e682e73c127437</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19126" id="RHSA-2026:19126" type="rhsa" title="RHSA-2026:19126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19126.html" id="ALSA-2026:19126" type="self" title="ALSA-2026:19126"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="yggdrasil-devel" version="0.4.9" release="4.el10_2" epoch="0" arch="s390x" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-devel-0.4.9-4.el10_2.s390x.rpm</filename>
          <sum type="sha256">b0e13767f01e49732a5f232b953aac704803cc4c0bf4e87bb9fcc11f90fcc977</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>PackageKit security update</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.  

Security Fix(es):  

  * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19141" id="RHSA-2026:19141" type="rhsa" title="RHSA-2026:19141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651"/>
      <reference href="https://bugzilla.redhat.com/2460604" id="2460604" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19141.html" id="ALSA-2026:19141" type="self" title="ALSA-2026:19141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="PackageKit-glib-devel" version="1.2.8" release="8.el10_2" epoch="0" arch="s390x" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-glib-devel-1.2.8-8.el10_2.s390x.rpm</filename>
          <sum type="sha256">b8198195b443d8086eac21fb570808298b328d88110bdb7e220e1fd65b556937</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19143</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsoup3 security update</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.  

Security Fix(es):  

  * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19143" id="RHSA-2026:19143" type="rhsa" title="RHSA-2026:19143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119"/>
      <reference href="https://bugzilla.redhat.com/2448044" id="2448044" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452932" id="2452932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19143.html" id="ALSA-2026:19143" type="self" title="ALSA-2026:19143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libsoup3-doc" version="3.6.5" release="3.el10_2.11" epoch="0" arch="noarch" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-doc-3.6.5-3.el10_2.11.noarch.rpm</filename>
          <sum type="sha256">e9c9aacec423d69703716502eee70d36997b031b05b8cdd423d46cbd4cf7206c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19146</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-07-08 11:53:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openexr security update</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  

Security Fix(es):  

  * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19146" id="RHSA-2026:19146" type="rhsa" title="RHSA-2026:19146"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588"/>
      <reference href="https://bugzilla.redhat.com/2455408" id="2455408" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19146.html" id="ALSA-2026:19146" type="self" title="ALSA-2026:19146"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="openexr-devel" version="3.1.10" release="8.el10_2.2" epoch="0" arch="s390x" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-devel-3.1.10-8.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">a37277120b8333cccdd0725bd7be79dfdfe550705f16e55ee0763949e2e3ab0b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19148</id>
    <title>Moderate: glib2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
  * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19148" id="RHSA-2026:19148" type="rhsa" title="RHSA-2026:19148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14087" id="CVE-2025-14087" type="cve" title="CVE-2025-14087"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14512" id="CVE-2025-14512" type="cve" title="CVE-2025-14512"/>
      <reference href="https://bugzilla.redhat.com/2419093" id="2419093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2421339" id="2421339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19148.html" id="ALSA-2026:19148" type="self" title="ALSA-2026:19148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="glib2-doc" version="2.80.4" release="12.el10_2.13" epoch="0" arch="s390x" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-doc-2.80.4-12.el10_2.13.s390x.rpm</filename>
          <sum type="sha256">10efd527c990b89d7c75707ca1ddd6aa7c98fd4a7ac93eee490cc6e7d9d2e1ec</sum>
        </package>
        <package name="glib2-static" version="2.80.4" release="12.el10_2.13" epoch="0" arch="s390x" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-static-2.80.4-12.el10_2.13.s390x.rpm</filename>
          <sum type="sha256">dfa001e61a1afa927856cc7772d939be53ec559e2560cbdd5e086d5931d4cd8d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
  * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
  * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19149" id="RHSA-2026:19149" type="rhsa" title="RHSA-2026:19149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858"/>
      <reference href="https://bugzilla.redhat.com/2452172" id="2452172" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452175" id="2452175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452179" id="2452179" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19149.html" id="ALSA-2026:19149" type="self" title="ALSA-2026:19149"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dovecot-devel" version="2.3.21" release="19.el10_2" epoch="1" arch="s390x" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-devel-2.3.21-19.el10_2.s390x.rpm</filename>
          <sum type="sha256">d32189b52af12d0a1881f8b4ebe04dc9210487c93342e63a5630c96f86d29456</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19150" id="RHSA-2026:19150" type="rhsa" title="RHSA-2026:19150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775"/>
      <reference href="https://bugzilla.redhat.com/2450768" id="2450768" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19150.html" id="ALSA-2026:19150" type="self" title="ALSA-2026:19150"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libtiff-tools" version="4.6.0" release="8.el10_2.1" epoch="0" arch="s390x" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-tools-4.6.0-8.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">287e5a08437cf775caa62bad96e4b22fa974a250f0e874648877a7bb6cfe88ba</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19151</id>
    <title>Important: jq security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>jq security update</summary>
    <description>jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.  

Security Fix(es):  

  * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979)
  * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19151" id="RHSA-2026:19151" type="rhsa" title="RHSA-2026:19151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39979" id="CVE-2026-39979" type="cve" title="CVE-2026-39979"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40164" id="CVE-2026-40164" type="cve" title="CVE-2026-40164"/>
      <reference href="https://bugzilla.redhat.com/2458077" id="2458077" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458084" id="2458084" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19151.html" id="ALSA-2026:19151" type="self" title="ALSA-2026:19151"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="jq-devel" version="1.7.1" release="11.el10_2.2" epoch="0" arch="s390x" src="jq-1.7.1-11.el10_2.2.src.rpm">
          <filename>jq-devel-1.7.1-11.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">633bc3f51b0bb3b2a4aaea3ce4014e25184d3d4b2d2125fa57d0faa45b6befde</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19154" id="RHSA-2026:19154" type="rhsa" title="RHSA-2026:19154"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868"/>
      <reference href="https://bugzilla.redhat.com/2446207" id="2446207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19154.html" id="ALSA-2026:19154" type="self" title="ALSA-2026:19154"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="giflib-devel" version="5.2.1" release="24.el10_2" epoch="0" arch="s390x" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-devel-5.2.1-24.el10_2.s390x.rpm</filename>
          <sum type="sha256">ef98c52f0ac5e693fd7087be188c41a7cd54823faeec4a3c9c2e49195aeced14</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="rhsa" title="RHSA-2026:19159"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945"/>
      <reference href="https://bugzilla.redhat.com/2477116" id="2477116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19159.html" id="ALSA-2026:19159" type="self" title="ALSA-2026:19159"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nginx-mod-devel" version="1.26.3" release="6.el10_2.3" epoch="2" arch="s390x" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-devel-1.26.3-6.el10_2.3.s390x.rpm</filename>
          <sum type="sha256">ab640387aab354f10eff20b69f971af329795c6e0a0d23fac4cc1d215f96c376</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-05-26 12:28:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libsndfile security update</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.   

Security Fix(es):  

  * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19560" id="RHSA-2026:19560" type="rhsa" title="RHSA-2026:19560"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555"/>
      <reference href="https://bugzilla.redhat.com/2463856" id="2463856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19560.html" id="ALSA-2026:19560" type="self" title="ALSA-2026:19560"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libsndfile-devel" version="1.2.2" release="6.el10_2.1" epoch="0" arch="s390x" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-devel-1.2.2-6.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">88e018df2c99e3ddfce7b5e48f4673289922aff9a2c381fec998645e8be80e22</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19569</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-06-07 18:12:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
  * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
  * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
  * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
  * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
  * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)
  * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
  * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
  * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)
  * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
  * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
  * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)
  * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19569" id="RHSA-2026:19569" type="rhsa" title="RHSA-2026:19569"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56603" id="CVE-2024-56603" type="cve" title="CVE-2024-56603"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-39766" id="CVE-2025-39766" type="cve" title="CVE-2025-39766"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68724" id="CVE-2025-68724" type="cve" title="CVE-2025-68724"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68741" id="CVE-2025-68741" type="cve" title="CVE-2025-68741"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23270" id="CVE-2026-23270" type="cve" title="CVE-2026-23270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23401" id="CVE-2026-23401" type="cve" title="CVE-2026-23401"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31402" id="CVE-2026-31402" type="cve" title="CVE-2026-31402"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31408" id="CVE-2026-31408" type="cve" title="CVE-2026-31408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31607" id="CVE-2026-31607" type="cve" title="CVE-2026-31607"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43128" id="CVE-2026-43128" type="cve" title="CVE-2026-43128"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46300" id="CVE-2026-46300" type="cve" title="CVE-2026-46300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46333" id="CVE-2026-46333" type="cve" title="CVE-2026-46333"/>
      <reference href="https://bugzilla.redhat.com/2334439" id="2334439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2394648" id="2394648" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424886" id="2424886" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2425046" id="2425046" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448745" id="2448745" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2453803" id="2453803" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454844" id="2454844" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455334" id="2455334" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461521" id="2461521" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467144" id="2467144" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477015" id="2477015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477802" id="2477802" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19569.html" id="ALSA-2026:19569" type="self" title="ALSA-2026:19569"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.16.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">27d94d8d96a0f4ee02d7d8cc6277cda149af05ed42a21dc241bd74b244777934</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.16.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.16.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.16.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">2b62fad127f9bf09c287ec57cafe00aeff05e6de9fc3d3d4420d49482aaf2cf6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20594</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 13:09:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20594" id="RHSA-2026:20594" type="rhsa" title="RHSA-2026:20594"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4046" id="CVE-2026-4046" type="cve" title="CVE-2026-4046"/>
      <reference href="https://bugzilla.redhat.com/2453117" id="2453117" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20594.html" id="ALSA-2026:20594" type="self" title="ALSA-2026:20594"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nss_hesiod" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>nss_hesiod-2.39-124.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">449d518d685a982e0da35e626c7c3b8c99d433e0bcd157bd9fba34b16ed95238</sum>
        </package>
        <package name="glibc-static" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-static-2.39-124.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">b7992fd8dc964cf87b5c7faa53ced7b8fb38e3dffe52471ce29c4a0851809d1d</sum>
        </package>
        <package name="glibc-nss-devel" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-nss-devel-2.39-124.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">c742be61847e245e6c3c931114483f37c26eb8bb437c1376e8f4a75058cfa9c0</sum>
        </package>
        <package name="glibc-benchtests" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>glibc-benchtests-2.39-124.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">c7bcda85bd3638614cd0449768b3406640c8ff26b94d582dd1f4c18bd98ebede</sum>
        </package>
        <package name="nss_db" version="2.39" release="124.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-124.el10_2.alma.1.src.rpm">
          <filename>nss_db-2.39-124.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">e72c6dc4325b8b472dadeaaf47b4b6718f47db54dc133ab80a78606605c0da54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20600</id>
    <title>Important: wireshark security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-07-08 11:52:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>wireshark security update</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.  

Security Fix(es):  

  * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405)
  * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20600" id="RHSA-2026:20600" type="rhsa" title="RHSA-2026:20600"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5405" id="CVE-2026-5405" type="cve" title="CVE-2026-5405"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5656" id="CVE-2026-5656" type="cve" title="CVE-2026-5656"/>
      <reference href="https://bugzilla.redhat.com/2464273" id="2464273" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464276" id="2464276" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20600.html" id="ALSA-2026:20600" type="self" title="ALSA-2026:20600"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="wireshark-devel" version="4.4.2" release="10.el10_2" epoch="1" arch="s390x" src="wireshark-4.4.2-10.el10_2.src.rpm">
          <filename>wireshark-devel-4.4.2-10.el10_2.s390x.rpm</filename>
          <sum type="sha256">2d8bdf1c1f76e3536802c8f8a9952d21517b764165bfc1e7e7978e11e64ddb30</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20606</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-06-04 10:20:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby4.0 security update</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  

Security Fix(es):  

  * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20606" id="RHSA-2026:20606" type="rhsa" title="RHSA-2026:20606"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33210" id="CVE-2026-33210" type="cve" title="CVE-2026-33210"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316"/>
      <reference href="https://bugzilla.redhat.com/2449871" id="2449871" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461369" id="2461369" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20606.html" id="ALSA-2026:20606" type="self" title="ALSA-2026:20606"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="ruby4.0-doc" version="4.0.3" release="34.el10_2" epoch="0" arch="noarch" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-doc-4.0.3-34.el10_2.noarch.rpm</filename>
          <sum type="sha256">911ec6ffa66042849dff4c20c6e9c57e452e38797a2d1cb88fb1289d50cb3f4c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-26 00:00:00"/>
    <updated date="2026-05-27 12:56:36"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mysql8.4 security update</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.  

Security Fix(es):  

  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)
  * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)
  * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)
  * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)
  * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)
  * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)
  * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:20693" id="RHSA-2026:20693" type="rhsa" title="RHSA-2026:20693"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240"/>
      <reference href="https://bugzilla.redhat.com/2460274" id="2460274" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460275" id="2460275" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460276" id="2460276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460279" id="2460279" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460295" id="2460295" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460312" id="2460312" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460315" id="2460315" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460316" id="2460316" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460323" id="2460323" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460324" id="2460324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460325" id="2460325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460326" id="2460326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460329" id="2460329" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460335" id="2460335" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460342" id="2460342" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460344" id="2460344" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460348" id="2460348" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460356" id="2460356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460358" id="2460358" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-20693.html" id="ALSA-2026:20693" type="self" title="ALSA-2026:20693"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="mysql8.4-test" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="s390x" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-test-8.4.9-1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">94467862075fdaf019c629131e45ea03c198064ffc546eb0ac447c2a0b03b959</sum>
        </package>
        <package name="mysql8.4-test-data" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="noarch" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-test-data-8.4.9-1.el10_2.alma.1.noarch.rpm</filename>
          <sum type="sha256">a5be777ac4cdff32f536e30c86ffbc34a9b78111f5b470d6b9f2e07464021123</sum>
        </package>
        <package name="mysql8.4-devel" version="8.4.9" release="1.el10_2.alma.1" epoch="0" arch="s390x" src="mysql8.4-8.4.9-1.el10_2.alma.1.src.rpm">
          <filename>mysql8.4-devel-8.4.9-1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">be3f93ad8382a77fc05c9812bd63cfcc261d1f6eb3ef8ca76c9e26f9bcbfb049</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21286</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-05-27 00:00:00"/>
    <updated date="2026-05-28 12:38:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):  

  * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)
  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21286" id="RHSA-2026:21286" type="rhsa" title="RHSA-2026:21286"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34043" id="CVE-2026-34043" type="cve" title="CVE-2026-34043"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2453284" id="2453284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21286.html" id="ALSA-2026:21286" type="self" title="ALSA-2026:21286"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-8.0-source-built-artifacts" version="8.0.127" release="1.el10_2" epoch="0" arch="s390x" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-source-built-artifacts-8.0.127-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">262eea40bb0d59b3ed62d156503d7dcc45cd10190d76b0a35d8e86c89fccf8e3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21557</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-06-08 09:59:26"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
  * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
  * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
  * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
  * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
  * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
  * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
  * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
  * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
  * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
  * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
  * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
  * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
  * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
  * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
  * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
  * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
  * kernel: mm/page_alloc: clear page-&gt;private in free_pages_prepare() (CVE-2026-43303)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21557" id="RHSA-2026:21557" type="rhsa" title="RHSA-2026:21557"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-56645" id="CVE-2024-56645" type="cve" title="CVE-2024-56645"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68183" id="CVE-2025-68183" type="cve" title="CVE-2025-68183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23375" id="CVE-2026-23375" type="cve" title="CVE-2026-23375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23392" id="CVE-2026-23392" type="cve" title="CVE-2026-23392"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23455" id="CVE-2026-23455" type="cve" title="CVE-2026-23455"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31684" id="CVE-2026-31684" type="cve" title="CVE-2026-31684"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31685" id="CVE-2026-31685" type="cve" title="CVE-2026-31685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43006" id="CVE-2026-43006" type="cve" title="CVE-2026-43006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43020" id="CVE-2026-43020" type="cve" title="CVE-2026-43020"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43023" id="CVE-2026-43023" type="cve" title="CVE-2026-43023"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43027" id="CVE-2026-43027" type="cve" title="CVE-2026-43027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43051" id="CVE-2026-43051" type="cve" title="CVE-2026-43051"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43110" id="CVE-2026-43110" type="cve" title="CVE-2026-43110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43116" id="CVE-2026-43116" type="cve" title="CVE-2026-43116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43158" id="CVE-2026-43158" type="cve" title="CVE-2026-43158"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43190" id="CVE-2026-43190" type="cve" title="CVE-2026-43190"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43205" id="CVE-2026-43205" type="cve" title="CVE-2026-43205"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43303" id="CVE-2026-43303" type="cve" title="CVE-2026-43303"/>
      <reference href="https://bugzilla.redhat.com/2334560" id="2334560" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2422699" id="2422699" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451199" id="2451199" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451218" id="2451218" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2454810" id="2454810" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461757" id="2461757" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461759" id="2461759" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464369" id="2464369" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464402" id="2464402" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464455" id="2464455" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464462" id="2464462" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464496" id="2464496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467005" id="2467005" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467014" id="2467014" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467064" id="2467064" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467090" id="2467090" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467210" id="2467210" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468091" id="2468091" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21557.html" id="ALSA-2026:21557" type="self" title="ALSA-2026:21557"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.18.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">1ad40e8ee4461fa31e676665bb2449003529440e475576e29b26f1c7b5e3c078</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.18.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.18.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.18.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">3e536a8c0ada3896c94f1121cc6e9dd4edf2ac34790e799b48ce6c14b0f95714</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21754</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 11:49:48"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21754" id="RHSA-2026:21754" type="rhsa" title="RHSA-2026:21754"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21754.html" id="ALSA-2026:21754" type="self" title="ALSA-2026:21754"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-9.0-source-built-artifacts" version="9.0.117" release="1.el10_2" epoch="0" arch="s390x" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-source-built-artifacts-9.0.117-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">cf92fb015d9f3331fd5fe811bf635530086a671efd32504706d8f313a0032ddf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-05-28 00:00:00"/>
    <updated date="2026-05-29 12:28:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>flatpak security update</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  

Security Fix(es):  

  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:21757" id="RHSA-2026:21757" type="rhsa" title="RHSA-2026:21757"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079"/>
      <reference href="https://bugzilla.redhat.com/2456276" id="2456276" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456284" id="2456284" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-21757.html" id="ALSA-2026:21757" type="self" title="ALSA-2026:21757"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="flatpak-devel" version="1.16.0" release="9.el10_2.1" epoch="0" arch="s390x" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-devel-1.16.0-9.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">bca78d57aac3080074312d41b14c64fe47c106e612638582cfcd19f8308b6604</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22145</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-01 00:00:00"/>
    <updated date="2026-06-03 07:58:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es):  

  * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22145" id="RHSA-2026:22145" type="rhsa" title="RHSA-2026:22145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899"/>
      <reference href="https://bugzilla.redhat.com/2476605" id="2476605" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22145.html" id="ALSA-2026:22145" type="self" title="ALSA-2026:22145"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-10.0-source-built-artifacts" version="10.0.108" release="1.el10_2" epoch="0" arch="s390x" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">54762bc62c85e4a5f7881ba00adbae42a43d487618c619d16d3f64d657514c07</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22529</id>
    <title>Moderate: libexif security update</title>
    <issued date="2026-06-02 00:00:00"/>
    <updated date="2026-06-04 14:44:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libexif security update</summary>
    <description>The libexif packages provide a library for extracting extra information from image files.  

Security Fix(es):  

  * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22529" id="RHSA-2026:22529" type="rhsa" title="RHSA-2026:22529"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40386" id="CVE-2026-40386" type="cve" title="CVE-2026-40386"/>
      <reference href="https://bugzilla.redhat.com/2457689" id="2457689" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22529.html" id="ALSA-2026:22529" type="self" title="ALSA-2026:22529"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libexif-devel" version="0.6.24" release="9.el10_2.1" epoch="0" arch="s390x" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-devel-0.6.24-9.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">2b887507da9d7ed5941d4f7d5444d8a0cd0231a228bc2197de1cba6f347c6529</sum>
        </package>
        <package name="libexif-doc" version="0.6.24" release="9.el10_2.1" epoch="0" arch="s390x" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-doc-0.6.24-9.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">a0730330ef0f8ee17e8f44cfc23b3d5f1e673a07f57cce05adbf66b0613b96c2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:22963</id>
    <title>Critical: samba security update</title>
    <issued date="2026-06-03 00:00:00"/>
    <updated date="2026-06-04 10:06:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>samba security update</summary>
    <description>Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  

Security Fix(es):  

  * samba: Missing access check on reparse point operations (CVE-2026-1933)
  * samba: vfs_worm does not block directory modification (CVE-2026-2340)
  * samba: group policy certificate enrollment uses &lt;http://&gt; without validation (CVE-2026-3012)
  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
  * samba: Remote Code Execution in SAMR (CVE-2026-4408)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:22963" id="RHSA-2026:22963" type="rhsa" title="RHSA-2026:22963"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1933" id="CVE-2026-1933" type="cve" title="CVE-2026-1933"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2340" id="CVE-2026-2340" type="cve" title="CVE-2026-2340"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3012" id="CVE-2026-3012" type="cve" title="CVE-2026-3012"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40170" id="CVE-2026-40170" type="cve" title="CVE-2026-40170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4408" id="CVE-2026-4408" type="cve" title="CVE-2026-4408"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4480" id="CVE-2026-4480" type="cve" title="CVE-2026-4480"/>
      <reference href="https://bugzilla.redhat.com/2447317" id="2447317" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447318" id="2447318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447319" id="2447319" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452232" id="2452232" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2459061" id="2459061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479762" id="2479762" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-22963.html" id="ALSA-2026:22963" type="self" title="ALSA-2026:22963"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="samba-pidl" version="4.23.5" release="109.el10_2" epoch="0" arch="noarch" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-pidl-4.23.5-109.el10_2.noarch.rpm</filename>
          <sum type="sha256">4180231d6fcb81a083d7db024760d87997779989ac8643e34d7af50f5873ba01</sum>
        </package>
        <package name="libnetapi-devel" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>libnetapi-devel-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">4cda90f137648c42617b011ed1769c31f3021bfb247bb56af67ff028083b7928</sum>
        </package>
        <package name="libldb-devel" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>libldb-devel-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">50cc85cf4e09d837c5c0f095a0b9502363a0bb34897c2f4902564798b60a0ffa</sum>
        </package>
        <package name="libwbclient-devel" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>libwbclient-devel-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">52b47699abc8cb50bb4b0c91866b6b3fda9daa1c76f9cf1001beb4de073bcb16</sum>
        </package>
        <package name="samba-test-libs" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-test-libs-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">5d24fd1a3fe04ce2ed3fb0458d4a4167a67a61c1ffc9e340b8aee8230384bab2</sum>
        </package>
        <package name="samba-test" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-test-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">b5e6c801ddf06cfd877d3be5f1e2c6ca522217b8b6b0862c8bc5659b34cac65b</sum>
        </package>
        <package name="libsmbclient-devel" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>libsmbclient-devel-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">caba23959f8c419a6d310fa784de015217b99f040e5abd4bb7188b5ba1294770</sum>
        </package>
        <package name="samba-devel" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>samba-devel-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">e160f6cf642f01a2213096275964b2eeffcf5d9e2e19f5fee93e02e6c594f59d</sum>
        </package>
        <package name="python3-samba-test" version="4.23.5" release="109.el10_2" epoch="0" arch="s390x" src="samba-4.23.5-109.el10_2.src.rpm">
          <filename>python3-samba-test-4.23.5-109.el10_2.s390x.rpm</filename>
          <sum type="sha256">f92e6d898bb15f66f916d82acfa348e7f49ebc6cdae95162f601e683bdd30407</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23231</id>
    <title>Important: unbound security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-04 11:47:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)
  * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)
  * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23231" id="RHSA-2026:23231" type="rhsa" title="RHSA-2026:23231"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33278" id="CVE-2026-33278" type="cve" title="CVE-2026-33278"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42944" id="CVE-2026-42944" type="cve" title="CVE-2026-42944"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42959" id="CVE-2026-42959" type="cve" title="CVE-2026-42959"/>
      <reference href="https://bugzilla.redhat.com/2479774" id="2479774" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479806" id="2479806" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479808" id="2479808" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23231.html" id="ALSA-2026:23231" type="self" title="ALSA-2026:23231"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="unbound-devel" version="1.24.2" release="7.el10_2.1" epoch="0" arch="s390x" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-devel-1.24.2-7.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">52aac252048d9acbda63f3c0ba66a38fd3801afb4f4035266b1172afc73f50aa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:23329</id>
    <title>Important: kernel security update</title>
    <issued date="2026-06-04 00:00:00"/>
    <updated date="2026-06-08 09:59:26"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
  * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
  * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
  * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
  * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
  * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322)
  * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:23329" id="RHSA-2026:23329" type="rhsa" title="RHSA-2026:23329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-38653" id="CVE-2025-38653" type="cve" title="CVE-2025-38653"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68366" id="CVE-2025-68366" type="cve" title="CVE-2025-68366"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31613" id="CVE-2026-31613" type="cve" title="CVE-2026-31613"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31709" id="CVE-2026-31709" type="cve" title="CVE-2026-31709"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43322" id="CVE-2026-43322" type="cve" title="CVE-2026-43322"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43329" id="CVE-2026-43329" type="cve" title="CVE-2026-43329"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46243" id="CVE-2026-46243" type="cve" title="CVE-2026-46243"/>
      <reference href="https://bugzilla.redhat.com/2390372" id="2390372" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2424881" id="2424881" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461480" id="2461480" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464476" id="2464476" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468124" id="2468124" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468131" id="2468131" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481486" id="2481486" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-23329.html" id="ALSA-2026:23329" type="self" title="ALSA-2026:23329"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.20.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">379e81f18d22e25a02cfb91029c6050624bb9fdf406ea969cea3dbd5b35c49eb</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.20.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.20.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.20.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">522ff6691be4d6505b275b57e0ba81173108ffdad3dd41f4005cadbf84aba29d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-08 08:31:27"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>bind security update</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  

Security Fix(es):  

  * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24338" id="RHSA-2026:24338" type="rhsa" title="RHSA-2026:24338"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946"/>
      <reference href="https://bugzilla.redhat.com/2479767" id="2479767" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479771" id="2479771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24338.html" id="ALSA-2026:24338" type="self" title="ALSA-2026:24338"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="bind-doc" version="9.18.33" release="15.el10_2.2" epoch="32" arch="noarch" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-doc-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">e794b480c049ceeadf03b0a2d4b32a7421120dc8f8cac56d7889077439239b1a</sum>
        </package>
        <package name="bind-devel" version="9.18.33" release="15.el10_2.2" epoch="32" arch="s390x" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-devel-9.18.33-15.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">fa93a3733f5bf7edc55fbc462b592d71ff220319cbc85add62d50d6c31f0814d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-08 00:00:00"/>
    <updated date="2026-06-11 08:50:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24470" id="RHSA-2026:24470" type="rhsa" title="RHSA-2026:24470"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2456333" id="2456333" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456339" id="2456339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24470.html" id="ALSA-2026:24470" type="self" title="ALSA-2026:24470"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="podman-tests" version="5.8.2" release="3.el10_2.alma.1" epoch="7" arch="s390x" src="podman-5.8.2-3.el10_2.alma.1.src.rpm">
          <filename>podman-tests-5.8.2-3.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">e75b7b5d72e9ce468d493670d78f7955dff53d838114eb24148891b12b8e2e7c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24758</id>
    <title>Important: libyang security update</title>
    <issued date="2026-06-09 00:00:00"/>
    <updated date="2026-07-08 11:51:32"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libyang security update</summary>
    <description>Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.  

Security Fix(es):  

  * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24758" id="RHSA-2026:24758" type="rhsa" title="RHSA-2026:24758"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44673" id="CVE-2026-44673" type="cve" title="CVE-2026-44673"/>
      <reference href="https://bugzilla.redhat.com/2477617" id="2477617" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24758.html" id="ALSA-2026:24758" type="self" title="ALSA-2026:24758"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libyang-devel-doc" version="2.1.148" release="4.el10_2" epoch="0" arch="s390x" src="libyang-2.1.148-4.el10_2.src.rpm">
          <filename>libyang-devel-doc-2.1.148-4.el10_2.s390x.rpm</filename>
          <sum type="sha256">34578b7b5c92f91e182eac5cb9c457f2825cdfec55e4fc87cd5d5d4b0a62b01e</sum>
        </package>
        <package name="libyang-devel" version="2.1.148" release="4.el10_2" epoch="0" arch="s390x" src="libyang-2.1.148-4.el10_2.src.rpm">
          <filename>libyang-devel-2.1.148-4.el10_2.s390x.rpm</filename>
          <sum type="sha256">d44b535b054e9c78270128061403681b2c6f76ad090be902398eefa1d6be7dff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:24985</id>
    <title>Important: poppler security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:51:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>poppler security update</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.  

Security Fix(es):  

  * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:24985" id="RHSA-2026:24985" type="rhsa" title="RHSA-2026:24985"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10118" id="CVE-2026-10118" type="cve" title="CVE-2026-10118"/>
      <reference href="https://bugzilla.redhat.com/2460428" id="2460428" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-24985.html" id="ALSA-2026:24985" type="self" title="ALSA-2026:24985"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="poppler-devel" version="24.02.0" release="7.el10_2.2" epoch="0" arch="s390x" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-devel-24.02.0-7.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">13b20e8e27fef9cb30a929ce8bb02333d7e0b8f41ebd205919c81402c8135797</sum>
        </package>
        <package name="poppler-cpp-devel" version="24.02.0" release="7.el10_2.2" epoch="0" arch="s390x" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-cpp-devel-24.02.0-7.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">18456463b555772be71a71a1b7c3c97db60ecdc4a7ec91882d04219b6cc97b3e</sum>
        </package>
        <package name="poppler-glib-devel" version="24.02.0" release="7.el10_2.2" epoch="0" arch="s390x" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-devel-24.02.0-7.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">9e38c790800d4f9642f10fe6d106991d5595392573320815675a035100750b6f</sum>
        </package>
        <package name="poppler-qt6-devel" version="24.02.0" release="7.el10_2.2" epoch="0" arch="s390x" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-qt6-devel-24.02.0-7.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">b6106da0a389fd9f8dcfda10fa1d0a56b006884399e9b6e5e158373011c0ff98</sum>
        </package>
        <package name="poppler-glib-doc" version="24.02.0" release="7.el10_2.2" epoch="0" arch="noarch" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-doc-24.02.0-7.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">db944170f7397aa5dc0f76041aa8a845f45fb3b697972932e97a17ef5e15cf48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25111</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:46:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25111" id="RHSA-2026:25111" type="rhsa" title="RHSA-2026:25111"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25111.html" id="ALSA-2026:25111" type="self" title="ALSA-2026:25111"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-8.0-source-built-artifacts" version="8.0.128" release="1.el10_2" epoch="0" arch="s390x" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">8ad6f461e892d0385504fe17a9215af0b7f8c363141e181c8cf49c0e4df97c8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25112</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:44:38"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25112" id="RHSA-2026:25112" type="rhsa" title="RHSA-2026:25112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25112.html" id="ALSA-2026:25112" type="self" title="ALSA-2026:25112"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-9.0-source-built-artifacts" version="9.0.118" release="1.el10_2" epoch="0" arch="s390x" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">6c149ccd7115bf58b853137459f9a37cfe1dc4c4babff01587347f3127f17b04</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25115</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-10 00:00:00"/>
    <updated date="2026-06-11 08:43:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):  

  * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
  * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25115" id="RHSA-2026:25115" type="rhsa" title="RHSA-2026:25115"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591"/>
      <reference href="https://bugzilla.redhat.com/2487164" id="2487164" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2487224" id="2487224" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25115.html" id="ALSA-2026:25115" type="self" title="ALSA-2026:25115"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-10.0-source-built-artifacts" version="10.0.109" release="1.el10_2" epoch="0" arch="s390x" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">fa85a6e7de3edc8b8276f4b4ba73fbd6bdf9078d82450dfef82a87df26dcfd82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:25191</id>
    <title>Critical: kernel security update</title>
    <issued date="2026-06-11 00:00:00"/>
    <updated date="2026-06-11 17:37:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
  * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
  * kernel: can: raw: fix ro-&gt;uniq use-after-free in raw_rcv() (CVE-2026-31532)
  * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
  * kernel: ip6_tunnel: clear skb2-&gt;cb[] in ip4ip6_err() (CVE-2026-43037)
  * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
  * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:25191" id="RHSA-2026:25191" type="rhsa" title="RHSA-2026:25191"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31419" id="CVE-2026-31419" type="cve" title="CVE-2026-31419"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31467" id="CVE-2026-31467" type="cve" title="CVE-2026-31467"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31532" id="CVE-2026-31532" type="cve" title="CVE-2026-31532"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31581" id="CVE-2026-31581" type="cve" title="CVE-2026-31581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43037" id="CVE-2026-43037" type="cve" title="CVE-2026-43037"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43501" id="CVE-2026-43501" type="cve" title="CVE-2026-43501"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46054" id="CVE-2026-46054" type="cve" title="CVE-2026-46054"/>
      <reference href="https://bugzilla.redhat.com/2457829" id="2457829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460616" id="2460616" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461107" id="2461107" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461471" id="2461471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464351" id="2464351" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480457" id="2480457" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482025" id="2482025" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-25191.html" id="ALSA-2026:25191" type="self" title="ALSA-2026:25191"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.22.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">5e2757ae61e1575ce597bf70f1cb10b886af2c5940d0270fc6b70696d68a52d5</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.22.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.22.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.22.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">ab18cd015d50e060f26de56ab720e388ab1462b01db071da76b38650d38e3642</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27288</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 00:00:00"/>
    <updated date="2026-06-26 17:55:48"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
  * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
  * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
  * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
  * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
  * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
  * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
  * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
  * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
  * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
  * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
  * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
  * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
  * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
  * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)


Bug Fix(es) and Enhancement(s):  

  * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
  * AlmaLinux9.5 crash due to lpfc NULL ndlp-&gt;vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
  * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
  * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
  * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
  * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
  * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27288" id="RHSA-2026:27288" type="rhsa" title="RHSA-2026:27288"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31474" id="CVE-2026-31474" type="cve" title="CVE-2026-31474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31641" id="CVE-2026-31641" type="cve" title="CVE-2026-31641"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31669" id="CVE-2026-31669" type="cve" title="CVE-2026-31669"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31772" id="CVE-2026-31772" type="cve" title="CVE-2026-31772"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31786" id="CVE-2026-31786" type="cve" title="CVE-2026-31786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31787" id="CVE-2026-31787" type="cve" title="CVE-2026-31787"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43056" id="CVE-2026-43056" type="cve" title="CVE-2026-43056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43260" id="CVE-2026-43260" type="cve" title="CVE-2026-43260"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43330" id="CVE-2026-43330" type="cve" title="CVE-2026-43330"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46056" id="CVE-2026-46056" type="cve" title="CVE-2026-46056"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46125" id="CVE-2026-46125" type="cve" title="CVE-2026-46125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46152" id="CVE-2026-46152" type="cve" title="CVE-2026-46152"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46166" id="CVE-2026-46166" type="cve" title="CVE-2026-46166"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46173" id="CVE-2026-46173" type="cve" title="CVE-2026-46173"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46331" id="CVE-2026-46331" type="cve" title="CVE-2026-46331"/>
      <reference href="https://bugzilla.redhat.com/2460646" id="2460646" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461503" id="2461503" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461548" id="2461548" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464092" id="2464092" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464096" id="2464096" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464449" id="2464449" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464502" id="2464502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467083" id="2467083" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468061" id="2468061" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2479492" id="2479492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482181" id="2482181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482563" id="2482563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482608" id="2482608" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482634" id="2482634" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482645" id="2482645" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27288.html" id="ALSA-2026:27288" type="self" title="ALSA-2026:27288"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.26.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">5bfcfd35a042ebfb85bdf51ed8e0a979f1192ac08627d27374e1d243bd76298c</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.26.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.26.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.26.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">6ab250a658f1eed95065c2834406d03e56d25770cb7e3b8af7a4a18934851605</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:27743</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-06-22 00:00:00"/>
    <updated date="2026-06-23 10:14:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
  * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
  * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
  * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:27743" id="RHSA-2026:27743" type="rhsa" title="RHSA-2026:27743"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478"/>
      <reference href="https://bugzilla.redhat.com/2477439" id="2477439" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477442" id="2477442" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477447" id="2477447" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2477448" id="2477448" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-27743.html" id="ALSA-2026:27743" type="self" title="ALSA-2026:27743"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="postgresql-test-rpm-macros" version="16.14" release="1.el10_2" epoch="0" arch="noarch" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-test-rpm-macros-16.14-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">f0c9d441dd4f2c10e7ccd46c88122dd2272396a602ea50eee9f8f60032a39627</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28234</id>
    <title>Low: libxml2 security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:26:49"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28234" id="RHSA-2026:28234" type="rhsa" title="RHSA-2026:28234"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-34459" id="CVE-2024-34459" type="cve" title="CVE-2024-34459"/>
      <reference href="https://bugzilla.redhat.com/2280532" id="2280532" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28234.html" id="ALSA-2026:28234" type="self" title="ALSA-2026:28234"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libxml2-static" version="2.12.5" release="10.el10_2.1" epoch="0" arch="s390x" src="libxml2-2.12.5-10.el10_2.1.src.rpm">
          <filename>libxml2-static-2.12.5-10.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">6a6ca49dfe0fd232f8e68293bd507e6f42d8c025c4fc12ba8d940ecb97d2c847</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28236</id>
    <title>Moderate: libsolv security update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:24:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsolv security update</summary>
    <description>The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm.  

Security Fix(es):  

  * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150)
  * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149)
  * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28236" id="RHSA-2026:28236" type="rhsa" title="RHSA-2026:28236"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-48864" id="CVE-2026-48864" type="cve" title="CVE-2026-48864"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9149" id="CVE-2026-9149" type="cve" title="CVE-2026-9149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9150" id="CVE-2026-9150" type="cve" title="CVE-2026-9150"/>
      <reference href="https://bugzilla.redhat.com/2460379" id="2460379" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460380" id="2460380" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460425" id="2460425" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28236.html" id="ALSA-2026:28236" type="self" title="ALSA-2026:28236"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libsolv-tools" version="0.7.33" release="5.el10_2.alma.1" epoch="0" arch="s390x" src="libsolv-0.7.33-5.el10_2.alma.1.src.rpm">
          <filename>libsolv-tools-0.7.33-5.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">b0f7870d770f4a8c6401e1a121bcc4dd799f38aa122f3b9b2aa9a4873fa155bf</sum>
        </package>
        <package name="libsolv-tools-base" version="0.7.33" release="5.el10_2.alma.1" epoch="0" arch="s390x" src="libsolv-0.7.33-5.el10_2.alma.1.src.rpm">
          <filename>libsolv-tools-base-0.7.33-5.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">b4de182f16232959029e754e7386d6d52ef6bf52b8999a073c934a3262ac9762</sum>
        </package>
        <package name="libsolv-devel" version="0.7.33" release="5.el10_2.alma.1" epoch="0" arch="s390x" src="libsolv-0.7.33-5.el10_2.alma.1.src.rpm">
          <filename>libsolv-devel-0.7.33-5.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">cfcf4aeae60e755b8f904aaf15f2c365b174840c81a8c9680792fd96f05e0255</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:28581</id>
    <title>Important: python3.14 security, bug fix, and enhancement update</title>
    <issued date="2026-06-23 00:00:00"/>
    <updated date="2026-06-24 09:23:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security, bug fix, and enhancement update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)


Bug Fix(es) and Enhancement(s):  

  * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:28581" id="RHSA-2026:28581" type="rhsa" title="RHSA-2026:28581"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6019" id="CVE-2026-6019" type="cve" title="CVE-2026-6019"/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460869" id="2460869" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-28581.html" id="ALSA-2026:28581" type="self" title="ALSA-2026:28581"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3.14-freethreading-test" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-test-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">179a7cb64a10828ff4631238d61a58bbceca2f098ab5879b16cb3dcc1e41bc3c</sum>
        </package>
        <package name="python3.14-test" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-test-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">1f42d4206dee74abd865126ff9d316ba4a5cbbdc4e3e1ad5a0116413615a8326</sum>
        </package>
        <package name="python3.14-freethreading" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">33a2e5da0ebbd68d73e6c82c47bd6611e150d605322ce9e7496712f30a27f466</sum>
        </package>
        <package name="python3.14-freethreading-devel" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-devel-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">767229978b96ff3f74651d01703be24c279eca09d24bedef53a995dc83873f85</sum>
        </package>
        <package name="python3.14-freethreading-idle" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-idle-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">86e8f7984596adb184341bab3b11635f35060484b3163045a8fd0d5eabe8dce1</sum>
        </package>
        <package name="python3.14-freethreading-libs" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-libs-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">8a6375a694bc009fcfcb2c68c2d5954cded7dc3acb6c5797aacc6a7a23b9b4ea</sum>
        </package>
        <package name="python3.14-freethreading-tkinter" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-tkinter-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">a4f9731d8665d92da35369dadd5c7be00f80f3a55009779a613cdac3802ed3ac</sum>
        </package>
        <package name="python3.14-idle" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-idle-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c3f4126edf2527e2b9f415297cd4a2a1a9dda8e481acfe7b078377c4e38ebacd</sum>
        </package>
        <package name="python3.14-debug" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-debug-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">db5feee7e8498babd8131bd193a74f61140ff80a45152c2b99c1847ff7df960f</sum>
        </package>
        <package name="python3.14-freethreading-debug" version="3.14.5" release="1.el10_2" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-freethreading-debug-3.14.5-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">f82e78202a0bdbdd8b1779379933fd36aa56c4a00536db3930b29462356c230a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-26 12:49:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:29874" id="RHSA-2026:29874" type="rhsa" title="RHSA-2026:29874"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256"/>
      <reference href="https://bugzilla.redhat.com/2480746" id="2480746" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-29874.html" id="ALSA-2026:29874" type="self" title="ALSA-2026:29874"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nginx-mod-devel" version="1.26.3" release="6.el10_2.4" epoch="2" arch="s390x" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-devel-1.26.3-6.el10_2.4.s390x.rpm</filename>
          <sum type="sha256">9a754a54d3a4a7c90907e995dd0913e1e4ad5d07409005ed1690c72ddb9d2a70</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:30129</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-25 00:00:00"/>
    <updated date="2026-06-27 12:59:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
  * kernel: ipv6: icmp: clear skb2-&gt;cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
  * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
  * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
  * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
  * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
  * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
  * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)


Bug Fix(es) and Enhancement(s):  

  * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:30129" id="RHSA-2026:30129" type="rhsa" title="RHSA-2026:30129"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31636" id="CVE-2026-31636" type="cve" title="CVE-2026-31636"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43038" id="CVE-2026-43038" type="cve" title="CVE-2026-43038"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43198" id="CVE-2026-43198" type="cve" title="CVE-2026-43198"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43414" id="CVE-2026-43414" type="cve" title="CVE-2026-43414"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45898" id="CVE-2026-45898" type="cve" title="CVE-2026-45898"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46117" id="CVE-2026-46117" type="cve" title="CVE-2026-46117"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46135" id="CVE-2026-46135" type="cve" title="CVE-2026-46135"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46145" id="CVE-2026-46145" type="cve" title="CVE-2026-46145"/>
      <reference href="https://bugzilla.redhat.com/2461510" id="2461510" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464397" id="2464397" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467228" id="2467228" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468155" id="2468155" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482031" id="2482031" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482576" id="2482576" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482581" id="2482581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482654" id="2482654" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-30129.html" id="ALSA-2026:30129" type="self" title="ALSA-2026:30129"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.28.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">5114ef7532312f4ded71df4db162259e234bf50c2d90fbfe62c64f5ab02c0b05</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.28.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.28.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.28.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">b8cd5a81c0c4d44456490fad37b35d017bca0faa6bc48a656cd2d79cae546319</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33092</id>
    <title>Moderate: glibc security, bug fix, and enhancement update</title>
    <issued date="2026-06-29 00:00:00"/>
    <updated date="2026-06-30 13:43:31"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security, bug fix, and enhancement update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450)


Bug Fix(es) and Enhancement(s):  

  * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33092" id="RHSA-2026:33092" type="rhsa" title="RHSA-2026:33092"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5450" id="CVE-2026-5450" type="cve" title="CVE-2026-5450"/>
      <reference href="https://bugzilla.redhat.com/2459853" id="2459853" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33092.html" id="ALSA-2026:33092" type="self" title="ALSA-2026:33092"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nss_db" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>nss_db-2.39-126.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">226e6be079b2a71a68b7648d9df8c4c0bf5f783a648c52481a46c76d47cd63f8</sum>
        </package>
        <package name="nss_hesiod" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>nss_hesiod-2.39-126.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">45cbefeab93b92dfa7181f868faedeb87988dd2f30a37716532411e86a219e6d</sum>
        </package>
        <package name="glibc-nss-devel" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-nss-devel-2.39-126.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">747fc6951d8ce1b62f4e9bc67d3fbc93ba7fef9729d54e262822bc0c611f3180</sum>
        </package>
        <package name="glibc-static" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-static-2.39-126.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">88ea04e126dec3de520bfab186336eab5c294178dafe364d1cc6885b16ec8d71</sum>
        </package>
        <package name="glibc-benchtests" version="2.39" release="126.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-126.el10_2.alma.1.src.rpm">
          <filename>glibc-benchtests-2.39-126.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">f5f91c55c36256ac3a766a2f5dc3b3286847146aaa18b63bfc9173604fe6a668</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33502</id>
    <title>Important: giflib security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:18:00"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33502" id="RHSA-2026:33502" type="rhsa" title="RHSA-2026:33502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-26740" id="CVE-2026-26740" type="cve" title="CVE-2026-26740"/>
      <reference href="https://bugzilla.redhat.com/2448747" id="2448747" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33502.html" id="ALSA-2026:33502" type="self" title="ALSA-2026:33502"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="giflib-devel" version="5.2.1" release="25.el10_2" epoch="0" arch="s390x" src="giflib-5.2.1-25.el10_2.src.rpm">
          <filename>giflib-devel-5.2.1-25.el10_2.s390x.rpm</filename>
          <sum type="sha256">0bee7c9c1c672e738deb7dcf8ccad38a1cf1d98480eb5c86a0a9beb3b90ec8b7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33540</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:18:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby4.0 security update</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  

Security Fix(es):  

  * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)
  * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)
  * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33540" id="RHSA-2026:33540" type="rhsa" title="RHSA-2026:33540"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258"/>
      <reference href="https://bugzilla.redhat.com/2468495" id="2468495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468498" id="2468498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468499" id="2468499" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33540.html" id="ALSA-2026:33540" type="self" title="ALSA-2026:33540"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="ruby4.0-doc" version="4.0.3" release="35.el10_2" epoch="0" arch="noarch" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-doc-4.0.3-35.el10_2.noarch.rpm</filename>
          <sum type="sha256">9c4dc402137050f3d244fd8c91b09222b0708196cddb3636d256ab4717d5ff82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33565</id>
    <title>Important: ruby security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:22:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ruby security update</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  

Security Fix(es):  

  * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)
  * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)
  * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33565" id="RHSA-2026:33565" type="rhsa" title="RHSA-2026:33565"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258"/>
      <reference href="https://bugzilla.redhat.com/2468495" id="2468495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468498" id="2468498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468499" id="2468499" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33565.html" id="ALSA-2026:33565" type="self" title="ALSA-2026:33565"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="ruby-doc" version="3.3.10" release="13.el10_2" epoch="0" arch="noarch" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-doc-3.3.10-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">bf4766816b9337dbdaa62dede5fe29be0f7fb652c360c89ccf3d6d5404ee32d4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33685</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 20:19:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
  * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
  * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
  * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)


Bug Fix(es) and Enhancement(s):  

  * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887)
  * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33685" id="RHSA-2026:33685" type="rhsa" title="RHSA-2026:33685"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43279" id="CVE-2026-43279" type="cve" title="CVE-2026-43279"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46090" id="CVE-2026-46090" type="cve" title="CVE-2026-46090"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46176" id="CVE-2026-46176" type="cve" title="CVE-2026-46176"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46189" id="CVE-2026-46189" type="cve" title="CVE-2026-46189"/>
      <reference href="https://bugzilla.redhat.com/2467215" id="2467215" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481980" id="2481980" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482588" id="2482588" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482594" id="2482594" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33685.html" id="ALSA-2026:33685" type="self" title="ALSA-2026:33685"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.29.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">64dd06c36db1099d55e6f600bc60210eff1ecc7ae27cdd4bf71349ce72c1ef8f</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.29.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.29.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.29.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">9b4e5c1b6cb3cc4a6c186ecbef9718d48ce9e48f557d4af5d163623539706e10</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:33731</id>
    <title>Moderate: rrdtool security update</title>
    <issued date="2026-06-30 00:00:00"/>
    <updated date="2026-07-01 10:20:30"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>rrdtool security update</summary>
    <description>The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.  

Security Fix(es):  

  * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:33731" id="RHSA-2026:33731" type="rhsa" title="RHSA-2026:33731"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43958" id="CVE-2026-43958" type="cve" title="CVE-2026-43958"/>
      <reference href="https://bugzilla.redhat.com/2460932" id="2460932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-33731.html" id="ALSA-2026:33731" type="self" title="ALSA-2026:33731"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3-rrdtool" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>python3-rrdtool-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">4469487bdffffd68a50196c70ee877b0fb67cb52af67cb4607f3a0ba56773da3</sum>
        </package>
        <package name="rrdtool-ruby" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-ruby-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">7461f2793186a57cc9417a1f8f4fe1f1c5a4e6d3363d33c9a0b616c1acc4b3b4</sum>
        </package>
        <package name="rrdtool-lua" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-lua-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">84b035a154f30fd5981a493fabfbbbe53f32ca0bc9a7786e26ac124c3b50a1b9</sum>
        </package>
        <package name="rrdtool-doc" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-doc-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">8c203782b4fcad2b1a72fab0899c21280b69544edd2f6cb6fa92b13be3229608</sum>
        </package>
        <package name="rrdtool-tcl" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-tcl-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">b0cfff67134cddeeda3f176eaa557fe7ab812db525149b82aa6e3713d037ede0</sum>
        </package>
        <package name="rrdtool-devel" version="1.8.0" release="21.el10_2" epoch="0" arch="s390x" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-devel-1.8.0-21.el10_2.s390x.rpm</filename>
          <sum type="sha256">b9251a92ca1d3623430a37767be49e2492751e74fe25d40fb84b7842280b0ac7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:34911</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-02 00:00:00"/>
    <updated date="2026-07-04 22:29:50"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
  * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
  * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
  * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
  * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)
  * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
  * kernel: kernel: ipv6 frag escape ()


Bug Fix(es) and Enhancement(s):  

  * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537)
  * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:34911" id="RHSA-2026:34911" type="rhsa" title="RHSA-2026:34911"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-10263" id="CVE-2025-10263" type="cve" title="CVE-2025-10263"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43112" id="CVE-2026-43112" type="cve" title="CVE-2026-43112"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45998" id="CVE-2026-45998" type="cve" title="CVE-2026-45998"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46209" id="CVE-2026-46209" type="cve" title="CVE-2026-46209"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46244" id="CVE-2026-46244" type="cve" title="CVE-2026-46244"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46316" id="CVE-2026-46316" type="cve" title="CVE-2026-46316"/>
      <reference href="https://bugzilla.redhat.com/2467015" id="2467015" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482024" id="2482024" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482636" id="2482636" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484451" id="2484451" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486958" id="2486958" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486982" id="2486982" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-34911.html" id="ALSA-2026:34911" type="self" title="ALSA-2026:34911"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.30.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">1dfd0ff2acddad60ed48e8751cf1efb77d68076e6b5e03b5c7623178eddfc005</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.30.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.30.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.30.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">dbf84f8c647656b583f35fba7031a6cc5a8b284f9b55e83bf96f0d1e30854b6d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36189</id>
    <title>Important: perl-HTTP-Daemon security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-22 13:38:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>perl-HTTP-Daemon security update</summary>
    <description>The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests.  

Security Fix(es):  

  * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36189" id="RHSA-2026:36189" type="rhsa" title="RHSA-2026:36189"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-8450" id="CVE-2026-8450" type="cve" title="CVE-2026-8450"/>
      <reference href="https://bugzilla.redhat.com/2481773" id="2481773" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36189.html" id="ALSA-2026:36189" type="self" title="ALSA-2026:36189"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="perl-HTTP-Daemon" version="6.16" release="7.el10_2.1" epoch="0" arch="noarch" src="perl-HTTP-Daemon-6.16-7.el10_2.1.src.rpm">
          <filename>perl-HTTP-Daemon-6.16-7.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">32b21a73a65fac12652db9a425de49e0f807cda3630eca4d41682c50de2052ce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36196</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-21 13:11:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>389-ds-base security update</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.  

Security Fix(es):  

  * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)
  * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36196" id="RHSA-2026:36196" type="rhsa" title="RHSA-2026:36196"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11610" id="CVE-2026-11610" type="cve" title="CVE-2026-11610"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-11774" id="CVE-2026-11774" type="cve" title="CVE-2026-11774"/>
      <reference href="https://bugzilla.redhat.com/2484414" id="2484414" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484916" id="2484916" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36196.html" id="ALSA-2026:36196" type="self" title="ALSA-2026:36196"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="389-ds-base-devel" version="3.2.0" release="8.el10_2" epoch="0" arch="s390x" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-devel-3.2.0-8.el10_2.s390x.rpm</filename>
          <sum type="sha256">90aac07c024f93249481e0a6214006a65c50e96745921abb1862aef0aed86fdc</sum>
        </package>
        <package name="389-ds-base-bdb" version="3.2.0" release="8.el10_2" epoch="0" arch="s390x" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-bdb-3.2.0-8.el10_2.s390x.rpm</filename>
          <sum type="sha256">c5ace3a3df1504b87043087113f5fe11d08e1596e1ee7695eecf75b4920047e1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36203</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-21 13:10:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>freerdp security update</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  

Security Fix(es):  

  * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)
  * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)
  * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)
  * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)
  * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36203" id="RHSA-2026:36203" type="rhsa" title="RHSA-2026:36203"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40033" id="CVE-2026-40033" type="cve" title="CVE-2026-40033"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44420" id="CVE-2026-44420" type="cve" title="CVE-2026-44420"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44421" id="CVE-2026-44421" type="cve" title="CVE-2026-44421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44422" id="CVE-2026-44422" type="cve" title="CVE-2026-44422"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-45700" id="CVE-2026-45700" type="cve" title="CVE-2026-45700"/>
      <reference href="https://bugzilla.redhat.com/2481473" id="2481473" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483467" id="2483467" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483470" id="2483470" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483471" id="2483471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483480" id="2483480" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36203.html" id="ALSA-2026:36203" type="self" title="ALSA-2026:36203"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="freerdp-devel" version="3.10.3" release="12.el10_2.6" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-devel-3.10.3-12.el10_2.6.s390x.rpm</filename>
          <sum type="sha256">3fa3f935974884d7c27cf12bc9a52816d6bcd54652a2b9f001613449c87f0fbe</sum>
        </package>
        <package name="freerdp-server" version="3.10.3" release="12.el10_2.6" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-server-3.10.3-12.el10_2.6.s390x.rpm</filename>
          <sum type="sha256">810719ef4a4988a24946213f08a61d90deccab15951731111f04e36ff67dd6c2</sum>
        </package>
        <package name="libwinpr-devel" version="3.10.3" release="12.el10_2.6" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>libwinpr-devel-3.10.3-12.el10_2.6.s390x.rpm</filename>
          <sum type="sha256">a18e47cf1ec1445929158350cd2f519dcf925ea4d3eefe6cd9ea8f957ee48d7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36211</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-13 09:47:28"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36211" id="RHSA-2026:36211" type="rhsa" title="RHSA-2026:36211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50031" id="CVE-2026-50031" type="cve" title="CVE-2026-50031"/>
      <reference href="https://bugzilla.redhat.com/2484296" id="2484296" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36211.html" id="ALSA-2026:36211" type="self" title="ALSA-2026:36211"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="freeipmi-devel" version="1.6.18" release="1.el10_2" epoch="0" arch="s390x" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-devel-1.6.18-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">327c3cf3cf94b90e419d888d631d9c40769024f256f72b7f91138153190f97e1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36320</id>
    <title>Important: unbound security update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-31 12:39:54"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292)
  * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622)
  * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390)
  * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36320" id="RHSA-2026:36320" type="rhsa" title="RHSA-2026:36320"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40622" id="CVE-2026-40622" type="cve" title="CVE-2026-40622"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41292" id="CVE-2026-41292" type="cve" title="CVE-2026-41292"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42534" id="CVE-2026-42534" type="cve" title="CVE-2026-42534"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44390" id="CVE-2026-44390" type="cve" title="CVE-2026-44390"/>
      <reference href="https://bugzilla.redhat.com/2480125" id="2480125" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480130" id="2480130" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480131" id="2480131" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36320.html" id="ALSA-2026:36320" type="self" title="ALSA-2026:36320"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="unbound-devel" version="1.24.2" release="7.el10_2.2" epoch="0" arch="s390x" src="unbound-1.24.2-7.el10_2.2.src.rpm">
          <filename>unbound-devel-1.24.2-7.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">b01c9514b4a31d8f290cab423dbaf7b9171e5be9c7a1d27371d7b6aec55a1ed5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36364</id>
    <title>Important: nginx security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 00:00:00"/>
    <updated date="2026-07-08 11:42:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>nginx security, bug fix, and enhancement update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)


Bug Fix(es) and Enhancement(s):  

  * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36364" id="RHSA-2026:36364" type="rhsa" title="RHSA-2026:36364"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42055" id="CVE-2026-42055" type="cve" title="CVE-2026-42055"/>
      <reference href="https://bugzilla.redhat.com/2489866" id="2489866" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36364.html" id="ALSA-2026:36364" type="self" title="ALSA-2026:36364"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nginx-mod-devel" version="1.26.3" release="6.el10_2.5" epoch="2" arch="s390x" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-devel-1.26.3-6.el10_2.5.s390x.rpm</filename>
          <sum type="sha256">4a1cfeddb2d52e72fc02ee88cfa7681211c69243ce6c4fa7e04fa752490c1958</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36541</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:19:42"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
  * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
  * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
  * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
  * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
  * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)


Bug Fix(es) and Enhancement(s):  

  * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140)
  * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36541" id="RHSA-2026:36541" type="rhsa" title="RHSA-2026:36541"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43074" id="CVE-2026-43074" type="cve" title="CVE-2026-43074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43276" id="CVE-2026-43276" type="cve" title="CVE-2026-43276"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43341" id="CVE-2026-43341" type="cve" title="CVE-2026-43341"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46155" id="CVE-2026-46155" type="cve" title="CVE-2026-46155"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46242" id="CVE-2026-46242" type="cve" title="CVE-2026-46242"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46259" id="CVE-2026-46259" type="cve" title="CVE-2026-46259"/>
      <reference href="https://bugzilla.redhat.com/2467019" id="2467019" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467113" id="2467113" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2468097" id="2468097" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482660" id="2482660" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2483519" id="2483519" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484477" id="2484477" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36541.html" id="ALSA-2026:36541" type="self" title="ALSA-2026:36541"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.31.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c620411ba44309f4fdeaf67d20957d4da4dc5f4e6df1e3be65c88014ea3bad3f</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.31.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.31.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.31.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">f658653025eca71e77a366325ed8b1b523fad9de4a58a12033cf02579f765789</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36749</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-08 00:00:00"/>
    <updated date="2026-07-09 11:10:34"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)
  * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)
  * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)
  * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36749" id="RHSA-2026:36749" type="rhsa" title="RHSA-2026:36749"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52718" id="CVE-2026-52718" type="cve" title="CVE-2026-52718"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52719" id="CVE-2026-52719" type="cve" title="CVE-2026-52719"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52720" id="CVE-2026-52720" type="cve" title="CVE-2026-52720"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52722" id="CVE-2026-52722" type="cve" title="CVE-2026-52722"/>
      <reference href="https://bugzilla.redhat.com/2486328" id="2486328" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486353" id="2486353" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486731" id="2486731" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486733" id="2486733" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36749.html" id="ALSA-2026:36749" type="self" title="ALSA-2026:36749"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-devel" version="1.26.7" release="2.el10_2.4" epoch="0" arch="s390x" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-devel-1.26.7-2.el10_2.4.s390x.rpm</filename>
          <sum type="sha256">8baaceea640f558bf5b0c7c9b671f461450705b673b5e89e4560d0d4df451a6a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:36956</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-09 00:00:00"/>
    <updated date="2026-07-10 09:19:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)
  * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
  * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:36956" id="RHSA-2026:36956" type="rhsa" title="RHSA-2026:36956"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71066" id="CVE-2025-71066" type="cve" title="CVE-2025-71066"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46113" id="CVE-2026-46113" type="cve" title="CVE-2026-46113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46227" id="CVE-2026-46227" type="cve" title="CVE-2026-46227"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53359" id="CVE-2026-53359" type="cve" title="CVE-2026-53359"/>
      <reference href="https://bugzilla.redhat.com/2429036" id="2429036" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482564" id="2482564" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482587" id="2482587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497033" id="2497033" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-36956.html" id="ALSA-2026:36956" type="self" title="ALSA-2026:36956"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.32.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">1cc573a1abf1588d827c319512ad3b30e9e385e3cb440cc979cc081dc46453b4</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.32.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.32.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.32.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">3f732cf7ed2b256c72a1276d1afa2cfd19b30d7cf5cad6df8c5b0e92e895560b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38492</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-13 20:55:06"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
  * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
  * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38492" id="RHSA-2026:38492" type="rhsa" title="RHSA-2026:38492"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43163" id="CVE-2026-43163" type="cve" title="CVE-2026-43163"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43499" id="CVE-2026-43499" type="cve" title="CVE-2026-43499"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53166" id="CVE-2026-53166" type="cve" title="CVE-2026-53166"/>
      <reference href="https://bugzilla.redhat.com/2467059" id="2467059" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480453" id="2480453" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492805" id="2492805" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38492.html" id="ALSA-2026:38492" type="self" title="ALSA-2026:38492"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.33.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">6366cd1b88ee0e940d359cb2f6fd6a7c93e8135c530571870b360c25d93aac66</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.33.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.33.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.33.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c8955e0ee8d110dce99894d222017a70f12480434273876adc24d279b7e74a5c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38495</id>
    <title>Important: podman security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:52:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38495" id="RHSA-2026:38495" type="rhsa" title="RHSA-2026:38495"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822"/>
      <reference href="https://bugzilla.redhat.com/2498152" id="2498152" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38495.html" id="ALSA-2026:38495" type="self" title="ALSA-2026:38495"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="podman-tests" version="5.8.2" release="5.el10_2.alma.1" epoch="7" arch="s390x" src="podman-5.8.2-5.el10_2.alma.1.src.rpm">
          <filename>podman-tests-5.8.2-5.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">44b55a406aaac8365a5188fd1a64aa671e192711ecf1b13895a91c6e4fb0e700</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38499</id>
    <title>Important: openexr security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:51:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>openexr security update</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.  

Security Fix(es):  

  * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142)
  * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38499" id="RHSA-2026:38499" type="rhsa" title="RHSA-2026:38499"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41142" id="CVE-2026-41142" type="cve" title="CVE-2026-41142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42216" id="CVE-2026-42216" type="cve" title="CVE-2026-42216"/>
      <reference href="https://bugzilla.redhat.com/2467623" id="2467623" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467633" id="2467633" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38499.html" id="ALSA-2026:38499" type="self" title="ALSA-2026:38499"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="openexr-devel" version="3.1.10" release="8.el10_2.3" epoch="0" arch="s390x" src="openexr-3.1.10-8.el10_2.3.src.rpm">
          <filename>openexr-devel-3.1.10-8.el10_2.3.s390x.rpm</filename>
          <sum type="sha256">917988bb2ed73df98fba00dc31413ca79a280eb3cd8471c7a0c25aad6d25c2de</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:38514</id>
    <title>Important: plexus-utils security update</title>
    <issued date="2026-07-13 00:00:00"/>
    <updated date="2026-07-14 08:49:41"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>plexus-utils security update</summary>
    <description>The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.  

Security Fix(es):  

  * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:38514" id="RHSA-2026:38514" type="rhsa" title="RHSA-2026:38514"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-67030" id="CVE-2025-67030" type="cve" title="CVE-2025-67030"/>
      <reference href="https://bugzilla.redhat.com/2451409" id="2451409" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-38514.html" id="ALSA-2026:38514" type="self" title="ALSA-2026:38514"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="plexus-utils-javadoc" version="3.5.1" release="9.el10_2" epoch="0" arch="noarch" src="plexus-utils-3.5.1-9.el10_2.src.rpm">
          <filename>plexus-utils-javadoc-3.5.1-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">046d045fce643909feecc9e8b368b5978198541c747268014c772e7983fa2b97</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39183</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:43:59"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39183" id="RHSA-2026:39183" type="rhsa" title="RHSA-2026:39183"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308"/>
      <reference href="https://bugzilla.redhat.com/2498608" id="2498608" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39183.html" id="ALSA-2026:39183" type="self" title="ALSA-2026:39183"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3-idle" version="3.12.13" release="2.el10_2.1" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python3-idle-3.12.13-2.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">aee072260f7f89e3a19e0c47d7343f3f0735c10e66e73df3b2ed42e8732346ac</sum>
        </package>
        <package name="python3-debug" version="3.12.13" release="2.el10_2.1" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python3-debug-3.12.13-2.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">c63becb70ee841ebaf6a45e5c9be3ca33ec55f73811adecca0a761fd452095dd</sum>
        </package>
        <package name="python3-test" version="3.12.13" release="2.el10_2.1" epoch="0" arch="s390x" src="python3.12-3.12.13-2.el10_2.1.src.rpm">
          <filename>python3-test-3.12.13-2.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">cb5692f273a611d08ef0917dcf7f63c27cc0a7569f578cfbb166dba5eef82375</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39296</id>
    <title>Moderate: libinput security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:42:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libinput security update</summary>
    <description>libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices.  

Security Fix(es):  

  * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39296" id="RHSA-2026:39296" type="rhsa" title="RHSA-2026:39296"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50292" id="CVE-2026-50292" type="cve" title="CVE-2026-50292"/>
      <reference href="https://bugzilla.redhat.com/2485390" id="2485390" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39296.html" id="ALSA-2026:39296" type="self" title="ALSA-2026:39296"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libinput-devel" version="1.30.1" release="2.el10_2" epoch="0" arch="s390x" src="libinput-1.30.1-2.el10_2.src.rpm">
          <filename>libinput-devel-1.30.1-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">b01e127c26b1a4766bf4a621417555c394eecf6e51a5d05b50352466e41249fd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39304</id>
    <title>Low: libxml2 security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-15 08:40:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>libxml2 security update</summary>
    <description>The libxml2 library is a development toolbox providing the implementation of various XML standards.  

Security Fix(es):  

  * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39304" id="RHSA-2026:39304" type="rhsa" title="RHSA-2026:39304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6170" id="CVE-2025-6170" type="cve" title="CVE-2025-6170"/>
      <reference href="https://bugzilla.redhat.com/2372952" id="2372952" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39304.html" id="ALSA-2026:39304" type="self" title="ALSA-2026:39304"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libxml2-static" version="2.12.5" release="10.el10_2.2" epoch="0" arch="s390x" src="libxml2-2.12.5-10.el10_2.2.src.rpm">
          <filename>libxml2-static-2.12.5-10.el10_2.2.s390x.rpm</filename>
          <sum type="sha256">3f6e0103c6f5303a23e15029406d1110313d92a290ebfddd9cf153d0fa88f8a5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39494</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-08-07 12:56:53"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
  * kernel: XFS data corruption using reflink ()


Bug Fix(es) and Enhancement(s):  

  * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39494" id="RHSA-2026:39494" type="rhsa" title="RHSA-2026:39494"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53016" id="CVE-2026-53016" type="cve" title="CVE-2026-53016"/>
      <reference href="https://bugzilla.redhat.com/2492269" id="2492269" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2498915" id="2498915" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39494.html" id="ALSA-2026:39494" type="self" title="ALSA-2026:39494"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64600.html" id="CVE-2026-64600" type="cve" title="CVE-2026-64600"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.34.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">4acde85f8b720691fc21c927082d6d9e0e598d583bcb591f69e3e448dfdb2dfa</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.34.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.34.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.34.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">fca9066ad8d4ee52915f62711ee85ec77bdae4c9d251d8c398f7ed142c7505bb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:39573</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-07-14 00:00:00"/>
    <updated date="2026-07-21 13:11:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:39573" id="RHSA-2026:39573" type="rhsa" title="RHSA-2026:39573"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821"/>
      <reference href="https://bugzilla.redhat.com/2467822" id="2467822" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2480756" id="2480756" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2484207" id="2484207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-39573.html" id="ALSA-2026:39573" type="self" title="ALSA-2026:39573"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="yggdrasil-devel" version="0.4.9.2" release="1.el10_2" epoch="0" arch="s390x" src="yggdrasil-0.4.9.2-1.el10_2.src.rpm">
          <filename>yggdrasil-devel-0.4.9.2-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">feecc91dfa057f2f84c7044b7198e2ad36942f98a9e597acf8857613878dc960</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:40856</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-07-16 00:00:00"/>
    <updated date="2026-07-17 07:54:43"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:40856" id="RHSA-2026:40856" type="rhsa" title="RHSA-2026:40856"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308"/>
      <reference href="https://bugzilla.redhat.com/2498608" id="2498608" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-40856.html" id="ALSA-2026:40856" type="self" title="ALSA-2026:40856"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3.14-freethreading-tkinter" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-tkinter-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">2ea48fd328f30998269d5379dd2e01377e50a1f5a772b1fe5066615669643b35</sum>
        </package>
        <package name="python3.14-freethreading-test" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-test-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">5d40bc8e6420052c02b1ba0932b3b61df0692d6cbd0dbf46b1b60cf5fff975bc</sum>
        </package>
        <package name="python3.14-freethreading" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">9dcaf993b5fc1b03af0c3cac2fca56fff0e467f9f6894e3aea5b4b8a6638101c</sum>
        </package>
        <package name="python3.14-test" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-test-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">a5a36a4cd168df3b8ae162c578327d8b19bd9b189d5a89adfe1fe2a05c459dcd</sum>
        </package>
        <package name="python3.14-freethreading-libs" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-libs-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">a6bbe78f464592566c4bc65a45506d47b8db4051683efe554d69dbc90196fd2d</sum>
        </package>
        <package name="python3.14-idle" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-idle-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">a7f1fa9b1e895f80fe28d0d0cf63ccb2229402ff61e787b17698fe53c2fcc312</sum>
        </package>
        <package name="python3.14-freethreading-idle" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-idle-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">abe1ded66fa8d2bea90071dedab829b2512cdf93cdb02a389ebfaef7898dfc50</sum>
        </package>
        <package name="python3.14-freethreading-devel" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-devel-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">b8a6123354a5eafbc3b1a353ec755de1f4b8d246e0d5b6f60ce38c823a4af0fe</sum>
        </package>
        <package name="python3.14-freethreading-debug" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-freethreading-debug-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">dc78438ece098d628db6bb441f1e6ad4e4e8e00121ccf45a66e578ed4256f43a</sum>
        </package>
        <package name="python3.14-debug" version="3.14.5" release="1.el10_2.1" epoch="0" arch="s390x" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-debug-3.14.5-1.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">e398944d80b468c9d09077670aac3c74fc2875f84dd4e3447d17164bdc57c0c7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41892</id>
    <title>Important: libtiff security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-20 11:48:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security, bug fix, and enhancement update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)
  * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)


Bug Fix(es) and Enhancement(s):  

  * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41892" id="RHSA-2026:41892" type="rhsa" title="RHSA-2026:41892"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2023-52355" id="CVE-2023-52355" type="cve" title="CVE-2023-52355"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-12912" id="CVE-2026-12912" type="cve" title="CVE-2026-12912"/>
      <reference href="https://bugzilla.redhat.com/2251326" id="2251326" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492871" id="2492871" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41892.html" id="ALSA-2026:41892" type="self" title="ALSA-2026:41892"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libtiff-tools" version="4.6.0" release="8.el10_2.4" epoch="0" arch="s390x" src="libtiff-4.6.0-8.el10_2.4.src.rpm">
          <filename>libtiff-tools-4.6.0-8.el10_2.4.s390x.rpm</filename>
          <sum type="sha256">2a58ce1cba81f8fefc3dcc05147598147856675c4cfcd0e66d92233f0ffe04cc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41893</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-31 12:34:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 8.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468)
  * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41893" id="RHSA-2026:41893" type="rhsa" title="RHSA-2026:41893"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50525" id="CVE-2026-50525" type="cve" title="CVE-2026-50525"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500580" id="2500580" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41893.html" id="ALSA-2026:41893" type="self" title="ALSA-2026:41893"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-8.0-source-built-artifacts" version="8.0.129" release="1.el10_2" epoch="0" arch="s390x" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">a31fe3c3e43877aa7f30a2cc9d4a7df2477df0f32f883550989841f927306418</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41895</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-31 12:33:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 9.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
  * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41895" id="RHSA-2026:41895" type="rhsa" title="RHSA-2026:41895"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41895.html" id="ALSA-2026:41895" type="self" title="ALSA-2026:41895"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-9.0-source-built-artifacts" version="9.0.119" release="1.el10_2" epoch="0" arch="s390x" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">8f4121ced0981e812f25d48a690ac944816b1bfc75f334de829112dfba1bf9bb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41897</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-31 12:37:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>.NET 10.0 security, bug fix, and enhancement update</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463)
  * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41897" id="RHSA-2026:41897" type="rhsa" title="RHSA-2026:41897"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108"/>
      <reference href="https://bugzilla.redhat.com/2499217" id="2499217" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500109" id="2500109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500189" id="2500189" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500492" id="2500492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500502" id="2500502" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500509" id="2500509" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500515" id="2500515" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500556" id="2500556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500562" id="2500562" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500563" id="2500563" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500565" id="2500565" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500577" id="2500577" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500581" id="2500581" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500587" id="2500587" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2500593" id="2500593" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41897.html" id="ALSA-2026:41897" type="self" title="ALSA-2026:41897"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dotnet-sdk-10.0-source-built-artifacts" version="10.0.110" release="1.el10_2" epoch="0" arch="s390x" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el10_2.s390x.rpm</filename>
          <sum type="sha256">6f01491c7bba958505d65b2caf07329d1d7c8af3b8e27aa4c5e19be0f62cf0a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41937</id>
    <title>Important: sssd security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-22 13:35:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sssd security update</summary>
    <description>The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.  

Security Fix(es):  

  * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)
  * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41937" id="RHSA-2026:41937" type="rhsa" title="RHSA-2026:41937"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14474" id="CVE-2026-14474" type="cve" title="CVE-2026-14474"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-14476" id="CVE-2026-14476" type="cve" title="CVE-2026-14476"/>
      <reference href="https://bugzilla.redhat.com/2496556" id="2496556" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2496581" id="2496581" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41937.html" id="ALSA-2026:41937" type="self" title="ALSA-2026:41937"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libsss_nss_idmap-devel" version="2.12.0" release="3.el10_2.1" epoch="0" arch="s390x" src="sssd-2.12.0-3.el10_2.1.src.rpm">
          <filename>libsss_nss_idmap-devel-2.12.0-3.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">d285a8ca24d3fb419577ad536dde97bafd0a97eb534e4b91bcf5c485c0dd8722</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:41988</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-21 10:27:03"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:41988" id="RHSA-2026:41988" type="rhsa" title="RHSA-2026:41988"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42006" id="CVE-2026-42006" type="cve" title="CVE-2026-42006"/>
      <reference href="https://bugzilla.redhat.com/2476476" id="2476476" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-41988.html" id="ALSA-2026:41988" type="self" title="ALSA-2026:41988"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="dovecot-devel" version="2.3.21" release="19.el10_2.1" epoch="1" arch="s390x" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-devel-2.3.21-19.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">c0e9bae7a51ad554ddb2e71265bf749a2d8ed93b8c26e0a4422cca15c5807d85</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42063</id>
    <title>Important: glib2 security update</title>
    <issued date="2026-07-20 00:00:00"/>
    <updated date="2026-07-21 10:25:25"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42063" id="RHSA-2026:42063" type="rhsa" title="RHSA-2026:42063"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-58016" id="CVE-2026-58016" type="cve" title="CVE-2026-58016"/>
      <reference href="https://bugzilla.redhat.com/2492257" id="2492257" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42063.html" id="ALSA-2026:42063" type="self" title="ALSA-2026:42063"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="glib2-doc" version="2.80.4" release="12.el10_2.14" epoch="0" arch="s390x" src="glib2-2.80.4-12.el10_2.14.src.rpm">
          <filename>glib2-doc-2.80.4-12.el10_2.14.s390x.rpm</filename>
          <sum type="sha256">528453595770a2cb7f8b12242ef74954e4f9351158157343b4458fc524ee97dd</sum>
        </package>
        <package name="glib2-static" version="2.80.4" release="12.el10_2.14" epoch="0" arch="s390x" src="glib2-2.80.4-12.el10_2.14.src.rpm">
          <filename>glib2-static-2.80.4-12.el10_2.14.s390x.rpm</filename>
          <sum type="sha256">c9c1f3380b72e58e29645da845134406c85d81e9618c121ef399b3763fd333d2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42694</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-22 13:46:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
  * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
  * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42694" id="RHSA-2026:42694" type="rhsa" title="RHSA-2026:42694"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5435" id="CVE-2026-5435" type="cve" title="CVE-2026-5435"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5928" id="CVE-2026-5928" type="cve" title="CVE-2026-5928"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6238" id="CVE-2026-6238" type="cve" title="CVE-2026-6238"/>
      <reference href="https://bugzilla.redhat.com/2459854" id="2459854" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463465" id="2463465" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2463539" id="2463539" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42694.html" id="ALSA-2026:42694" type="self" title="ALSA-2026:42694"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="nss_db" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>nss_db-2.39-128.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">1764ac50aa960fd7909189cb686d1fa7b4bc10117642999e137b9a873543ab22</sum>
        </package>
        <package name="nss_hesiod" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>nss_hesiod-2.39-128.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">35b3169b976733d224768bd1eff1bde39dca338932d4822680654aad46d05fdb</sum>
        </package>
        <package name="glibc-benchtests" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-benchtests-2.39-128.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">935a414c40a0ca633ec2a778651d1d5bb747d522a38d46f420e84d06dd302662</sum>
        </package>
        <package name="glibc-static" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-static-2.39-128.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">abdc472e4e54ad5d836bf0e63fc479c7bb01490696f30708c91272085a3f4589</sum>
        </package>
        <package name="glibc-nss-devel" version="2.39" release="128.el10_2.alma.1" epoch="0" arch="s390x" src="glibc-2.39-128.el10_2.alma.1.src.rpm">
          <filename>glibc-nss-devel-2.39-128.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">e695a4afbf3e5a60b019c2b256fe6ee15b08fe5a8340273fda6c962e5b051443</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42895</id>
    <title>Important: java-21-openjdk security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-24 08:12:12"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>java-21-openjdk security update</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Enhance TLS certificate handling (CVE-2026-46968)
  * JDK: Improve DTLS handshaking (CVE-2026-46917)
  * JDK: Enhance JPEG handling (CVE-2026-47010)
  * JDK: Enhance XBM image support (CVE-2026-47021)
  * JDK: Enhance Jar file processing (CVE-2026-47027)
  * JDK: Improve certification checking (CVE-2026-60147)
  * JDK: Enhance AWT ImagingLib (CVE-2026-47059)
  * JDK: Enhance Jar handling (CVE-2026-47063)
  * JDK: Update LCMS to 2.19 (CVE-2026-41254)


Enhancement(s):  

  * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343)


Bug Fix(es):  

  * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42895" id="RHSA-2026:42895" type="rhsa" title="RHSA-2026:42895"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41254" id="CVE-2026-41254" type="cve" title="CVE-2026-41254"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46917" id="CVE-2026-46917" type="cve" title="CVE-2026-46917"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46968" id="CVE-2026-46968" type="cve" title="CVE-2026-46968"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47010" id="CVE-2026-47010" type="cve" title="CVE-2026-47010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47021" id="CVE-2026-47021" type="cve" title="CVE-2026-47021"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47027" id="CVE-2026-47027" type="cve" title="CVE-2026-47027"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47059" id="CVE-2026-47059" type="cve" title="CVE-2026-47059"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-47063" id="CVE-2026-47063" type="cve" title="CVE-2026-47063"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-60147" id="CVE-2026-60147" type="cve" title="CVE-2026-60147"/>
      <reference href="https://bugzilla.redhat.com/2459420" id="2459420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502751" id="2502751" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502782" id="2502782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502783" id="2502783" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502784" id="2502784" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502791" id="2502791" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502792" id="2502792" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502793" id="2502793" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503636" id="2503636" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42895.html" id="ALSA-2026:42895" type="self" title="ALSA-2026:42895"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="java-21-openjdk-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">4bfd2080bd4f850282f216b12733c300f34b33fb1733e777faf197fd9da59279</sum>
        </package>
        <package name="java-21-openjdk-headless-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-headless-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">6c0138c9db1fa82028595ded6434f4c98e8fd1cca1758cfc9403a56441ef1612</sum>
        </package>
        <package name="java-21-openjdk-demo-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-demo-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">6cbb949169574c983e616b55a93f56328adba7cad0c5d74a079d16236c1dcf87</sum>
        </package>
        <package name="java-21-openjdk-devel-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-devel-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">83955a24a0d546f135d57833176dcedcf4f923432dae6e7dde7e3acbb122b1e1</sum>
        </package>
        <package name="java-21-openjdk-jmods-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-jmods-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">89b3b05518d2215dd9abfab4f6fc75059a6c519fd69ce6484ebd480b22e06da3</sum>
        </package>
        <package name="java-21-openjdk-static-libs-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-static-libs-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">a99f93bbcc3ed236e89999d438d65562cfd8829cfb288cd119d75662de6b9475</sum>
        </package>
        <package name="java-21-openjdk-src-slowdebug" version="21.0.12.0.8" release="1.2.el10_2.alma.2" epoch="1" arch="s390x" src="java-21-openjdk-21.0.12.0.8-1.2.el10_2.alma.2.src.rpm">
          <filename>java-21-openjdk-src-slowdebug-21.0.12.0.8-1.2.el10_2.alma.2.s390x.rpm</filename>
          <sum type="sha256">c7a6d11936ea446faeebe65534fd351b3d82f0e68fd14c28b4dfe844720815f9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42899</id>
    <title>Important: java-25-openjdk security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-08-06 14:43:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>java-25-openjdk security update</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.  

Security Fix(es):  

  * JDK: Enhance TLS certificate handling (CVE-2026-46968)
  * JDK: Improve DTLS handshaking (CVE-2026-46917)
  * JDK: Enhance JPEG handling (CVE-2026-47010)
  * JDK: Enhance XBM image support (CVE-2026-47021)
  * JDK: Enhance Jar file processing (CVE-2026-47027)
  * JDK: Improve certification checking (CVE-2026-60147)
  * JDK: Enhance AWT ImagingLib (CVE-2026-47059)
  * JDK: Enhance Jar handling (CVE-2026-47063)
  * JDK: Update LCMS to 2.19 (CVE-2026-41254)


Enhancement(s):  

  * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048)


Bug Fix(es):  

  * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052)
  * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42899" id="RHSA-2026:42899" type="rhsa" title="RHSA-2026:42899"/>
      <reference href="https://bugzilla.redhat.com/2459420" id="2459420" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502751" id="2502751" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502782" id="2502782" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502783" id="2502783" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502784" id="2502784" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502791" id="2502791" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502792" id="2502792" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2502793" id="2502793" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2503636" id="2503636" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42899.html" id="ALSA-2026:42899" type="self" title="ALSA-2026:42899"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-41254.html" id="CVE-2026-41254" type="cve" title="CVE-2026-41254"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-46917.html" id="CVE-2026-46917" type="cve" title="CVE-2026-46917"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-46968.html" id="CVE-2026-46968" type="cve" title="CVE-2026-46968"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47010.html" id="CVE-2026-47010" type="cve" title="CVE-2026-47010"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47021.html" id="CVE-2026-47021" type="cve" title="CVE-2026-47021"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47027.html" id="CVE-2026-47027" type="cve" title="CVE-2026-47027"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47059.html" id="CVE-2026-47059" type="cve" title="CVE-2026-47059"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-47063.html" id="CVE-2026-47063" type="cve" title="CVE-2026-47063"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-60147.html" id="CVE-2026-60147" type="cve" title="CVE-2026-60147"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="java-25-openjdk-jmods-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-jmods-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">15cf9973eaf43732c7f554e01cb2311b019a3aef808beef819d9ec12c3c3de11</sum>
        </package>
        <package name="java-25-openjdk-demo-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-demo-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">1e885b36b6d32fcf11090ab629de7808cd8328a12990fa22475d6b6574692cef</sum>
        </package>
        <package name="java-25-openjdk-static-libs-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-static-libs-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">1fe49992e5c7bc51cafaf3cc0d5fd51003995b93cca62cafe4cc445d7f249970</sum>
        </package>
        <package name="java-25-openjdk-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">75e03d7defde597c7607f0e3f2399e255e72f443f845be31e537aae8019405f8</sum>
        </package>
        <package name="java-25-openjdk-devel-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-devel-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">81c95e1809fce21a5ff02b7ab9b38857ddd9a9e5e3fa6d3824db2ce8111aadb5</sum>
        </package>
        <package name="java-25-openjdk-crypto-adapter-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">934f7a73f88d48e868a577f936dcc700577923a627cbf5229202ff2d85fce5ce</sum>
        </package>
        <package name="java-25-openjdk-headless-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-headless-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">d58c9781b7d8beec1e159f06694f3555fbfc9686e53390673db2f7906b344746</sum>
        </package>
        <package name="java-25-openjdk-src-slowdebug" version="25.0.4.0.7" release="1.1.el10_2.alma.1" epoch="1" arch="s390x" src="java-25-openjdk-25.0.4.0.7-1.1.el10_2.alma.1.src.rpm">
          <filename>java-25-openjdk-src-slowdebug-25.0.4.0.7-1.1.el10_2.alma.1.s390x.rpm</filename>
          <sum type="sha256">f578b14adb515c86fc4655cf23b535d2a0a3e383c8a47ecc529a354da4d1540c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:42919</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-21 00:00:00"/>
    <updated date="2026-07-24 10:19:07"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
  * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
  * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
  * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
  * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
  * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
  * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
  * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
  * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
  * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
  * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
  * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()


Bug Fix(es) and Enhancement(s):  

  * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103)
  * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
  * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
  * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:42919" id="RHSA-2026:42919" type="rhsa" title="RHSA-2026:42919"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71113" id="CVE-2025-71113" type="cve" title="CVE-2025-71113"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-71147" id="CVE-2025-71147" type="cve" title="CVE-2025-71147"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23168" id="CVE-2026-23168" type="cve" title="CVE-2026-23168"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31530" id="CVE-2026-31530" type="cve" title="CVE-2026-31530"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46116" id="CVE-2026-46116" type="cve" title="CVE-2026-46116"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46150" id="CVE-2026-46150" type="cve" title="CVE-2026-46150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46215" id="CVE-2026-46215" type="cve" title="CVE-2026-46215"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52950" id="CVE-2026-52950" type="cve" title="CVE-2026-52950"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52976" id="CVE-2026-52976" type="cve" title="CVE-2026-52976"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53009" id="CVE-2026-53009" type="cve" title="CVE-2026-53009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53071" id="CVE-2026-53071" type="cve" title="CVE-2026-53071"/>
      <reference href="https://bugzilla.redhat.com/2429611" id="2429611" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2432366" id="2432366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439941" id="2439941" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460644" id="2460644" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482523" id="2482523" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482612" id="2482612" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2482615" id="2482615" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492284" id="2492284" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492318" id="2492318" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492390" id="2492390" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492458" id="2492458" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-42919.html" id="ALSA-2026:42919" type="self" title="ALSA-2026:42919"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.37.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">0726514d57dbc31774d3f3dc1dc50b22fc21c86443f7ff6f120ddc06cc96b0d1</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.37.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.37.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.37.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">b97f83ec0be2d56ff9108aff8255b3820fd775fca829871e526132969c4040f9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:43505</id>
    <title>Important: mariadb-connector-c security update</title>
    <issued date="2026-07-22 00:00:00"/>
    <updated date="2026-07-23 08:41:57"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>mariadb-connector-c security update</summary>
    <description>The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases.   

Security Fix(es):  

  * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:43505" id="RHSA-2026:43505" type="rhsa" title="RHSA-2026:43505"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-44172" id="CVE-2026-44172" type="cve" title="CVE-2026-44172"/>
      <reference href="https://bugzilla.redhat.com/2488459" id="2488459" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-43505.html" id="ALSA-2026:43505" type="self" title="ALSA-2026:43505"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="mariadb-connector-c-test" version="3.4.4" release="2.el10_2" epoch="0" arch="s390x" src="mariadb-connector-c-3.4.4-2.el10_2.src.rpm">
          <filename>mariadb-connector-c-test-3.4.4-2.el10_2.s390x.rpm</filename>
          <sum type="sha256">3591507abe4b98b8ffe9f7df4f8e1620645be79f8556b9068c76297e1c01afde</sum>
        </package>
        <package name="mariadb-connector-c-doc" version="3.4.4" release="2.el10_2" epoch="0" arch="noarch" src="mariadb-connector-c-3.4.4-2.el10_2.src.rpm">
          <filename>mariadb-connector-c-doc-3.4.4-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">8cf1ce56d4d79c064cdad31b2bb230e2d0a09ef70c34615e9310cb74aabd0d18</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:44270</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-23 00:00:00"/>
    <updated date="2026-07-25 07:46:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:44270" id="RHSA-2026:44270" type="rhsa" title="RHSA-2026:44270"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46323" id="CVE-2026-46323" type="cve" title="CVE-2026-46323"/>
      <reference href="https://bugzilla.redhat.com/2479832" id="2479832" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-44270.html" id="ALSA-2026:44270" type="self" title="ALSA-2026:44270"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.38.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">6826b26468ae8f5aea8f3537ab9eb18a20c5a7805400bbc739b12b9e618a5507</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.38.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.38.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.38.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c45459e0d8a45e83ff73ae9c2171d629401b692554af98f2ad457ccc1ce4d3e3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:45114</id>
    <title>Important: kernel security update</title>
    <issued date="2026-07-24 00:00:00"/>
    <updated date="2026-08-07 12:56:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237)
  * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
  * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
  * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
  * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
  * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)


</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:45114" id="RHSA-2026:45114" type="rhsa" title="RHSA-2026:45114"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-40237" id="CVE-2025-40237" type="cve" title="CVE-2025-40237"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23110" id="CVE-2026-23110" type="cve" title="CVE-2026-23110"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31692" id="CVE-2026-31692" type="cve" title="CVE-2026-31692"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46099" id="CVE-2026-46099" type="cve" title="CVE-2026-46099"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52973" id="CVE-2026-52973" type="cve" title="CVE-2026-52973"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53059" id="CVE-2026-53059" type="cve" title="CVE-2026-53059"/>
      <reference href="https://bugzilla.redhat.com/2418829" id="2418829" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2436755" id="2436755" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2464093" id="2464093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2481972" id="2481972" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492277" id="2492277" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492413" id="2492413" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-45114.html" id="ALSA-2026:45114" type="self" title="ALSA-2026:45114"/>
      <reference href="https://www.redhat.com/security/data/cve/CVE-2026-64561.html" id="CVE-2026-64561" type="cve" title="CVE-2026-64561"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.39.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">a20c7a532a26dbacaa602d8408fce1f8d5f912adb900768029df9095c18f0a0d</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.39.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.39.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.39.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">e7140513e19994f29742455c8fa4ca482de31de21080d1b3c29752e3999b7c9d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47017</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-08-01 22:58:16"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)
  * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
  * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
  * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)


Bug Fix(es) and Enhancement(s):  

  * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47017" id="RHSA-2026:47017" type="rhsa" title="RHSA-2026:47017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46086" id="CVE-2026-46086" type="cve" title="CVE-2026-46086"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-52993" id="CVE-2026-52993" type="cve" title="CVE-2026-52993"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53006" id="CVE-2026-53006" type="cve" title="CVE-2026-53006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-53281" id="CVE-2026-53281" type="cve" title="CVE-2026-53281"/>
      <reference href="https://bugzilla.redhat.com/2481989" id="2481989" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492363" id="2492363" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2492437" id="2492437" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2493728" id="2493728" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47017.html" id="ALSA-2026:47017" type="self" title="ALSA-2026:47017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.40.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">d948dd1730d4b4c6c1b8432ab3ba7080d5a5a410aeede0a3159e8a10f330bf2a</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.40.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.40.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.40.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">fce4fc51d823342d7684039e8869da2cad6d2ecf350c4688161f4ab02233fbd5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47079</id>
    <title>Important: libXfont2 security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libXfont2 security update</summary>
    <description>X.Org X11 libXfont2 runtime library  

Security Fix(es):  

  * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001)
  * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47079" id="RHSA-2026:47079" type="rhsa" title="RHSA-2026:47079"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56001" id="CVE-2026-56001" type="cve" title="CVE-2026-56001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-56002" id="CVE-2026-56002" type="cve" title="CVE-2026-56002"/>
      <reference href="https://bugzilla.redhat.com/2496640" id="2496640" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2496641" id="2496641" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47079.html" id="ALSA-2026:47079" type="self" title="ALSA-2026:47079"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libXfont2-devel" version="2.0.6" release="5.el10_2.1" epoch="0" arch="s390x" src="libXfont2-2.0.6-5.el10_2.1.src.rpm">
          <filename>libXfont2-devel-2.0.6-5.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">5b68810cfb7d7fed090be0f0b2274435bcc51938717a4b71ec713f63349768ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47085</id>
    <title>Important: rest security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>rest security update</summary>
    <description>The rest packages provide a library for access to the RESTful web services.  

Security Fix(es):  

  * librest: weak random number generation in PKCE implementation (CVE-2026-16615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47085" id="RHSA-2026:47085" type="rhsa" title="RHSA-2026:47085"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16615" id="CVE-2026-16615" type="cve" title="CVE-2026-16615"/>
      <reference href="https://bugzilla.redhat.com/2504432" id="2504432" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47085.html" id="ALSA-2026:47085" type="self" title="ALSA-2026:47085"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="rest-devel" version="0.9.1" release="11.el10_2.1" epoch="0" arch="s390x" src="rest-0.9.1-11.el10_2.1.src.rpm">
          <filename>rest-devel-0.9.1-11.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">54861cae723da13300b7207de40b9c7510515a9e6526b68a27487c431b02c531</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:47180</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-28 00:00:00"/>
    <updated date="2026-07-29 12:49:57"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691)
  * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:47180" id="RHSA-2026:47180" type="rhsa" title="RHSA-2026:47180"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59691" id="CVE-2026-59691" type="cve" title="CVE-2026-59691"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-59692" id="CVE-2026-59692" type="cve" title="CVE-2026-59692"/>
      <reference href="https://bugzilla.redhat.com/2497343" id="2497343" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2497344" id="2497344" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-47180.html" id="ALSA-2026:47180" type="self" title="ALSA-2026:47180"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-devel" version="1.26.7" release="2.el10_2.6" epoch="0" arch="s390x" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.6.src.rpm">
          <filename>gstreamer1-plugins-bad-free-devel-1.26.7-2.el10_2.6.s390x.rpm</filename>
          <sum type="sha256">348f60087e44a3a0117562355c8b2c0ecc671fef659c681e044ff59017520726</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49211</id>
    <title>Important: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-07-31 00:00:00"/>
    <updated date="2026-08-06 14:44:56"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
  * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)
  * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle ()


Bug Fix(es) and Enhancement(s):  

  * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669)
  * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49211" id="RHSA-2026:49211" type="rhsa" title="RHSA-2026:49211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68211" id="CVE-2025-68211" type="cve" title="CVE-2025-68211"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-46303" id="CVE-2026-46303" type="cve" title="CVE-2026-46303"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-64530" id="CVE-2026-64530" type="cve" title="CVE-2026-64530"/>
      <reference href="https://bugzilla.redhat.com/2422696" id="2422696" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2486471" id="2486471" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2504052" id="2504052" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49211.html" id="ALSA-2026:49211" type="self" title="ALSA-2026:49211"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="libperf" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.42.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">0c6f27a921c48ff66221f918be08dd6f418ceb628ade761131e106d946da90e7</sum>
        </package>
        <package name="kernel-cross-headers" version="6.12.0" release="211.42.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.42.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.42.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">af76581ced8398e2fc7dfa060901b73e1b987e96098c6f72188c8724ff8a1f48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49836</id>
    <title>Important: ldns security update</title>
    <issued date="2026-08-03 00:00:00"/>
    <updated date="2026-08-06 14:43:17"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>ldns security update</summary>
    <description>The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets.  

Security Fix(es):  

  * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49836" id="RHSA-2026:49836" type="rhsa" title="RHSA-2026:49836"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-10846" id="CVE-2026-10846" type="cve" title="CVE-2026-10846"/>
      <reference href="https://bugzilla.redhat.com/2487437" id="2487437" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49836.html" id="ALSA-2026:49836" type="self" title="ALSA-2026:49836"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="python3-ldns" version="1.8.3" release="18.el10_2.1" epoch="0" arch="s390x" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>python3-ldns-1.8.3-18.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">06a8c0746d854e69cd8454438d2262dbc62652aea0ca15432b4ba83b90d6044c</sum>
        </package>
        <package name="ldns-utils" version="1.8.3" release="18.el10_2.1" epoch="0" arch="s390x" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>ldns-utils-1.8.3-18.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">19ff15e75a5c8bdd8fd42babef00f88294cac47f2e96c510051f0d3e7002478c</sum>
        </package>
        <package name="perl-ldns" version="1.8.3" release="18.el10_2.1" epoch="0" arch="s390x" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>perl-ldns-1.8.3-18.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">5bfa50cd13e2b2402fecb3e74d1ad2ae5229dd6b9c56675f3d50745c85c81294</sum>
        </package>
        <package name="ldns-devel" version="1.8.3" release="18.el10_2.1" epoch="0" arch="s390x" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>ldns-devel-1.8.3-18.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">828f7e50680b4196dee034f59f7a86aa4e072a8224efa1d5c28da31c7a5071c3</sum>
        </package>
        <package name="ldns-doc" version="1.8.3" release="18.el10_2.1" epoch="0" arch="noarch" src="ldns-1.8.3-18.el10_2.1.src.rpm">
          <filename>ldns-doc-1.8.3-18.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">d3a9d21b00192966f42699a0a0e9a7496c7988733f2e1989217611c1e00a2679</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:49871</id>
    <title>Moderate: kernel security, bug fix, and enhancement update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-07 08:58:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>kernel security, bug fix, and enhancement update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214)
  * kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)


Bug Fix(es) and Enhancement(s):  

  * [Lenovo] Graphics not working on T14 G7 Intel (Pantherlake) (JIRA:AlmaLinux-172832)
  * Possible regression with FM350GL [almalinux-10.2.z] (JIRA:AlmaLinux-184266)
  * [10.2 FEAT] CNB102: dpll: sync with upstream (JIRA:AlmaLinux-211011)
  * backport make module and modules-core provides use variant [almalinux-10.2.z] (JIRA:AlmaLinux-213965)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:49871" id="RHSA-2026:49871" type="rhsa" title="RHSA-2026:49871"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-68214" id="CVE-2025-68214" type="cve" title="CVE-2025-68214"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23199" id="CVE-2026-23199" type="cve" title="CVE-2026-23199"/>
      <reference href="https://bugzilla.redhat.com/2422686" id="2422686" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439919" id="2439919" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-49871.html" id="ALSA-2026:49871" type="self" title="ALSA-2026:49871"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.43.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">2408fde11d9244ab2c166394d4403d539ac7684e36af3ce9549bccce9f5a536a</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.43.1.el10_2" epoch="0" arch="s390x" src="kernel-6.12.0-211.43.1.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.43.1.el10_2.s390x.rpm</filename>
          <sum type="sha256">c9348d2f521ccac429042dc1f08ba7f58d45540a61f2913f0de07881c9107f0e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:50142</id>
    <title>Important: sg3_utils security, bug fix, and enhancement update</title>
    <issued date="2026-08-04 00:00:00"/>
    <updated date="2026-08-06 14:41:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>sg3_utils security, bug fix, and enhancement update</summary>
    <description>The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.  

Security Fix(es):  

  * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)


Bug Fix(es) and Enhancement(s):  

  * sg_inq output conformance for SCSI name string and ATA fields [almalinux-10.2.z] (JIRA:AlmaLinux-188123)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:50142" id="RHSA-2026:50142" type="rhsa" title="RHSA-2026:50142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-16313" id="CVE-2026-16313" type="cve" title="CVE-2026-16313"/>
      <reference href="https://bugzilla.redhat.com/2502845" id="2502845" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-50142.html" id="ALSA-2026:50142" type="self" title="ALSA-2026:50142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="sg3_utils-devel" version="1.48" release="7.el10_2.1" epoch="0" arch="s390x" src="sg3_utils-1.48-7.el10_2.1.src.rpm">
          <filename>sg3_utils-devel-1.48-7.el10_2.1.s390x.rpm</filename>
          <sum type="sha256">7e4d798fc4093aaf836eabc558e0b4adbadbc5b062fcb747896af63bea802d1e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:50747</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-08-05 00:00:00"/>
    <updated date="2026-08-06 14:41:04"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>freerdp security update</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  

Security Fix(es):  

  * FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding (CVE-2026-55827)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:50747" id="RHSA-2026:50747" type="rhsa" title="RHSA-2026:50747"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-55827" id="CVE-2026-55827" type="cve" title="CVE-2026-55827"/>
      <reference href="https://bugzilla.redhat.com/2499159" id="2499159" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-50747.html" id="ALSA-2026:50747" type="self" title="ALSA-2026:50747"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-s390x-crb-rpms__10_0_default">
        <name>almalinux-10-for-s390x-crb-rpms__10_0_default</name>
        <package name="freerdp-server" version="3.10.3" release="12.el10_2.7" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-server-3.10.3-12.el10_2.7.s390x.rpm</filename>
          <sum type="sha256">6da61fda6a5d33912616db3bf4866e569081e75362bc03eb57e6c16e3ef445a0</sum>
        </package>
        <package name="libwinpr-devel" version="3.10.3" release="12.el10_2.7" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>libwinpr-devel-3.10.3-12.el10_2.7.s390x.rpm</filename>
          <sum type="sha256">af501cd942e4e0159dbc240ccaac3e09c3dcf012c7fe1649b46fa3751d642ff6</sum>
        </package>
        <package name="freerdp-devel" version="3.10.3" release="12.el10_2.7" epoch="2" arch="s390x" src="freerdp-3.10.3-12.el10_2.7.src.rpm">
          <filename>freerdp-devel-3.10.3-12.el10_2.7.s390x.rpm</filename>
          <sum type="sha256">fc30313cf5b74db356955098347144f0c6566d712bb40bb23f3923f67cc06eaf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>