Amazon Linux 2 (EOS) Security Advisory: ALAS2KERNEL-5.15-2026-119
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
fou: Fix use-after-free in fou_create() (CVE-2026-74496)
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (CVE-2026-80726)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (CVE-2026-89796)
In the Linux kernel, the following vulnerability has been resolved:
i2c: smbus: reject oversized block transfers in the common path (CVE-2026-93287)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate idmap key payload length (CVE-2026-93785)
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix leaks and online flag on radix_tree_insert failure (CVE-2026-93795)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix reloc root cleanup in merge_reloc_roots() (CVE-2026-93798)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (CVE-2026-93800)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (CVE-2026-97416)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
In the Linux kernel, the following vulnerability has been resolved:
bpf: NUL-terminate replaced sysctl value (CVE-2026-97420)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421)
In the Linux kernel, the following vulnerability has been resolved:
xhci: Prevent queuing new commands if xhci is inaccessible (CVE-2026-97430)
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() (CVE-2026-97437)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate index entry key bounds (CVE-2026-97438)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (CVE-2026-97439)
In the Linux kernel, the following vulnerability has been resolved:
ata: ahci: fail probe if BAR too small for claimed ports (CVE-2026-97441)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: add boundary checks in two places (CVE-2026-97444)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (CVE-2026-97445)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (CVE-2026-97446)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Add validation for node in acpi_ns_build_normalized_path() (CVE-2026-97448)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Add package limit checks in parser functions (CVE-2026-97449)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: validate handler object type in two places (CVE-2026-97450)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (CVE-2026-97451)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Prevent adding invalid references (CVE-2026-97452)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: validate byte_count in acpi_ps_get_next_package_length() (CVE-2026-97453)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: add boundary checks in acpi_ps_get_next_field() (CVE-2026-97454)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (CVE-2026-97455)
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix condition check in acpi_ps_parse_loop() (CVE-2026-97456)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrconf: fix temp address generation after prefix deprecation (CVE-2026-97472)
In the Linux kernel, the following vulnerability has been resolved:
rds: filter RDS_INFO_* getsockopt by caller's netns (CVE-2026-97476)
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250: fix possible ISR soft lockup (CVE-2026-97481)
In the Linux kernel, the following vulnerability has been resolved:
usb: core: hcd: fix possible deadlock in rh control transfers (CVE-2026-97483)
In the Linux kernel, the following vulnerability has been resolved:
usbip: vhci_hcd: fix NULL deref in status_show_vhci (CVE-2026-97484)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: close race between scheduler and state change (CVE-2026-97523)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid unneeded actions on subflow reset (CVE-2026-97524)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: syncookies: remember the request backup flag (CVE-2026-97568)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reject invalid states in connection template sync records (CVE-2026-97596)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: bound automatic table ID allocation (CVE-2026-97598)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_log: unregister loggers before per-net teardown (CVE-2026-97608)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix use-after-free of the flow table mask array (CVE-2026-97611)
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: clear inner_protocol when the last label is popped (CVE-2026-97612)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix memory leak in query_perf_config_list() (CVE-2026-97899)
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: initialize policy rwsem before sysfs publication (CVE-2026-97904)
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: zero-initialize policy cpumask before sysfs publication (CVE-2026-97905)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (CVE-2026-97951)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). (CVE-2026-97958)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_route: free emptied bucket on filter move (CVE-2026-97959)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_log: cope with concurrent instance destruction (CVE-2026-97998)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: drr: clamp quantum in change class (CVE-2026-98010)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: clamp quantum in change and init paths (CVE-2026-98011)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sfq: clamp quantum in change path (CVE-2026-98012)
In the Linux kernel, the following vulnerability has been resolved:
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (CVE-2026-98022)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: reject dynamic fdb entries that reference a nexthop id (CVE-2026-98023)
In the Linux kernel, the following vulnerability has been resolved:
nexthop: Initialize extack in remove_nh_grp_entry() (CVE-2026-98031)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL-ptr-deref in btf_var_show() (CVE-2026-98063)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL-ptr-deref when showing a void BTF type (CVE-2026-98064)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: don't let rds_conn_shutdown() consume a concurrent drop (CVE-2026-98068)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: acquire the fastpath locks in rds_conn_shutdown() (CVE-2026-98069)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (CVE-2026-98070)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: clear cp_flags bits individually in rds_conn_path_reset() (CVE-2026-98071)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: use wq_has_sleeper() in release_in_xmit() (CVE-2026-98072)
In the Linux kernel, the following vulnerability has been resolved:
bonding: do not clear curr_active_slave prematurely when releasing all slaves (CVE-2026-98074)
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject BPF_PSEUDO_FUNC reference to the main program (CVE-2026-98075)
In the Linux kernel, the following vulnerability has been resolved:
tracing/probes: Fix use-after-free on field name/type of events with multiple probes (CVE-2026-98076)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix reversed sequence option serialization (CVE-2026-98078)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not force reloc root creation during qgroup_account_snapshot() (CVE-2026-98080)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: restore active device pointers after failed sprout (CVE-2026-98090)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: detach failed sprout device from transaction update list (CVE-2026-98091)
In the Linux kernel, the following vulnerability has been resolved:
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (CVE-2026-98095)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: restore network header before routing and forwarding (CVE-2026-98096)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (CVE-2026-98123)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130)
In the Linux kernel, the following vulnerability has been resolved:
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation (CVE-2026-98157)
In the Linux kernel, the following vulnerability has been resolved:
Input: zero ff_effect before compat copy in input_ff_effect_from_user (CVE-2026-98201)
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - zero absinfo before partial copy in EVIOCSABS (CVE-2026-98205)
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: Fix tpm2_load_cmd() boundary check (CVE-2026-98221)
In the Linux kernel, the following vulnerability has been resolved:
net/packet: clear RX owner on VNET header error (CVE-2026-98233)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: cap hh_flows_limit at change time (CVE-2026-98234)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: xfrm: use full sockets in local error paths (CVE-2026-98241)
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: avoid reallocating confirmed conntrack labels (CVE-2026-98251)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (CVE-2026-98252)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Serialize join and leave on copy_to_user failure (CVE-2026-98253)
In the Linux kernel, the following vulnerability has been resolved:
tcp: exclude old ACKs from tcp fast path (CVE-2026-98255)
In the Linux kernel, the following vulnerability has been resolved:
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (CVE-2026-98262)
In the Linux kernel, the following vulnerability has been resolved:
net: lock the socket in sock_gettstamp() (CVE-2026-98276)
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not let tcp_rmem be set below 4096 (CVE-2026-98299)
In the Linux kernel, the following vulnerability has been resolved:
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (CVE-2026-98300)
In the Linux kernel, the following vulnerability has been resolved:
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (CVE-2026-98306)
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (CVE-2026-98319)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_nat: fully initialise new_addr in netmap setup (CVE-2026-98322)
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: wait for RCU readers before releasing dma_device (CVE-2026-98342)
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (CVE-2026-98343)
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix device kref underflow in dma_chan_put() (CVE-2026-98344)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mad: Fix receive buffer leak when PKey enforcement fails (CVE-2026-98354)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (CVE-2026-98363)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (CVE-2026-98369)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (CVE-2026-98374)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev (CVE-2026-98379)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions (CVE-2026-98380)
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize (CVE-2026-98381)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (CVE-2026-98383)
In the Linux kernel, the following vulnerability has been resolved:
exec: do_close_on_exec() before taking exec_update_lock (CVE-2026-98388)
In the Linux kernel, the following vulnerability has been resolved:
selinux: always fill AVC decision in avc_has_perm_noaudit() (CVE-2026-98413)
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (CVE-2026-98479)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)
In the Linux kernel, the following vulnerability has been resolved:
net: arp: terminate device name before lookup (CVE-2026-98495)
In the Linux kernel, the following vulnerability has been resolved:
llc: reserve device headroom for allocated frames (CVE-2026-98526)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (CVE-2026-98531)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix NULL current_pwq deref in flush dependency check (CVE-2026-98537)
In the Linux kernel, the following vulnerability has been resolved:
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (CVE-2026-98541)
In the Linux kernel, the following vulnerability has been resolved:
af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (CVE-2026-98547)
In the Linux kernel, the following vulnerability has been resolved:
autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (CVE-2026-98553)
In the Linux kernel, the following vulnerability has been resolved:
vlan: ensure sufficient headroom in vlan_dev_hard_header() (CVE-2026-98554)
In the Linux kernel, the following vulnerability has been resolved:
net: xps: reject an out of range traffic class (CVE-2026-98567)
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (CVE-2026-98573)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (CVE-2026-98588)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bpf_sock context code generation (CVE-2026-98590)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (CVE-2026-98610)
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid livelock while updating retransmit path (CVE-2026-98614)
In the Linux kernel, the following vulnerability has been resolved:
net: gue: reject invalid REMCSUM offsets (CVE-2026-98621)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (CVE-2026-98624)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish HW_DEAD after worker is done (CVE-2026-98625)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Restrict CO-RE poisoning to relocatable instructions (CVE-2026-98626)
In the Linux kernel, the following vulnerability has been resolved:
squashfs: Add dictionary size range check to prevent shift-out-of-bounds (CVE-2026-98636)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of rtt_min in sock_ops (CVE-2026-98643)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (CVE-2026-98644)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix divide-by-zero in btf_struct_walk() (CVE-2026-98647)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel or yum update --advisory ALAS2KERNEL-5.15-2026-119 to update your system.
System reboot is required in order to complete this update.
aarch64:
kernel-5.15.222-158.255.amzn2.aarch64
kernel-headers-5.15.222-158.255.amzn2.aarch64
kernel-debuginfo-common-aarch64-5.15.222-158.255.amzn2.aarch64
perf-5.15.222-158.255.amzn2.aarch64
perf-debuginfo-5.15.222-158.255.amzn2.aarch64
python-perf-5.15.222-158.255.amzn2.aarch64
python-perf-debuginfo-5.15.222-158.255.amzn2.aarch64
kernel-tools-5.15.222-158.255.amzn2.aarch64
kernel-tools-devel-5.15.222-158.255.amzn2.aarch64
kernel-tools-debuginfo-5.15.222-158.255.amzn2.aarch64
bpftool-5.15.222-158.255.amzn2.aarch64
bpftool-debuginfo-5.15.222-158.255.amzn2.aarch64
kernel-devel-5.15.222-158.255.amzn2.aarch64
kernel-debuginfo-5.15.222-158.255.amzn2.aarch64
kernel-livepatch-5.15.222-158.255-1.0-0.amzn2.aarch64
i686:
kernel-headers-5.15.222-158.255.amzn2.i686
src:
kernel-5.15.222-158.255.amzn2.src
x86_64:
kernel-5.15.222-158.255.amzn2.x86_64
kernel-headers-5.15.222-158.255.amzn2.x86_64
kernel-debuginfo-common-x86_64-5.15.222-158.255.amzn2.x86_64
perf-5.15.222-158.255.amzn2.x86_64
perf-debuginfo-5.15.222-158.255.amzn2.x86_64
python-perf-5.15.222-158.255.amzn2.x86_64
python-perf-debuginfo-5.15.222-158.255.amzn2.x86_64
kernel-tools-5.15.222-158.255.amzn2.x86_64
kernel-tools-devel-5.15.222-158.255.amzn2.x86_64
kernel-tools-debuginfo-5.15.222-158.255.amzn2.x86_64
bpftool-5.15.222-158.255.amzn2.x86_64
bpftool-debuginfo-5.15.222-158.255.amzn2.x86_64
kernel-devel-5.15.222-158.255.amzn2.x86_64
kernel-debuginfo-5.15.222-158.255.amzn2.x86_64
kernel-livepatch-5.15.222-158.255-1.0-0.amzn2.x86_64