Amazon Linux 2023 Security Advisory: ALAS2023-2026-1894
Advisory Released Date: 2026-06-22
Advisory Updated Date: 2026-07-29
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
In the Linux kernel, the following vulnerability has been resolved:
rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
In the Linux kernel, the following vulnerability has been resolved:
net: ioam6: fix OOB and missing lock (CVE-2026-43083)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
In the Linux kernel, the following vulnerability has been resolved:
ntfs: ->d_compare() must not block (CVE-2026-43245)
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix end-of-list detection in cgroup_storage_get_next_key() (CVE-2026-45838)
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839)
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841)
In the Linux kernel, the following vulnerability has been resolved:
slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842)
In the Linux kernel, the following vulnerability has been resolved:
slip: bound decode() reads against the compressed packet length (CVE-2026-45843)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
In the Linux kernel, the following vulnerability has been resolved:
io-wq: check that the predecessor is hashed in io_wq_remove_pending() (CVE-2026-46274)
In the Linux kernel, the following vulnerability has been resolved:
io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)
In the Linux kernel, the following vulnerability has been resolved:
vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925)
In the Linux kernel, the following vulnerability has been resolved:
crypto: jitterentropy - replace long-held spinlock with mutex (CVE-2026-52936)
In the Linux kernel, the following vulnerability has been resolved:
libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954)
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955)
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957)
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958)
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961)
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962)
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix possible infinite loop and oob read in symlink_data() (CVE-2026-52967)
In the Linux kernel, the following vulnerability has been resolved:
KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970)
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974)
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977)
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Clear rel_deadline when initializing forked entities (CVE-2026-52980)
In the Linux kernel, the following vulnerability has been resolved:
neigh: let neigh_xmit take skb ownership (CVE-2026-52981)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: netem: fix queue limit check to include reordered packets
The queue limit check in netem_enqueue() uses q->t_len which only
counts packets in the internal tfifo. Packets placed in sch->q by
the reorder path (__qdisc_enqueue_head) are not counted, allowing
the total queue occupancy to exceed sch->limit under reordering.
Include sch->q.qlen in the limit check. (CVE-2026-52984)
In the Linux kernel, the following vulnerability has been resolved:
netdevsim: zero initialize struct iphdr in dummy sk_buff (CVE-2026-52985)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
In the Linux kernel, the following vulnerability has been resolved:
fsnotify: fix inode reference leak in fsnotify_recalc_mask() (CVE-2026-52990)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: restrict several matches to inet family (CVE-2026-53001)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames (CVE-2026-53003)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb (CVE-2026-53009)
In the Linux kernel, the following vulnerability has been resolved:
nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012)
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir (CVE-2026-53014)
In the Linux kernel, the following vulnerability has been resolved:
erofs: unify lcn as u64 for 32-bit platforms (CVE-2026-53015)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: terminate the cached volume label after UTF-8 conversion (CVE-2026-53023)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Validate node_id in arena_alloc_pages() (CVE-2026-53031)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix af_unix null-ptr-deref in proto update (CVE-2026-53034)
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035)
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix off-by-one in check_imm signed range check (CVE-2026-53036)
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix deadlock in hid_post_reset() (CVE-2026-53037)
In the Linux kernel, the following vulnerability has been resolved:
ima_fs: Correctly create securityfs files for unsupported hash algos (CVE-2026-53038)
In the Linux kernel, the following vulnerability has been resolved:
quota: Fix race of dquot_scan_active() with quota deactivation (CVE-2026-53050)
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
In the Linux kernel, the following vulnerability has been resolved:
dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)
In the Linux kernel, the following vulnerability has been resolved:
dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060)
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061)
In the Linux kernel, the following vulnerability has been resolved:
dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix write hang in passthrough mode (CVE-2026-53063)
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064)
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069)
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074)
In the Linux kernel, the following vulnerability has been resolved:
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix OOB in pcpu_init_value (CVE-2026-53076)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (CVE-2026-53081)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083)
In the Linux kernel, the following vulnerability has been resolved:
bpf: return VMA snapshot from task_vma iterator (CVE-2026-53084)
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix mm lifecycle in open-coded task_vma iterator (CVE-2026-53085)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096)
In the Linux kernel, the following vulnerability has been resolved:
bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111)
In the Linux kernel, the following vulnerability has been resolved:
platform/wmi: use generic driver_override infrastructure (CVE-2026-53119)
In the Linux kernel, the following vulnerability has been resolved:
PCI: use generic driver_override infrastructure (CVE-2026-53120)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122)
In the Linux kernel, the following vulnerability has been resolved:
md: wake raid456 reshape waiters before suspend (CVE-2026-53123)
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126)
In the Linux kernel, the following vulnerability has been resolved:
drbd: Balance RCU calls in drbd_adm_dump_devices() (CVE-2026-53128)
In the Linux kernel, the following vulnerability has been resolved:
fs/mbcache: cancel shrink work before destroying the cache (CVE-2026-53129)
In the Linux kernel, the following vulnerability has been resolved:
audit: fix incorrect inheritable capability in CAPSET records
__audit_log_capset() records the effective capability set into the
inheritable field due to a copy-paste error. Every CAPSET audit
record therefore reports cap_pi (process inheritable) with the value
of cap_effective instead of cap_inheritable.
This silently corrupts audit data used for compliance and forensic
analysis: an attacker who modifies inheritable capabilities to
prepare for a privilege-escalating exec would have the change masked
in the audit trail.
The bug has been present since the original introduction of CAPSET
audit records in 2008. (CVE-2026-53287)
In the Linux kernel, the following vulnerability has been resolved:
arm64: Reserve an extra page for early kernel mapping (CVE-2026-53288)
In the Linux kernel, the following vulnerability has been resolved:
ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289)
In the Linux kernel, the following vulnerability has been resolved:
mailbox: add sanity check for channel array
Fail gracefully if there is no channel array attached to the mailbox
controller. Otherwise the later dereference will cause an OOPS which
might not be seen because mailbox controllers might instantiate very
early. Remove the comment explaining the obvious while here. (CVE-2026-53295)
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Resolve soft lockup issue when opening /dev/sgX (CVE-2026-53304)
In the Linux kernel, the following vulnerability has been resolved:
padata: Put CPU offline callback in ONLINE section to allow failure
syzbot reported the following warning:
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")
which tglx traced to padata_cpu_dead() given it's the only
sub-CPUHP_TEARDOWN_CPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU
so move the CPU offline callback to the ONLINE section where failure is
possible. (CVE-2026-53314)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Prefer NLA_NUL_STRING
These attributes are evaluated as c-string (passed to strcmp), but
NLA_STRING doesn't check for the presence of a \0 terminator.
Either this needs to switch to nla_strcmp() and needs to adjust printf fmt
specifier to not use plain %s, or this needs to use NLA_NUL_STRING.
As the code has been this way for long time, it seems to me that userspace
does include the terminating nul, even tough its not enforced so far, and
thus NLA_NUL_STRING use is the simpler solution. (CVE-2026-63860)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (CVE-2026-63865)
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for. (CVE-2026-64015)
In the Linux kernel, the following vulnerability has been resolved:
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and
defers to psock->saved_data_ready when a TLS RX context is present,
avoiding a conflict with the TLS strparser's ownership of the receive
queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types
with ktls").
sk_psock_verdict_data_ready() has no equivalent guard. When a socket
is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is
configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready
as rx_ctx->saved_data_ready. On data arrival:
tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready
-> saved_data_ready() = sk_psock_verdict_data_ready()
-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()
without calling tcp_eat_skb(), so copied_seq is not advanced.
tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls
tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and
returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned
(potentially freed) skb. tls_decrypt_sg() subsequently walks that
frag_list: use-after-free.
Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context
is present, call psock->saved_data_ready (sock_def_readable) to wake
recv() waiters and return immediately, leaving the receive queue
untouched. TLS retains sole ownership of the queue and decrypts the
record normally through tls_sw_recvmsg(). (CVE-2026-64025)
In the Linux kernel, the following vulnerability has been resolved:
bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
In the Linux kernel, the following vulnerability has been resolved:
net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046)
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
When an sk_msg scatterlist ring wraps (sg.end < sg.start),
tls_push_record() chains the tail portion of the ring to the head
using sg_chain(). An extra entry in the sg array is reserved for
this:
struct sk_msg_sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];
The current code uses MAX_SKB_FRAGS + 1 as the ring size:
sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
MAX_SKB_FRAGS - msg_pl->sg.start + 1,
msg_pl->sg.data);
This places the chain pointer at
sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =
&data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =
data[start + (MAX_SKB_FRAGS - start + 1) - 1] =
data[MAX_SKB_FRAGS]
instead of the true last entry. This is likely due to a "race" of
the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")
Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested
by Sabrina). (CVE-2026-64047)
In the Linux kernel, the following vulnerability has been resolved:
block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052)
In the Linux kernel, the following vulnerability has been resolved:
block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio->private handling in netfs_perform_write() (CVE-2026-64059)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix early put of sink folio in netfs_read_gaps() (CVE-2026-64061)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix potential deadlock in write-through mode (CVE-2026-64062)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix streaming write being overwritten (CVE-2026-64063)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (CVE-2026-64064)
In the Linux kernel, the following vulnerability has been resolved:
netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call (CVE-2026-64065)
In the Linux kernel, the following vulnerability has been resolved:
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073)
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Free private_irqs when init fails after allocation (CVE-2026-64105)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports. The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.
Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device. This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range. (CVE-2026-64106)
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix busy dentry used after unmounting (CVE-2026-64108)
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)
In the Linux kernel, the following vulnerability has been resolved:
lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
In the Linux kernel, the following vulnerability has been resolved:
rbd: eliminate a race in lock_dwork draining on unmap (CVE-2026-64112)
In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: fix use-after-free in VEPA multicast source pruning
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's
own address (VEPA multicast workaround) by freeing the skb and
continuing to the next descriptor:
dev_kfree_skb_irq(skb);
continue;
The skb pointer is declared outside the while loop and persists across
iterations. Because the continue skips the "skb = NULL" reset at the
bottom of the loop, the next iteration enters the "else if (skb)" path
and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
The sibling driver iavf already handles this correctly by nulling the
pointer before continuing. Apply the same pattern here.
I do not have ixgbevf hardware; the bug was found by static analysis
(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
corroboration with the highest score in the scan). The UAF was confirmed
under KASAN by loading a test module that reproduces the exact code
pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000
Read of size 8 at addr 000000006163ae78 by task insmod/30
freed 208-byte region [000000006163adc0, 000000006163ae90)
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
driver does not include the VEPA source pruning path, so a full
end-to-end reproduction with emulated hardware was not possible. (CVE-2026-64113)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: raw: reject IP_HDRINCL packets with ihl < 5
raw_send_hdrinc() validates that the caller-supplied IPv4 header
fits within the message length:
iphlen = iph->ihl * 4;
err = -EINVAL;
if (iphlen > length)
goto error_free;
if (iphlen >= sizeof(*iph)) {
/* fix up saddr, tot_len, id, csum, transport_header */
}
It does not, however, reject ihl < 5. For such a packet the
"if (iphlen >= sizeof(*iph))" branch is skipped, leaving the
crafted iphdr untouched, but the packet is still handed to
__ip_local_out() and onward. Downstream consumers that read
iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in
particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
and passes the (signed-int-negative, then cast to size_t)
result to memcpy(), producing an OOB access of length close to
SIZE_MAX and a host kernel panic.
An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
"Internet Header Length is the length of the internet header in
32 bit words ... Note that the minimum value for a correct header
is 5."). The kernel should not be willing to inject such a
packet into its own output path.
Reject "iphlen < sizeof(*iph)" alongside the existing
"iphlen > length" check. This matches the principle that locally
constructed packets that re-enter the IP stack must pass the same
basic sanity tests that a foreign packet would be subjected to.
Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around
the fixup branch becomes redundant; left in place to keep the
patch minimal and backport-friendly. A follow-up can unwrap it.
Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket
message is big enough to hold an IP header") ensures the message
buffer is large enough to hold an iphdr, but does not constrain
the self-reported iph->ihl.
Reachability: the malformed packet source is any caller with
CAP_NET_RAW, including an unprivileged process in a user+net
namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH
crash also requires a matching xfrm AH policy on the outgoing
route; a container granted CAP_NET_ADMIN can install that state
and policy in its netns. Loopback bypasses xfrm_output, so the
trigger uses a real netdev.
Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
memcpy_orig at the crash site. Same shape reproduces inside a
rootless Docker container with --cap-add NET_ADMIN on a stock
distro kernel. (CVE-2026-64114)
In the Linux kernel, the following vulnerability has been resolved:
vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (CVE-2026-64116)
In the Linux kernel, the following vulnerability has been resolved:
net: ifb: report ethtool stats over num_tx_queues (CVE-2026-64121)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN (CVE-2026-64153)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix partial invalidation of streaming-write folio (CVE-2026-64157)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix write streaming disablement if fd open O_RDWR (CVE-2026-64158)
In the Linux kernel, the following vulnerability has been resolved:
test_kprobes: clear kprobes between test runs (CVE-2026-64163)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (CVE-2026-64164)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (CVE-2026-64166)
In the Linux kernel, the following vulnerability has been resolved:
mm/memory_hotplug: fix memory block reference leak on remove (CVE-2026-64180)
In the Linux kernel, the following vulnerability has been resolved:
drivers/base/memory: fix memory block reference leak in poison accounting (CVE-2026-64182)
In the Linux kernel, the following vulnerability has been resolved:
efi: Allocate runtime workqueue before ACPI init (CVE-2026-64183)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (CVE-2026-64184)
In the Linux kernel, the following vulnerability has been resolved:
sysfs: don't remove existing directory on update failure
When sysfs_update_group() is called for a named group and create_files()
fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on
the group directory. In the update path, kn was obtained via
kernfs_find_and_get() and refers to a directory that already existed
before this call. Removing it silently destroys a sysfs group that the
caller did not create.
Only remove the directory if we created it ourselves. On update failure
the directory remains as it is left empty by remove_files() inside
create_files(), but can be repopulated by a retry. (CVE-2026-64185)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix overrun check in netfs_extract_user_iter() (CVE-2026-64217)
Affected Packages:
kernel6.12
Issue Correction:
Run dnf update kernel6.12 --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1894 --releasever 2023.12.20260622 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
python3-perf6.12-6.12.92-122.166.amzn2023.aarch64
kernel6.12-modules-extra-common-6.12.92-122.166.amzn2023.aarch64
perf6.12-debuginfo-6.12.92-122.166.amzn2023.aarch64
kernel6.12-tools-devel-6.12.92-122.166.amzn2023.aarch64
kernel6.12-tools-debuginfo-6.12.92-122.166.amzn2023.aarch64
python3-perf6.12-debuginfo-6.12.92-122.166.amzn2023.aarch64
bpftool6.12-6.12.92-122.166.amzn2023.aarch64
perf6.12-6.12.92-122.166.amzn2023.aarch64
bpftool6.12-debuginfo-6.12.92-122.166.amzn2023.aarch64
kernel6.12-modules-extra-6.12.92-122.166.amzn2023.aarch64
kernel6.12-debuginfo-6.12.92-122.166.amzn2023.aarch64
kernel6.12-tools-6.12.92-122.166.amzn2023.aarch64
kernel6.12-headers-6.12.92-122.166.amzn2023.aarch64
kernel-livepatch-6.12.92-122.166-1.0-0.amzn2023.aarch64
kernel6.12-6.12.92-122.166.amzn2023.aarch64
kernel6.12-debuginfo-common-aarch64-6.12.92-122.166.amzn2023.aarch64
kernel6.12-devel-6.12.92-122.166.amzn2023.aarch64
src:
kernel6.12-6.12.92-122.166.amzn2023.src
x86_64:
bpftool6.12-debuginfo-6.12.92-122.166.amzn2023.x86_64
kernel6.12-modules-extra-6.12.92-122.166.amzn2023.x86_64
kernel6.12-debuginfo-6.12.92-122.166.amzn2023.x86_64
kernel6.12-tools-devel-6.12.92-122.166.amzn2023.x86_64
kernel-livepatch-6.12.92-122.166-1.0-0.amzn2023.x86_64
kernel6.12-tools-6.12.92-122.166.amzn2023.x86_64
perf6.12-debuginfo-6.12.92-122.166.amzn2023.x86_64
kernel6.12-tools-debuginfo-6.12.92-122.166.amzn2023.x86_64
kernel6.12-modules-extra-common-6.12.92-122.166.amzn2023.x86_64
python3-perf6.12-debuginfo-6.12.92-122.166.amzn2023.x86_64
kernel6.12-headers-6.12.92-122.166.amzn2023.x86_64
kernel6.12-6.12.92-122.166.amzn2023.x86_64
perf6.12-6.12.92-122.166.amzn2023.x86_64
python3-perf6.12-6.12.92-122.166.amzn2023.x86_64
bpftool6.12-6.12.92-122.166.amzn2023.x86_64
kernel6.12-debuginfo-common-x86_64-6.12.92-122.166.amzn2023.x86_64
kernel6.12-devel-6.12.92-122.166.amzn2023.x86_64
2026-07-29: CVE-2026-64113 was added to this advisory.
2026-07-29: CVE-2026-63860 was added to this advisory.
2026-07-29: CVE-2026-64053 was added to this advisory.
2026-07-29: CVE-2026-64112 was added to this advisory.
2026-07-29: CVE-2026-64025 was added to this advisory.
2026-07-29: CVE-2026-64047 was added to this advisory.
2026-07-29: CVE-2026-64114 was added to this advisory.
2026-07-29: CVE-2026-64065 was added to this advisory.
2026-07-29: CVE-2026-64046 was added to this advisory.
2026-07-29: CVE-2026-64182 was added to this advisory.
2026-07-29: CVE-2026-64132 was added to this advisory.
2026-07-29: CVE-2026-64015 was added to this advisory.
2026-07-29: CVE-2026-64158 was added to this advisory.
2026-07-29: CVE-2026-64180 was added to this advisory.
2026-07-29: CVE-2026-64115 was added to this advisory.
2026-07-29: CVE-2026-64136 was added to this advisory.
2026-07-29: CVE-2026-64183 was added to this advisory.
2026-07-29: CVE-2026-63865 was added to this advisory.
2026-07-29: CVE-2026-64121 was added to this advisory.
2026-07-29: CVE-2026-64032 was added to this advisory.
2026-07-29: CVE-2026-64163 was added to this advisory.
2026-07-29: CVE-2026-64153 was added to this advisory.
2026-07-29: CVE-2026-64059 was added to this advisory.
2026-07-29: CVE-2026-64111 was added to this advisory.
2026-07-29: CVE-2026-64052 was added to this advisory.
2026-07-29: CVE-2026-64108 was added to this advisory.
2026-07-29: CVE-2026-64062 was added to this advisory.
2026-07-29: CVE-2026-64166 was added to this advisory.
2026-07-29: CVE-2026-64105 was added to this advisory.
2026-07-29: CVE-2026-64106 was added to this advisory.
2026-07-29: CVE-2026-64184 was added to this advisory.
2026-07-29: CVE-2026-64164 was added to this advisory.
2026-07-29: CVE-2026-64116 was added to this advisory.
2026-07-29: CVE-2026-64098 was added to this advisory.
2026-07-29: CVE-2026-64063 was added to this advisory.
2026-07-29: CVE-2026-64185 was added to this advisory.
2026-07-29: CVE-2026-64073 was added to this advisory.
2026-07-29: CVE-2026-64157 was added to this advisory.
2026-07-29: CVE-2026-64064 was added to this advisory.
2026-07-29: CVE-2026-64061 was added to this advisory.
2026-07-29: CVE-2026-64217 was added to this advisory.
2026-07-29: CVE-2026-64109 was added to this advisory.
2026-07-06: CVE-2026-53053 was added to this advisory.
2026-07-06: CVE-2026-46170 was added to this advisory.
2026-07-06: CVE-2026-46160 was added to this advisory.
2026-07-06: CVE-2026-53076 was added to this advisory.
2026-07-06: CVE-2026-52970 was added to this advisory.
2026-07-06: CVE-2026-52961 was added to this advisory.
2026-07-06: CVE-2026-45842 was added to this advisory.
2026-07-06: CVE-2026-53094 was added to this advisory.
2026-07-06: CVE-2026-46274 was added to this advisory.
2026-07-06: CVE-2026-52993 was added to this advisory.
2026-07-06: CVE-2026-53003 was added to this advisory.
2026-07-06: CVE-2026-53062 was added to this advisory.
2026-07-06: CVE-2026-52936 was added to this advisory.
2026-07-06: CVE-2026-53077 was added to this advisory.
2026-07-06: CVE-2026-53031 was added to this advisory.
2026-07-06: CVE-2026-52954 was added to this advisory.
2026-07-06: CVE-2026-52969 was added to this advisory.
2026-07-06: CVE-2026-52967 was added to this advisory.
2026-07-06: CVE-2026-53034 was added to this advisory.
2026-07-06: CVE-2026-52920 was added to this advisory.
2026-07-06: CVE-2026-53061 was added to this advisory.
2026-07-06: CVE-2026-53032 was added to this advisory.
2026-07-06: CVE-2026-52974 was added to this advisory.
2026-07-06: CVE-2026-52990 was added to this advisory.
2026-07-06: CVE-2026-46158 was added to this advisory.
2026-07-06: CVE-2026-52977 was added to this advisory.
2026-07-06: CVE-2026-53096 was added to this advisory.
2026-07-06: CVE-2026-53063 was added to this advisory.
2026-07-06: CVE-2026-53288 was added to this advisory.
2026-07-06: CVE-2026-52980 was added to this advisory.
2026-07-06: CVE-2026-43245 was added to this advisory.
2026-07-06: CVE-2026-53126 was added to this advisory.
2026-07-06: CVE-2026-45838 was added to this advisory.
2026-07-06: CVE-2026-31613 was added to this advisory.
2026-07-06: CVE-2026-45840 was added to this advisory.
2026-07-06: CVE-2026-53083 was added to this advisory.
2026-07-06: CVE-2026-53085 was added to this advisory.
2026-07-06: CVE-2026-53081 was added to this advisory.
2026-07-06: CVE-2026-53128 was added to this advisory.
2026-07-06: CVE-2026-45843 was added to this advisory.
2026-07-06: CVE-2026-46315 was added to this advisory.
2026-07-06: CVE-2026-23272 was added to this advisory.
2026-07-06: CVE-2026-53014 was added to this advisory.
2026-07-06: CVE-2026-53037 was added to this advisory.
2026-07-06: CVE-2026-53064 was added to this advisory.
2026-07-06: CVE-2026-53009 was added to this advisory.
2026-07-06: CVE-2026-52962 was added to this advisory.
2026-07-06: CVE-2026-53015 was added to this advisory.
2026-07-06: CVE-2026-53002 was added to this advisory.
2026-07-06: CVE-2026-52912 was added to this advisory.
2026-07-06: CVE-2026-53120 was added to this advisory.
2026-07-06: CVE-2026-45841 was added to this advisory.
2026-07-06: CVE-2026-53013 was added to this advisory.
2026-07-06: CVE-2026-53122 was added to this advisory.
2026-07-06: CVE-2026-52984 was added to this advisory.
2026-07-06: CVE-2026-52957 was added to this advisory.
2026-07-06: CVE-2025-71289 was added to this advisory.
2026-07-06: CVE-2026-53075 was added to this advisory.
2026-07-06: CVE-2026-52925 was added to this advisory.
2026-07-06: CVE-2026-46137 was added to this advisory.
2026-07-06: CVE-2026-53119 was added to this advisory.
2026-07-06: CVE-2026-53060 was added to this advisory.
2026-07-06: CVE-2026-52958 was added to this advisory.
2026-07-06: CVE-2026-53036 was added to this advisory.
2026-07-06: CVE-2026-46244 was added to this advisory.
2026-07-06: CVE-2026-52972 was added to this advisory.
2026-07-06: CVE-2026-53289 was added to this advisory.
2026-07-06: CVE-2026-52999 was added to this advisory.
2026-07-06: CVE-2026-52986 was added to this advisory.
2026-07-06: CVE-2026-53059 was added to this advisory.
2026-07-06: CVE-2026-52998 was added to this advisory.
2026-07-06: CVE-2026-53314 was added to this advisory.
2026-07-06: CVE-2026-52921 was added to this advisory.
2026-07-06: CVE-2026-53033 was added to this advisory.
2026-07-06: CVE-2026-53035 was added to this advisory.
2026-07-06: CVE-2026-52985 was added to this advisory.
2026-07-06: CVE-2026-53069 was added to this advisory.
2026-07-06: CVE-2026-52915 was added to this advisory.
2026-07-06: CVE-2026-52995 was added to this advisory.
2026-07-06: CVE-2026-53084 was added to this advisory.
2026-07-06: CVE-2026-53023 was added to this advisory.
2026-07-06: CVE-2026-53295 was added to this advisory.
2026-07-06: CVE-2026-52955 was added to this advisory.
2026-07-06: CVE-2026-52981 was added to this advisory.
2026-07-06: CVE-2026-53004 was added to this advisory.
2026-07-06: CVE-2026-53001 was added to this advisory.
2026-07-06: CVE-2026-53006 was added to this advisory.
2026-07-06: CVE-2026-53074 was added to this advisory.
2026-07-06: CVE-2026-53129 was added to this advisory.
2026-07-06: CVE-2026-53038 was added to this advisory.
2026-07-06: CVE-2026-53111 was added to this advisory.
2026-07-06: CVE-2026-53012 was added to this advisory.
2026-07-06: CVE-2026-53021 was added to this advisory.
2026-07-06: CVE-2026-53304 was added to this advisory.
2026-07-06: CVE-2026-45839 was added to this advisory.
2026-07-06: CVE-2026-53287 was added to this advisory.
2026-07-06: CVE-2026-53050 was added to this advisory.
2026-07-06: CVE-2026-53123 was added to this advisory.