I would like to check the fix status for CVE-2026-43499 in Rocky Linux 8.10.
When I searched for this CVE at https://errata.rockylinux.org/, I found results for Rocky Linux 9 and 10, but not for version 8.
Could you please provide information on the following?
Is the fix for this CVE included in the current Rocky Linux 8.10 repositories?
If included, what is the version of the package that contains the fix?
If the fix is not yet applied, is there a release schedule for the package that addresses this vulnerability?
It’s very simple to check using dnf commands, eg:
root@rocky8:~# dnf changelog kernel | grep 43499
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499}
clearly shows it’s fixed. In fact if you view the full changelog with that command instead of grepping, you’ll then find out what kernel it was fixed in. If you grep it and it doesn’t show any results, that means your system is not up-to-date, in which case:
Good point, forgot about that. Got confused with using the changelog parameter with the rpm command which would only query it’s local data, whereas dnf will utilise the repo data and refresh itself.
dnf changelog shows all changes for a packages in the versions available on the repository. You can review the log to find where a particular patch or change came in or use grep to verify it has been applied, as previously stated. There appears to be a limit, 10? in history beyond which you will not see the documentation in this log.
That depends. The changelog is “just a document” that is inserted into the package (by the build system?). Rocky may or may not add their own entries into the log and could filter what else is included in the document.
IME, CentOS used to retain lot more log entries, back when access to (RHEL) sources was more trivial.
You can do a some queries about log sizes, like:
rpm -qa | while read X ; do rpm -q --changelog $X | wc -l ; done | sort -n
rpm -qa ker\* | while read X ; do echo $X ; rpm -q --changelog $X | grep -c '^\*' ; done
Note also that “lack of evidence is not always a proof non-existence”. Recently Red Hat did release a kernel patch as a “bug fix” before the fixed issue were assigned a CVE. Hence the log entry for that patch does not mention the CVE.
