ALAS2023-2026-3389

Amazon Linux 2023 Security Advisory: ALAS2023-2026-3389
Advisory Released Date: 2026-11-09
Advisory Updated Date: 2026-11-09

Severity: Important

References: CVE-2026-74356 CVE-2026-74752 CVE-2026-89633 CVE-2026-89659 CVE-2026-90036 CVE-2026-97563 CVE-2026-98033 CVE-2026-98454 CVE-2026-98715 CVE-2026-98805 CVE-2026-98846 CVE-2026-98857 CVE-2026-99053 CVE-2026-99082
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

vhost: fix vhost_get_avail_idx for a non empty ring (CVE-2026-74356)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use (CVE-2026-74752)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during delegation revoke (CVE-2026-89659)

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (CVE-2026-97563)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve inner map identity in callback frames (CVE-2026-98033)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads (CVE-2026-98454)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (CVE-2026-98715)

In the Linux kernel, the following vulnerability has been resolved:

tipc: prevent GCM nonce reuse on peer key changes (CVE-2026-98805)

In the Linux kernel, the following vulnerability has been resolved:

sctp: check RCV_SHUTDOWN after the sendmsg connect wait (CVE-2026-98846)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: bound LBLCR and LBLC cache growth (CVE-2026-98857)

In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name (CVE-2026-99053)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use active memslots for the per-vCPU MMIO cache (CVE-2026-99082)

Affected Packages:

kernel

Issue Correction:
Run dnf update kernel --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3389 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    microvm-kernel-6.1.190-237.431.amzn2023.aarch64
    kernel-headers-6.1.190-237.431.amzn2023.aarch64
    kernel-livepatch-6.1.190-237.431-1.0-0.amzn2023.aarch64
    kernel-tools-devel-6.1.190-237.431.amzn2023.aarch64
    perf-6.1.190-237.431.amzn2023.aarch64
    kernel-tools-6.1.190-237.431.amzn2023.aarch64
    python3-perf-debuginfo-6.1.190-237.431.amzn2023.aarch64
    bpftool-debuginfo-6.1.190-237.431.amzn2023.aarch64
    kernel-tools-debuginfo-6.1.190-237.431.amzn2023.aarch64
    kernel-modules-extra-6.1.190-237.431.amzn2023.aarch64
    python3-perf-6.1.190-237.431.amzn2023.aarch64
    kernel-modules-extra-common-6.1.190-237.431.amzn2023.aarch64
    perf-debuginfo-6.1.190-237.431.amzn2023.aarch64
    bpftool-6.1.190-237.431.amzn2023.aarch64
    kernel-6.1.190-237.431.amzn2023.aarch64
    kernel-debuginfo-6.1.190-237.431.amzn2023.aarch64
    kernel-debuginfo-common-aarch64-6.1.190-237.431.amzn2023.aarch64
    kernel-devel-6.1.190-237.431.amzn2023.aarch64

src:
    kernel-6.1.190-237.431.amzn2023.src

x86_64:
    kernel-debuginfo-6.1.190-237.431.amzn2023.x86_64
    kernel-debuginfo-common-x86_64-6.1.190-237.431.amzn2023.x86_64
    python3-perf-6.1.190-237.431.amzn2023.x86_64
    bpftool-debuginfo-6.1.190-237.431.amzn2023.x86_64
    bpftool-6.1.190-237.431.amzn2023.x86_64
    perf-debuginfo-6.1.190-237.431.amzn2023.x86_64
    kernel-headers-6.1.190-237.431.amzn2023.x86_64
    kernel-tools-debuginfo-6.1.190-237.431.amzn2023.x86_64
    microvm-kernel-6.1.190-237.431.amzn2023.x86_64
    perf-6.1.190-237.431.amzn2023.x86_64
    kernel-tools-devel-6.1.190-237.431.amzn2023.x86_64
    kernel-modules-extra-common-6.1.190-237.431.amzn2023.x86_64
    python3-perf-debuginfo-6.1.190-237.431.amzn2023.x86_64
    kernel-livepatch-6.1.190-237.431-1.0-0.amzn2023.x86_64
    kernel-tools-6.1.190-237.431.amzn2023.x86_64
    kernel-modules-extra-6.1.190-237.431.amzn2023.x86_64
    kernel-6.1.190-237.431.amzn2023.x86_64
    kernel-devel-6.1.190-237.431.amzn2023.x86_64

Additional References

Release Notes: Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-74356, CVE-2026-74752, CVE-2026-89633, CVE-2026-89659, CVE-2026-90036, CVE-2026-97563, CVE-2026-98033, CVE-2026-98454, CVE-2026-98715, CVE-2026-98805, CVE-2026-98846, CVE-2026-98857, CVE-2026-99053, CVE-2026-99082

Mitre: CVE-2026-74356, CVE-2026-74752, CVE-2026-89633, CVE-2026-89659, CVE-2026-90036, CVE-2026-97563, CVE-2026-98033, CVE-2026-98454, CVE-2026-98715, CVE-2026-98805, CVE-2026-98846, CVE-2026-98857, CVE-2026-99053, CVE-2026-99082