Amazon Linux 2023 Security Advisory: ALAS2023-2026-2143
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
When CONFIG_BPF_LSM=y is set, BPF inode storage maps
(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
from the "lsm=" boot parameter), lsm_prepare() is never executed for
the BPF LSM.
Consequently, the BPF inode security blob offset
(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at
its default compiled size of 8 bytes instead of being updated to a
valid offset past the reserved struct rcu_head (typically 16 bytes
or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE
map, bpf_inode() evaluates inode->i_security + 8. This erroneously
aliases the struct rcu_head.func callback pointer at the beginning
of the inode->i_security blob. During subsequent map element cleanup
or inode destruction, writing NULL to owner_storage clears the queued
RCU callback pointer. When rcu_do_batch() later executes the queued
callback, it attempts an instruction fetch at address 0x0, triggering
an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag
marked with __ro_after_init. Set this flag to true inside bpf_lsm_init()
when the LSM framework successfully registers the BPF LSM. Gate map
allocation in inode_storage_map_alloc() on this flag, returning
-EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode
storage maps when the supporting BPF LSM infrastructure is absent,
avoiding zombie map states. (CVE-2026-64192)
In the Linux kernel, the following vulnerability has been resolved:
mm: do file ownership checks with the proper mount idmap (CVE-2026-64294)
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Support for hardening against JIT spraying (CVE-2026-64508)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543)
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Detach event groups during remove_on_exec
perf_event_remove_on_exec() removes events by calling
perf_event_exit_event(). For top-level events, this removes the event from
the context with DETACH_EXIT only.
This can leave inconsistent group state when a removed event is a group
leader and the group contains siblings without remove_on_exec. If the group
was active, the surviving siblings can remain active and attached to the
removed leader's sibling list, but are no longer represented by a valid
group leader on the PMU context active lists.
A later close of the removed leader uses DETACH_GROUP and can promote the
still-active siblings from this stale group state. The next schedule-in can
then add an already-linked active_list entry again, corrupting the PMU
context active list.
With DEBUG_LIST enabled, this is caught as a list_add double-add in
merge_sched_in().
Fix this by detaching group relationships when remove_on_exec removes an
event. This preserves the existing task-exit and revoke behavior, while
ensuring surviving siblings are ungrouped before the removed event leaves
the context. (CVE-2026-64556)
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)
In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject free space cache with more entries than pages (CVE-2026-64567)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
In the Linux kernel, the following vulnerability has been resolved:
nexthop: initialize extack in nh_res_bucket_migrate() (CVE-2026-64576)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579)
In the Linux kernel, the following vulnerability has been resolved:
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (CVE-2026-64580)
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (CVE-2026-68093)
In the Linux kernel, the following vulnerability has been resolved:
audit: fix recursive locking deadlock in audit_dupe_exe() (CVE-2026-68096)
In the Linux kernel, the following vulnerability has been resolved:
tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
In the Linux kernel, the following vulnerability has been resolved:
pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
In the Linux kernel, the following vulnerability has been resolved:
ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127)
In the Linux kernel, the following vulnerability has been resolved:
super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)
In the Linux kernel, the following vulnerability has been resolved:
net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)
In the Linux kernel, the following vulnerability has been resolved:
geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142)
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146)
In the Linux kernel, the following vulnerability has been resolved:
libceph: remove debugfs files before client teardown (CVE-2026-68153)
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject zero bucket types in crush_decode (CVE-2026-68154)
In the Linux kernel, the following vulnerability has been resolved:
libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
In the Linux kernel, the following vulnerability has been resolved:
libceph: guard missing CRUSH type name lookup (CVE-2026-68157)
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158)
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: disallow overlapping input ranges for damon_set_regions() (CVE-2026-68164)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: validate ranges in damon_set_regions() (CVE-2026-68165)
In the Linux kernel, the following vulnerability has been resolved:
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (CVE-2026-68184)
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: set have_execfd only once the interpreter is opened (CVE-2026-68186)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (CVE-2026-68243)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Do not leak siblings[] on proto context error (CVE-2026-68244)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Return NULL on error in active_instance (CVE-2026-68248)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: bound EDID block reads to the response buffer (CVE-2026-68255)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Add missing nospec on parallel submit slot (CVE-2026-68269)
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (CVE-2026-68277)
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (CVE-2026-68279)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297)
In the Linux kernel, the following vulnerability has been resolved:
sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313)
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320)
In the Linux kernel, the following vulnerability has been resolved:
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322)
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Bound the early ACPI HID map (CVE-2026-68325)
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix devconf_all NULL dereference when IPv6 is disabled (CVE-2026-68336)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Reject unhashed UDP sockets on sockmap update (CVE-2026-68386)
In the Linux kernel, the following vulnerability has been resolved:
smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (CVE-2026-68422)
In the Linux kernel, the following vulnerability has been resolved:
IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Fix use-after-free on vendor module reload (CVE-2026-68428)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound get_version reply decode to front len (CVE-2026-68433)
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate vmw_surface_metadata::array_size (CVE-2026-68446)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free mapping node on duplicate reloc root insert (CVE-2026-68450)
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-core: Reject an invalid concurrent positioning ranges count (CVE-2026-72030)
In the Linux kernel, the following vulnerability has been resolved:
ipmi: fix refcount leak in i_ipmi_request() (CVE-2026-72040)
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: make error counter atomic (CVE-2026-72096)
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
In the Linux kernel, the following vulnerability has been resolved:
bpf,fork: wipe ->bpf_storage before bailouts that access it (CVE-2026-72110)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing device refcount for CAN filter removal (CVE-2026-72113)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: validate frame length in bcm_rx_setup() for RTR replies (CVE-2026-72114)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: track a single source interface for ANYDEV timeout/throttle ops (CVE-2026-72115)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix stale rx/tx ops after device removal (CVE-2026-72116)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() (CVE-2026-72117)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix CAN frame rx/tx statistics (CVE-2026-72118)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: extend bcm_tx_lock usage for data and timer updates (CVE-2026-72119)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add locking when updating filter and timer values (CVE-2026-72121)
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172)
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: validate split-point offset in indx_insert_into_buffer (CVE-2026-72191)
In the Linux kernel, the following vulnerability has been resolved:
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (CVE-2026-72253)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
In the Linux kernel, the following vulnerability has been resolved:
tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392)
In the Linux kernel, the following vulnerability has been resolved:
sctp: add INIT verification after cookie unpacking (CVE-2026-72398)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347)
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: bound DMA command body size against suffix pointer (CVE-2026-74443)
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (CVE-2026-74444)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465)
In the Linux kernel, the following vulnerability has been resolved:
sctp: prevent peer transport count overflow (CVE-2026-74469)
In the Linux kernel, the following vulnerability has been resolved:
tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475)
In the Linux kernel, the following vulnerability has been resolved:
veth: convert frag_list skbs before running XDP (CVE-2026-74476)
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)
In the Linux kernel, the following vulnerability has been resolved:
mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481)
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482)
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: reject a flag character as the field delimiter (CVE-2026-74485)
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
In the Linux kernel, the following vulnerability has been resolved:
tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492)
In the Linux kernel, the following vulnerability has been resolved:
audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: don't free uninitialized dev_name on error path (CVE-2026-74519)
In the Linux kernel, the following vulnerability has been resolved:
net: do not send ICMP/NDISC Redirects when peer allocation fails (CVE-2026-74550)
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557)
In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)
In the Linux kernel, the following vulnerability has been resolved:
keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566)
In the Linux kernel, the following vulnerability has been resolved:
keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute() (CVE-2026-74577)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579)
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581)
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
In the Linux kernel, the following vulnerability has been resolved:
sctp: clear new_transport when removing a peer (CVE-2026-74586)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587)
In the Linux kernel, the following vulnerability has been resolved:
sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589)
In the Linux kernel, the following vulnerability has been resolved:
sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)
In the Linux kernel, the following vulnerability has been resolved:
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595)
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (CVE-2026-74597)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix Route Information option length validation (CVE-2026-74598)
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifs_try_adding_channels() (CVE-2026-74608)
In the Linux kernel, the following vulnerability has been resolved:
tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609)
In the Linux kernel, the following vulnerability has been resolved:
veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: avoid refilling the RX queue after teardown (CVE-2026-74613)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: read virtqueues under worker locks (CVE-2026-74614)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615)
In the Linux kernel, the following vulnerability has been resolved:
xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: defer invalid log until after unlock (CVE-2026-74624)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630)
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bitblit: bound-check glyph index in bit_cursor() (CVE-2026-74635)
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636)
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_dma: Clear stale RX state on shutdown (CVE-2026-74654)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fix use-after-free in fib_nhc_update_mtu() (CVE-2026-74656)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent robust futex exit race some more (CVE-2026-74658)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660)
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: publish queues before arming timer (CVE-2026-74662)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: reallocate update replies for mismatched IDs (CVE-2026-74664)
In the Linux kernel, the following vulnerability has been resolved:
packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)
In the Linux kernel, the following vulnerability has been resolved:
net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667)
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
In the Linux kernel, the following vulnerability has been resolved:
ima: fix out-of-bounds read in xattr_verify() (CVE-2026-74671)
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (CVE-2026-74672)
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - fix information leak in evdev_pass_values() (CVE-2026-74673)
In the Linux kernel, the following vulnerability has been resolved:
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (CVE-2026-74675)
In the Linux kernel, the following vulnerability has been resolved:
vt: add permission check for KDSKBMETA ioctl (CVE-2026-74676)
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - sanitize event type index when fetching event masks (CVE-2026-74683)
In the Linux kernel, the following vulnerability has been resolved:
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684)
In the Linux kernel, the following vulnerability has been resolved:
sctp: clear control chunk transport if it is being removed (CVE-2026-74688)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix TFO max_qlen accounting across reuseport migration (CVE-2026-74696)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700)
In the Linux kernel, the following vulnerability has been resolved:
net/openvswitch: check Ethernet header length in key_extract() (CVE-2026-74701)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (CVE-2026-74704)
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
In the Linux kernel, the following vulnerability has been resolved:
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (CVE-2026-74714)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: fw_tracer, return NULL on create error (CVE-2026-74717)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic (CVE-2026-74720)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix memory leak in btrfs_do_encoded_write() (CVE-2026-74722)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (CVE-2026-74724)
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (CVE-2026-74726)
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (CVE-2026-74730)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_u32: skip hash tables in u32_bind_class() (CVE-2026-74739)
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743)
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix refcount race between list:set GC and swap (CVE-2026-74748)
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix hanging __ceph_get_caps() with stale mds_wanted (CVE-2026-80527)
In the Linux kernel, the following vulnerability has been resolved:
ceph: avoid fs reclaim while using current->journal_info (CVE-2026-80528)
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't swallow dquot recovery verification errors (CVE-2026-80529)
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534)
In the Linux kernel, the following vulnerability has been resolved:
xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557)
In the Linux kernel, the following vulnerability has been resolved:
libceph: Avoid using invalid osd indices from primary_temp (CVE-2026-80558)
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix multiple unsafe decodes in decode_locker() (CVE-2026-80561)
In the Linux kernel, the following vulnerability has been resolved:
Input: byd - synchronize timer deletion before freeing private data (CVE-2026-80572)
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (CVE-2026-80574)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
In the Linux kernel, the following vulnerability has been resolved:
block: stop the timeout timer when releasing a never added disk (CVE-2026-80589)
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: re-fetch eth header after route_shortcircuit() (CVE-2026-80681)
In the Linux kernel, the following vulnerability has been resolved:
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (CVE-2026-80686)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: do not propagate one-packet flag to synced conns (CVE-2026-80714)
In the Linux kernel, the following vulnerability has been resolved:
igc: remove napi_synchronize() in igc_down() (CVE-2026-80715)
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate Adaptation Indication parameter length (CVE-2026-80717)
In the Linux kernel, the following vulnerability has been resolved:
net: gro: properly validate BIG TCP aggregation criteria (CVE-2026-80725)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (CVE-2026-80726)
In the Linux kernel, the following vulnerability has been resolved:
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (CVE-2026-80731)
In the Linux kernel, the following vulnerability has been resolved:
net: remove WARN_ON_ONCE() from sk_mc_loop() (CVE-2026-80733)
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737)
In the Linux kernel, the following vulnerability has been resolved:
af_packet: Don't send zero-byte data in tpacket_snd(). (CVE-2026-80742)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (CVE-2026-80744)
In the Linux kernel, the following vulnerability has been resolved:
selinux: do not cancel a policy conversion that never started (CVE-2026-80756)
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a class permission count below its inherited common (CVE-2026-80757)
In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv: validate initial device info bounds (CVE-2026-80765)
In the Linux kernel, the following vulnerability has been resolved:
HID: core: fix OOB read of field->usage in hid_set_field() (CVE-2026-80781)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793)
In the Linux kernel, the following vulnerability has been resolved:
xfs: validate attr entry pointer before field access (CVE-2026-80805)
In the Linux kernel, the following vulnerability has been resolved:
ext4: stop retrying saturated xattr cache entries (CVE-2026-80808)
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (CVE-2026-80888)
In the Linux kernel, the following vulnerability has been resolved:
sctp: reject stale cookies with mismatched verification tags (CVE-2026-80890)
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (CVE-2026-80893)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix the checksum validations (CVE-2026-80901)
In the Linux kernel, the following vulnerability has been resolved:
net/tls: Fail tls_sw_splice_read() after a failed async decrypt (CVE-2026-80904)
In the Linux kernel, the following vulnerability has been resolved:
net: packet: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80906)
In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined (CVE-2026-80913)
Affected Packages:
kernel
Issue Correction:
Run dnf update kernel --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2143 --releasever 2023.12.20260914 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
kernel-headers-6.1.186-228.374.amzn2023.aarch64
kernel-modules-extra-6.1.186-228.374.amzn2023.aarch64
kernel-tools-debuginfo-6.1.186-228.374.amzn2023.aarch64
kernel-tools-devel-6.1.186-228.374.amzn2023.aarch64
perf-6.1.186-228.374.amzn2023.aarch64
bpftool-6.1.186-228.374.amzn2023.aarch64
kernel-tools-6.1.186-228.374.amzn2023.aarch64
python3-perf-debuginfo-6.1.186-228.374.amzn2023.aarch64
kernel-livepatch-6.1.186-228.374-1.0-0.amzn2023.aarch64
python3-perf-6.1.186-228.374.amzn2023.aarch64
kernel-6.1.186-228.374.amzn2023.aarch64
kernel-debuginfo-6.1.186-228.374.amzn2023.aarch64
perf-debuginfo-6.1.186-228.374.amzn2023.aarch64
bpftool-debuginfo-6.1.186-228.374.amzn2023.aarch64
kernel-modules-extra-common-6.1.186-228.374.amzn2023.aarch64
kernel-debuginfo-common-aarch64-6.1.186-228.374.amzn2023.aarch64
kernel-devel-6.1.186-228.374.amzn2023.aarch64
src:
kernel-6.1.186-228.374.amzn2023.src
x86_64:
kernel-debuginfo-6.1.186-228.374.amzn2023.x86_64
perf-debuginfo-6.1.186-228.374.amzn2023.x86_64
kernel-modules-extra-6.1.186-228.374.amzn2023.x86_64
python3-perf-debuginfo-6.1.186-228.374.amzn2023.x86_64
kernel-tools-6.1.186-228.374.amzn2023.x86_64
bpftool-6.1.186-228.374.amzn2023.x86_64
perf-6.1.186-228.374.amzn2023.x86_64
kernel-modules-extra-common-6.1.186-228.374.amzn2023.x86_64
bpftool-debuginfo-6.1.186-228.374.amzn2023.x86_64
kernel-tools-devel-6.1.186-228.374.amzn2023.x86_64
python3-perf-6.1.186-228.374.amzn2023.x86_64
kernel-livepatch-6.1.186-228.374-1.0-0.amzn2023.x86_64
kernel-headers-6.1.186-228.374.amzn2023.x86_64
kernel-tools-debuginfo-6.1.186-228.374.amzn2023.x86_64
kernel-6.1.186-228.374.amzn2023.x86_64
kernel-debuginfo-common-x86_64-6.1.186-228.374.amzn2023.x86_64
kernel-devel-6.1.186-228.374.amzn2023.x86_64