Amazon Linux 2023 Security Advisory: ALAS2023-2026-2057
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-20
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: take vmap_purge_lock in shrinker (CVE-2026-46093)
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() (CVE-2026-53027)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path. (CVE-2026-53402)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
Blamed commit moved the TIME_WAIT-derived ISN from the skb control
block to a per-CPU variable, assuming the value would always be consumed
by tcp_conn_request() for the same packet that wrote it. That assumption
is violated by multiple drop paths between the producer
(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
(tcp_conn_request()):
- min_ttl / min_hopcount check
- xfrm policy check
- tcp_inbound_hash() MD5/AO mismatch
- tcp_filter() eBPF/SO_ATTACH_FILTER drop
- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
- tcp_v{4,6}_cookie_check() returning NULL
When a packet is dropped on any of these paths, tcp_tw_isn is left set.
The next SYN processed on the same CPU then consumes the non zero value in
tcp_conn_request(), receiving a potentially predictable ISN.
This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
variable.
Note that tcp_v{4,6}_fill_cb() do not set it.
Very litle impact on overall code size/complexity:
$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)
Function old new delta
tcp_v6_rcv 3038 3042 +4
tcp_v4_rcv 3035 3039 +4
tcp_conn_request 2938 2923 -15
Total: Before=24436060, After=24436053, chg -0.00% (CVE-2026-64024)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)
In the Linux kernel, the following vulnerability has been resolved:
xfs: fail recovery on a committed log item with no regions
If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.
The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log. It came from an AI-assisted code audit of the
recovery parser.
xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf. Reject it there, before the commit handlers that also read
ri_buf[0].
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
xlog_recover (fs/xfs/xfs_log_recover.c:3493)
xfs_log_mount (fs/xfs/xfs_log.c:618)
xfs_mountfs (fs/xfs/xfs_mount.c:1034)
xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
vfs_get_tree (fs/super.c:1695)
path_mount (fs/namespace.c:4161)
__x64_sys_mount (fs/namespace.c:4367) (CVE-2026-64187)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
When CONFIG_BPF_LSM=y is set, BPF inode storage maps
(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
from the "lsm=" boot parameter), lsm_prepare() is never executed for
the BPF LSM.
Consequently, the BPF inode security blob offset
(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at
its default compiled size of 8 bytes instead of being updated to a
valid offset past the reserved struct rcu_head (typically 16 bytes
or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE
map, bpf_inode() evaluates inode->i_security + 8. This erroneously
aliases the struct rcu_head.func callback pointer at the beginning
of the inode->i_security blob. During subsequent map element cleanup
or inode destruction, writing NULL to owner_storage clears the queued
RCU callback pointer. When rcu_do_batch() later executes the queued
callback, it attempts an instruction fetch at address 0x0, triggering
an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag
marked with __ro_after_init. Set this flag to true inside bpf_lsm_init()
when the LSM framework successfully registers the BPF LSM. Gate map
allocation in inode_storage_map_alloc() on this flag, returning
-EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode
storage maps when the supporting BPF LSM infrastructure is absent,
avoiding zombie map states. (CVE-2026-64192)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: driver: Check ACPI_COMPANION() against NULL during probe (CVE-2026-64227)
In the Linux kernel, the following vulnerability has been resolved:
fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix adapter deregistration race (CVE-2026-64279)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits (CVE-2026-64284)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (CVE-2026-64286)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)
In the Linux kernel, the following vulnerability has been resolved:
mm: do file ownership checks with the proper mount idmap (CVE-2026-64294)
In the Linux kernel, the following vulnerability has been resolved:
exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
In the Linux kernel, the following vulnerability has been resolved:
tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299)
In the Linux kernel, the following vulnerability has been resolved:
crypto: drbg - Fix returning success on failure in CTR_DRBG (CVE-2026-64306)
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312)
In the Linux kernel, the following vulnerability has been resolved:
crypto: ecc - Fix carry overflow in vli multiplication (CVE-2026-64313)
In the Linux kernel, the following vulnerability has been resolved:
isofs: bound Rock Ridge symlink components to the SL record (CVE-2026-64317)
In the Linux kernel, the following vulnerability has been resolved:
udf: validate sparing table length as an entry count, not a byte count (CVE-2026-64322)
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size (CVE-2026-64323)
In the Linux kernel, the following vulnerability has been resolved:
udf: validate free block extents against the partition length (CVE-2026-64324)
In the Linux kernel, the following vulnerability has been resolved:
block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (CVE-2026-64326)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Validate BTF repeated field counts before expansion (CVE-2026-64354)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap (CVE-2026-64355)
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchmaps reservation limit check (CVE-2026-64357)
In the Linux kernel, the following vulnerability has been resolved:
HID: multitouch: fix out-of-bounds bit access on mt_io_flags (CVE-2026-64364)
In the Linux kernel, the following vulnerability has been resolved:
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (CVE-2026-64370)
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (part 1) (CVE-2026-64371)
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372)
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373)
In the Linux kernel, the following vulnerability has been resolved:
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (CVE-2026-64374)
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden POSIX SID length parsing (CVE-2026-64380)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix change notify replay double-free (CVE-2026-64384)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay (CVE-2026-64385)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix query_info() replay double-free (CVE-2026-64386)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix query directory replay double-free (CVE-2026-64387)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: module names must be null-terminated (CVE-2026-64412)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: zero chainstack array (CVE-2026-64413)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: handle unreadable frags (CVE-2026-64414)
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (CVE-2026-64415)
In the Linux kernel, the following vulnerability has been resolved:
mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (CVE-2026-64416)
In the Linux kernel, the following vulnerability has been resolved:
mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423)
In the Linux kernel, the following vulnerability has been resolved:
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns (CVE-2026-64432)
In the Linux kernel, the following vulnerability has been resolved:
audit: Fix data races of skb_queue_len() readers on audit_queue (CVE-2026-64435)
In the Linux kernel, the following vulnerability has been resolved:
net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450)
In the Linux kernel, the following vulnerability has been resolved:
hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)
In the Linux kernel, the following vulnerability has been resolved:
virtio_pci: fix vq info pointer lookup via wrong index (CVE-2026-64457)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/ops-common: handle extreme intervals in damon_hot_score() (CVE-2026-64458)
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix sleep in atomic context in xhci_free_streams() (CVE-2026-64465)
In the Linux kernel, the following vulnerability has been resolved:
vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)
In the Linux kernel, the following vulnerability has been resolved:
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (CVE-2026-64474)
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476)
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Support for hardening against JIT spraying (CVE-2026-64508)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Suppress UBSAN warning caused by field misuse (CVE-2026-64512)
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: gate must_wait writability check on pte_present() (CVE-2026-64514)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} (CVE-2026-64532)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543)
In the Linux kernel, the following vulnerability has been resolved:
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (CVE-2026-64544)
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)
In the Linux kernel, the following vulnerability has been resolved:
drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548)
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big() (CVE-2026-64552)
In the Linux kernel, the following vulnerability has been resolved:
net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (CVE-2026-64555)
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Detach event groups during remove_on_exec
perf_event_remove_on_exec() removes events by calling
perf_event_exit_event(). For top-level events, this removes the event from
the context with DETACH_EXIT only.
This can leave inconsistent group state when a removed event is a group
leader and the group contains siblings without remove_on_exec. If the group
was active, the surviving siblings can remain active and attached to the
removed leader's sibling list, but are no longer represented by a valid
group leader on the PMU context active lists.
A later close of the removed leader uses DETACH_GROUP and can promote the
still-active siblings from this stale group state. The next schedule-in can
then add an already-linked active_list entry again, corrupting the PMU
context active list.
With DEBUG_LIST enabled, this is caught as a list_add double-add in
merge_sched_in().
Fix this by detaching group relationships when remove_on_exec removes an
event. This preserves the existing task-exit and revoke behavior, while
ensuring surviving siblings are ungrouped before the removed event leaves
the context. (CVE-2026-64556)
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU. If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root. On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately. (CVE-2026-64561)
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix NULL-deref on adapter registration failure (CVE-2026-64589)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not trim a device which is not writeable (CVE-2026-64593)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
In the Linux kernel, the following vulnerability has been resolved:
smb/client: Fix error code in smb2_aead_req_alloc() (CVE-2026-64598)
In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (CVE-2026-64604)
In the Linux kernel, the following vulnerability has been resolved:
mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
In the Linux kernel, the following vulnerability has been resolved:
debugobjects: Plug race against a concurrent OOM disable (CVE-2026-68090)
In the Linux kernel, the following vulnerability has been resolved:
time/jiffies: Register jiffies clocksource before usage (CVE-2026-68092)
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix handling of AIF enable without AISB (CVE-2026-68454)
In the Linux kernel, the following vulnerability has been resolved:
device property: initialize the remaining fields of fwnode_handle in fwnode_init() (CVE-2026-68461)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reload ip header after head reallocation (CVE-2026-68476)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix more places with wrong ipv6 transport offsets (CVE-2026-68477)
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (CVE-2026-72010)
In the Linux kernel, the following vulnerability has been resolved:
tracing/osnoise: Call synchronize_rcu() when unregistering (CVE-2026-72012)
In the Linux kernel, the following vulnerability has been resolved:
drbd: reject data replies with an out-of-range payload size (CVE-2026-72014)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (CVE-2026-72020)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: use parsed transport offset in SCTP state lookup (CVE-2026-72021)
In the Linux kernel, the following vulnerability has been resolved:
mm/compaction: handle free_pages_prepare() properly in compaction_free() (CVE-2026-72027)
In the Linux kernel, the following vulnerability has been resolved:
fhandle: reject detached mounts in capable_wrt_mount() (CVE-2026-72034)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72035)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72036)
In the Linux kernel, the following vulnerability has been resolved:
espintcp: use sk_msg_free_partial to fix partial send (CVE-2026-72041)
In the Linux kernel, the following vulnerability has been resolved:
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
In the Linux kernel, the following vulnerability has been resolved:
net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053)
In the Linux kernel, the following vulnerability has been resolved:
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72054)
In the Linux kernel, the following vulnerability has been resolved:
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72055)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: preserve tc_skb_cb across defragmentation (CVE-2026-72057)
In the Linux kernel, the following vulnerability has been resolved:
net: sit: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72061)
In the Linux kernel, the following vulnerability has been resolved:
gpio: tegra: do not call pinctrl for GPIO direction (CVE-2026-72063)
In the Linux kernel, the following vulnerability has been resolved:
cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066)
In the Linux kernel, the following vulnerability has been resolved:
cpu: hotplug: Preserve per instance callback errors (CVE-2026-72067)
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() (CVE-2026-72068)
In the Linux kernel, the following vulnerability has been resolved:
tracing/user_events: Fix use-after-free in user_event_mm_dup() (CVE-2026-72071)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084)
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: make error counter atomic (CVE-2026-72096)
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: fix a possible NULL pointer dereference (CVE-2026-72097)
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix a bug if the bio is out of limits (CVE-2026-72100)
In the Linux kernel, the following vulnerability has been resolved:
dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
In the Linux kernel, the following vulnerability has been resolved:
dm-log: fix a bitset_size overflow on 32bit machines (CVE-2026-72105)
In the Linux kernel, the following vulnerability has been resolved:
dm-ioctl: fix a possible overflow in list_version_get_info (CVE-2026-72106)
In the Linux kernel, the following vulnerability has been resolved:
dm thin metadata: fix metadata snapshot consistency on commit failure (CVE-2026-72108)
In the Linux kernel, the following vulnerability has been resolved:
bpf,fork: wipe ->bpf_storage before bailouts that access it (CVE-2026-72110)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing rcu list annotations and operations (CVE-2026-72120)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123)
In the Linux kernel, the following vulnerability has been resolved:
netdev-genl: report NAPI thread PID in the caller's pid namespace (CVE-2026-72127)
In the Linux kernel, the following vulnerability has been resolved:
NFS: Charge unstable writes by request size, not folio size (CVE-2026-72132)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72136)
In the Linux kernel, the following vulnerability has been resolved:
xen/gntdev: fix error handling in ioctl (CVE-2026-72138)
In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (CVE-2026-72151)
In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (CVE-2026-72152)
In the Linux kernel, the following vulnerability has been resolved:
mtd: spi-nor: swp: Improve locking user experience (CVE-2026-72155)
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172)
In the Linux kernel, the following vulnerability has been resolved:
fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (CVE-2026-72174)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (CVE-2026-72176)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (CVE-2026-72177)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: always put unsuccessfully committed target pids (CVE-2026-72178)
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: validate split-point offset in indx_insert_into_buffer (CVE-2026-72191)
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head (CVE-2026-72192)
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: cap RESTART_TABLE free-chain walker at rt->used (CVE-2026-72193)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow (CVE-2026-72194)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off (CVE-2026-72195)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass (CVE-2026-72196)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length (CVE-2026-72197)
In the Linux kernel, the following vulnerability has been resolved:
mm/memory_hotplug: fix incorrect altmap passing in error path (CVE-2026-72212)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (CVE-2026-72217)
In the Linux kernel, the following vulnerability has been resolved:
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218)
In the Linux kernel, the following vulnerability has been resolved:
lockd: Plug nlm_file leak when nlm_do_fopen() fails (CVE-2026-72219)
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path (CVE-2026-72223)
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Free arenas on btt_init() error paths (CVE-2026-72224)
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (CVE-2026-72225)
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: avoid OOB read of num_dests header (CVE-2026-72227)
In the Linux kernel, the following vulnerability has been resolved:
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)
In the Linux kernel, the following vulnerability has been resolved:
selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conncount: fix zone comparison in tuple dedup (CVE-2026-72247)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (CVE-2026-72250)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: reload possible stale data pointer (CVE-2026-72251)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_cluster: reject template conntracks in hash match (CVE-2026-72256)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: vesafb: fix memory leak in vesafb_probe() (CVE-2026-72266)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: efifb: fix memory leak in efifb_probe() (CVE-2026-72273)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (CVE-2026-72274)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (CVE-2026-72275)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (CVE-2026-72276)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (CVE-2026-72280)
In the Linux kernel, the following vulnerability has been resolved:
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (CVE-2026-72282)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (CVE-2026-72284)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (CVE-2026-72286)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (CVE-2026-72290)
In the Linux kernel, the following vulnerability has been resolved:
net: ife: require ETH_HLEN to be pullable in ife_decode() (CVE-2026-72296)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix overflow in passthrough ioctl bounds check (CVE-2026-72310)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate DFS referral string offsets (CVE-2026-72318)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: ensure inner headers in ICMP errors are in headroom (CVE-2026-72319)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: Fix potential UAF in MLD delayed work (CVE-2026-72322)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323)
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (CVE-2026-72325)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cake: reject overhead values that underflow length (CVE-2026-72326)
In the Linux kernel, the following vulnerability has been resolved:
net/tls: Consume empty data records in tls_sw_read_sock() (CVE-2026-72330)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload (CVE-2026-72338)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix HV VHCA stats agent registration race (CVE-2026-72342)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_connmark: reject invalid shift parameters (CVE-2026-72347)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVE-2026-72348)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (CVE-2026-72349)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_u32: reject invalid shift counts (CVE-2026-72350)
In the Linux kernel, the following vulnerability has been resolved:
gue: validate REMCSUM private option length (CVE-2026-72351)
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: Fix hid_bpf_get_data() range check (CVE-2026-72352)
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix missing credit release on failure in cifs_issue_read() (CVE-2026-72356)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix writeback error handling (CVE-2026-72364)
In the Linux kernel, the following vulnerability has been resolved:
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (CVE-2026-72379)
In the Linux kernel, the following vulnerability has been resolved:
bridge: stp: Fix a potential use-after-free when deleting a bridge (CVE-2026-72389)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF (CVE-2026-72390)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392)
In the Linux kernel, the following vulnerability has been resolved:
seg6: validate SRH length before reading fixed fields (CVE-2026-72400)
In the Linux kernel, the following vulnerability has been resolved:
net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (CVE-2026-72405)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct (CVE-2026-72418)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() (CVE-2026-72419)
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: avoid R5_Overlap races while breaking stripe batches (CVE-2026-72420)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: Don't ignore error route in local/main tables. (CVE-2026-72421)
In the Linux kernel, the following vulnerability has been resolved:
ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (CVE-2026-72425)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix effective prog array index with BPF_F_PREORDER (CVE-2026-72427)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack slot index in nospec checks (CVE-2026-72428)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (CVE-2026-72433)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: make sure gc is properly stopped (CVE-2026-72434)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (CVE-2026-72435)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (CVE-2026-72436)
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (CVE-2026-72437)
In the Linux kernel, the following vulnerability has been resolved:
flow_dissector: check device type before reading ETH_ADDRS (CVE-2026-72444)
In the Linux kernel, the following vulnerability has been resolved:
sctp: hold socket lock when dumping endpoints in sctp_diag (CVE-2026-72447)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: validate selector family and prefixlen during match (CVE-2026-72450)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix xfrm state cache insertion race (CVE-2026-72451)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: clear CRTC color blob pointers after dropping refs (CVE-2026-72452)
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Fix bcall rep leak and unbounded peek (CVE-2026-72466)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: resize log->one_page_buf when adopting on-disk page size (CVE-2026-72470)
In the Linux kernel, the following vulnerability has been resolved:
nfs: use nfsi->rwsem to protect traversal of the file lock list (CVE-2026-72472)
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix possible use after free (CVE-2026-72476)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: add bounds check to run_get_highest_vcn() (CVE-2026-72478)
In the Linux kernel, the following vulnerability has been resolved:
PCI: Check ROM header and data structure addr before accessing (CVE-2026-72487)
In the Linux kernel, the following vulnerability has been resolved:
tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (CVE-2026-72502)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in tipc_l2_send_msg() (CVE-2026-74255)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (CVE-2026-74256)
In the Linux kernel, the following vulnerability has been resolved:
cifs: remove all cifs files before kill super (CVE-2026-74259)
In the Linux kernel, the following vulnerability has been resolved:
kcm: use WRITE_ONCE() when changing lower socket callbacks (CVE-2026-74262)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (CVE-2026-74267)
In the Linux kernel, the following vulnerability has been resolved:
handshake: Require admin permission for DONE command (CVE-2026-74270)
In the Linux kernel, the following vulnerability has been resolved:
power: supply: core: fix supplied_from allocations (CVE-2026-74271)
In the Linux kernel, the following vulnerability has been resolved:
tipc: reject inverted service ranges from peer bindings (CVE-2026-74281)
In the Linux kernel, the following vulnerability has been resolved:
tipc: prevent snt_unacked underflow on CONN_ACK (CVE-2026-74282)
In the Linux kernel, the following vulnerability has been resolved:
tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_hfsc: Don't make class passive twice (CVE-2026-74284)
In the Linux kernel, the following vulnerability has been resolved:
net: pfcp: allocate per-cpu tstats for PFCP netdevs (CVE-2026-74286)
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded address parameter length (CVE-2026-74287)
In the Linux kernel, the following vulnerability has been resolved:
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). (CVE-2026-74288)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_flow: Dont expose folded kernel pointers (CVE-2026-74290)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (CVE-2026-74296)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size (CVE-2026-74297)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Tighten cgroup storage cookie checks for prog arrays (CVE-2026-74305)
In the Linux kernel, the following vulnerability has been resolved:
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (CVE-2026-74307)
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix kernel BUG in ext4_write_inline_data_end (CVE-2026-74308)
In the Linux kernel, the following vulnerability has been resolved:
vhost/net: complete zerocopy ubufs only once (CVE-2026-74310)
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (CVE-2026-74316)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix deadlock cloning inline extent when using flushoncommit (CVE-2026-74318)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (CVE-2026-74321)
In the Linux kernel, the following vulnerability has been resolved:
vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() (CVE-2026-74327)
In the Linux kernel, the following vulnerability has been resolved:
watchdog: unregister PM notifier on watchdog unregister (CVE-2026-74329)
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix lockless traversals of ->s_children (CVE-2026-74330)
In the Linux kernel, the following vulnerability has been resolved:
firmware_loader: Fix recursive lock in device_cache_fw_images() (CVE-2026-74331)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix OOB read during CQ MR registration (CVE-2026-74346)
In the Linux kernel, the following vulnerability has been resolved:
vhost: fix vhost_get_avail_idx for a non empty ring (CVE-2026-74356)
In the Linux kernel, the following vulnerability has been resolved:
configfs_lookup(): don't leave ->s_dentry dangling on failure (CVE-2026-74359)
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (CVE-2026-74363)
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Handle preemption in BTT lane acquisition (CVE-2026-74365)
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: reset read_slot when reusing r10bio for discard (CVE-2026-74376)
In the Linux kernel, the following vulnerability has been resolved:
dax/kmem: account for partial discontiguous resource upon removal (CVE-2026-74379)
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix iommu_map_sgtable() return value check (CVE-2026-74380)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_bpf: prevent unbounded recursion in offload rollback (CVE-2026-74382)
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: fix flex array size in struct nvme_ns_head (CVE-2026-74384)
In the Linux kernel, the following vulnerability has been resolved:
drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (CVE-2026-74393)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (CVE-2026-74395)
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (CVE-2026-74397)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (CVE-2026-74398)
In the Linux kernel, the following vulnerability has been resolved:
evm: terminate and bound the evm_xattrs read buffer (CVE-2026-74399)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). (CVE-2026-74406)
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix integer overflow in radeon_align_pitch() (CVE-2026-74417)
In the Linux kernel, the following vulnerability has been resolved:
fbcon: fix NULL pointer dereference for a console without vc_data (CVE-2026-74424)
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (CVE-2026-74439)
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_skcipher - force synchronous processing on trees without ctx->state (CVE-2026-74578)
Affected Packages:
kernel6.12
Issue Correction:
Run dnf update kernel6.12 --releasever 2023.12.20260817 or dnf update --advisory ALAS2023-2026-2057 --releasever 2023.12.20260817 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
kernel6.12-tools-devel-6.12.100-125.179.amzn2023.aarch64
kernel6.12-modules-extra-6.12.100-125.179.amzn2023.aarch64
bpftool6.12-debuginfo-6.12.100-125.179.amzn2023.aarch64
kernel6.12-modules-extra-common-6.12.100-125.179.amzn2023.aarch64
kernel-livepatch-6.12.100-125.179-1.0-0.amzn2023.aarch64
kernel6.12-headers-6.12.100-125.179.amzn2023.aarch64
kernel6.12-tools-debuginfo-6.12.100-125.179.amzn2023.aarch64
perf6.12-debuginfo-6.12.100-125.179.amzn2023.aarch64
bpftool6.12-6.12.100-125.179.amzn2023.aarch64
kernel6.12-tools-6.12.100-125.179.amzn2023.aarch64
kernel6.12-6.12.100-125.179.amzn2023.aarch64
python3-perf6.12-6.12.100-125.179.amzn2023.aarch64
python3-perf6.12-debuginfo-6.12.100-125.179.amzn2023.aarch64
perf6.12-6.12.100-125.179.amzn2023.aarch64
kernel6.12-debuginfo-6.12.100-125.179.amzn2023.aarch64
kernel6.12-debuginfo-common-aarch64-6.12.100-125.179.amzn2023.aarch64
kernel6.12-devel-6.12.100-125.179.amzn2023.aarch64
src:
kernel6.12-6.12.100-125.179.amzn2023.src
x86_64:
bpftool6.12-6.12.100-125.179.amzn2023.x86_64
kernel6.12-modules-extra-6.12.100-125.179.amzn2023.x86_64
perf6.12-debuginfo-6.12.100-125.179.amzn2023.x86_64
kernel6.12-headers-6.12.100-125.179.amzn2023.x86_64
kernel6.12-debuginfo-common-x86_64-6.12.100-125.179.amzn2023.x86_64
python3-perf6.12-debuginfo-6.12.100-125.179.amzn2023.x86_64
kernel6.12-tools-6.12.100-125.179.amzn2023.x86_64
kernel6.12-modules-extra-common-6.12.100-125.179.amzn2023.x86_64
bpftool6.12-debuginfo-6.12.100-125.179.amzn2023.x86_64
kernel-livepatch-6.12.100-125.179-1.0-0.amzn2023.x86_64
kernel6.12-tools-debuginfo-6.12.100-125.179.amzn2023.x86_64
kernel6.12-tools-devel-6.12.100-125.179.amzn2023.x86_64
python3-perf6.12-6.12.100-125.179.amzn2023.x86_64
perf6.12-6.12.100-125.179.amzn2023.x86_64
kernel6.12-6.12.100-125.179.amzn2023.x86_64
kernel6.12-debuginfo-6.12.100-125.179.amzn2023.x86_64
kernel6.12-devel-6.12.100-125.179.amzn2023.x86_64