ALAS2-2026-3927

References: CVE-2026-0799  CVE-2026-31911  CVE-2026-6244  CVE-2026-6554 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures. (CVE-2026-0799)

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. (CVE-2026-31911)

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. (CVE-2026-6244)

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. (CVE-2026-6554)

Issue Correction:
Run yum update libpcap or yum update --advisory ALAS2-2026-3927 to update your system.

New Packages:

aarch64:
    libpcap-1.5.3-11.amzn2.0.1.aarch64
    libpcap-devel-1.5.3-11.amzn2.0.1.aarch64
    libpcap-debuginfo-1.5.3-11.amzn2.0.1.aarch64

i686:
    libpcap-1.5.3-11.amzn2.0.1.i686
    libpcap-devel-1.5.3-11.amzn2.0.1.i686
    libpcap-debuginfo-1.5.3-11.amzn2.0.1.i686

src:
    libpcap-1.5.3-11.amzn2.0.1.src

x86_64:
    libpcap-1.5.3-11.amzn2.0.1.x86_64
    libpcap-devel-1.5.3-11.amzn2.0.1.x86_64
    libpcap-debuginfo-1.5.3-11.amzn2.0.1.x86_64