ALAS2023-2026-3100

References: CVE-2026-0799  CVE-2026-31911  CVE-2026-31912  CVE-2026-6244  CVE-2026-6554 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures. (CVE-2026-0799)

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. (CVE-2026-31911)

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. (CVE-2026-31912)

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. (CVE-2026-6244)

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. (CVE-2026-6554)

Issue Correction:
Run dnf update libpcap --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3100 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libpcap-debugsource-1.10.7-1.amzn2023.0.1.aarch64
    libpcap-debuginfo-1.10.7-1.amzn2023.0.1.aarch64
    libpcap-1.10.7-1.amzn2023.0.1.aarch64
    libpcap-devel-1.10.7-1.amzn2023.0.1.aarch64

src:
    libpcap-1.10.7-1.amzn2023.0.1.src

x86_64:
    libpcap-debuginfo-1.10.7-1.amzn2023.0.1.x86_64
    libpcap-debugsource-1.10.7-1.amzn2023.0.1.x86_64
    libpcap-1.10.7-1.amzn2023.0.1.x86_64
    libpcap-devel-1.10.7-1.amzn2023.0.1.x86_64