Amazon Linux 2023 Security Advisory: ALAS2023-2026-3197
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (CVE-2026-100070)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: add hook transactions for device deletions (CVE-2026-63858)
In the Linux kernel, the following vulnerability has been resolved:
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and
defers to psock->saved_data_ready when a TLS RX context is present,
avoiding a conflict with the TLS strparser's ownership of the receive
queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types
with ktls").
sk_psock_verdict_data_ready() has no equivalent guard. When a socket
is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is
configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready
as rx_ctx->saved_data_ready. On data arrival:
tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready
-> saved_data_ready() = sk_psock_verdict_data_ready()
-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()
without calling tcp_eat_skb(), so copied_seq is not advanced.
tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls
tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and
returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned
(potentially freed) skb. tls_decrypt_sg() subsequently walks that
frag_list: use-after-free.
Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context
is present, call psock->saved_data_ready (sock_def_readable) to wake
recv() waiters and return immediately, leaving the receive queue
untouched. TLS retains sole ownership of the queue and decrypts the
record normally through tls_sw_recvmsg(). (CVE-2026-64025)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: add and use xtables_unregister_table_exit
Previous change added xtables_unregister_table_pre_exit to detach the
table from the packetpath and to unlink it from the active table list.
In case of rmmod, userspace that is doing set/getsockopt for this table
will not be able to re-instantiate the table:
1. The larval table has been removed already
2. existing instantiated table is no longer on the xt pernet table list.
This adds the second stage helper:
unlink the table from the dying list, free the hook ops (if any) and do
the audit notification. It replaces xt_unregister_table(). (CVE-2026-64078)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: allocate hook ops while under mutex
arp/ip(6)t_register_table() add the table to the per-netns list via
xt_register_table() before allocating the per-netns hook ops copy
via kmemdup_array(). This leaves a window where the table is
visible in the list with ops=NULL.
If the pernet exit happens runs concurrently the pre_exit callback finds
the table via xt_find_table() and passes the NULL ops pointer to
nf_unregister_net_hooks(), causing a NULL dereference:
general protection fault in nf_unregister_net_hooks+0xbc/0x150
RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)
Call Trace:
ipt_unregister_table_pre_exit
iptable_mangle_net_pre_exit
ops_pre_exit_list
cleanup_net
Fix by moving the ops allocation into the xtables core so the table is
never in the list without valid ops. Also ensure the table is no longer
processing packets before its torn down on error unwind.
nf_register_net_hooks might have published at least one hook; call
synchronize_rcu() if there was an error.
audit log register message gets deferred until all operations have
passed, this avoids need to emit another ureg message in case of
error unwinding.
Based on earlier patch by Tristan Madani. (CVE-2026-64079)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reload ip header after head reallocation (CVE-2026-68476)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323)
In the Linux kernel, the following vulnerability has been resolved:
tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474)
In the Linux kernel, the following vulnerability has been resolved:
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (CVE-2026-80671)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: fix memory leak from alloc-during-teardown race (CVE-2026-80784)
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't enable DAX on new encrypted files (CVE-2026-80806)
In the Linux kernel, the following vulnerability has been resolved:
usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
In the Linux kernel, the following vulnerability has been resolved:
usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840)
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix xfrm_state_construct() auth-trunc leak (CVE-2026-80843)
In the Linux kernel, the following vulnerability has been resolved:
tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852)
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on open O_TRUNC DAX failure (CVE-2026-80855)
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on setattr writeback failure (CVE-2026-80856)
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject an unclaimed class value in security_get_classes() (CVE-2026-80912)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: flush works in dependency order (CVE-2026-80932)
In the Linux kernel, the following vulnerability has been resolved:
dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)
In the Linux kernel, the following vulnerability has been resolved:
seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)
In the Linux kernel, the following vulnerability has been resolved:
net: cap advertised IP tunnel headroom (CVE-2026-80978)
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)
In the Linux kernel, the following vulnerability has been resolved:
xdp: fix zero-copy frame layout (CVE-2026-81002)
In the Linux kernel, the following vulnerability has been resolved:
ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix stream->outcnt underflow on duplicate RECONF responses
A cached RECONF chunk may contain more than one request parameter. A
duplicate response can therefore find and process the same ADD_OUT request
again while another parameter is still outstanding, rolling back outcnt
twice and possibly underflowing it.
Track outstanding request types as bits and clear each bit after its first
response. Later responses for the same request are then ignored. (CVE-2026-89476)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)
In the Linux kernel, the following vulnerability has been resolved:
sctp: drop a chunk if its transport was removed (CVE-2026-89478)
In the Linux kernel, the following vulnerability has been resolved:
sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: reject a read that transferred too few bytes
nvme_tcp_recv_data() completes a request once the current C2HData PDU
has been consumed. Nothing compares the total bytes received against
the length the command asked for: struct nvme_tcp_request has no
receive-side counter, queue->data_remaining is per queue, and
blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally
with no residual concept anywhere above.
A controller can therefore answer a 4096-byte read with 512 bytes and
have it reported as a complete read; user space then gets 4096 bytes of
which 3584 are whatever was already in the page. I reproduced that with
a test target.
Count the bytes received and refuse to complete a successful read whose
count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in
nvme_tcp_process_nvme_cqe(). The success test shifts req->status right
by one, because the driver keeps the wire value there and shifts it on
completion, so the check must see what the completion path will see.
Only REQ_OP_READ is checked, because there the length comes from the
sectors the request covers; a passthrough command is built by its
submitter, which picks both command and buffer, so the kernel has
nothing to compare against. (CVE-2026-89480)
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)
In the Linux kernel, the following vulnerability has been resolved:
nvme: zero the discard fallback page (CVE-2026-89483)
In the Linux kernel, the following vulnerability has been resolved:
lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: only skb_tx_error() a packet we are about to drop (CVE-2026-89487)
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508)
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (CVE-2026-89515)
In the Linux kernel, the following vulnerability has been resolved:
udf: reject VAT indexes equal to the entry count (CVE-2026-89525)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538)
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: route to a populated pool in svc_pool_for_cpu() (CVE-2026-89549)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)
In the Linux kernel, the following vulnerability has been resolved:
mpls: reload header after pskb_may_pull()
mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop
when an MPLS route has multiple nexthops. While walking the MPLS label
stack, the hash routine caches hdr for the current label. After finding
the bottom-of-stack label, it calls pskb_may_pull() before reading the
inner IP header.
If an skb is constructed with the inner IP header in nonlinear data and
insufficient tailroom in the linear head, pskb_may_pull() calls
pskb_expand_head() to replace the skb head and free the old one. This
leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr
again when it performs a second pull for the larger header.
The issue was found through static analysis. A reproducer sending a legal
Geneve packet through a bareudp/MPLS multipath setup triggered the same
KASAN report in 2 of 2 unpatched runs:
BUG: KASAN: slab-use-after-free in mpls_select_multipath
Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23
Call Trace:
mpls_select_multipath
mpls_forward
__netif_receive_skb_list_core
netif_receive_skb_list_internal
napi_complete_done
gro_cell_poll
__napi_poll
net_rx_action
Freed by task 23:
kfree
pskb_expand_head
__pskb_pull_tail
mpls_select_multipath
Reload hdr from the current skb head after each successful pull before
deriving the inner IPv4 or IPv6 header pointer. (CVE-2026-89555)
In the Linux kernel, the following vulnerability has been resolved:
md: do overflow check for sb->bblog_shift in super_1_load() (CVE-2026-89557)
In the Linux kernel, the following vulnerability has been resolved:
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (CVE-2026-89559)
In the Linux kernel, the following vulnerability has been resolved:
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
Whiteout objects are used in the upper layer of an OverlayFS to
indicate that the file with this name does not exist in the unified
view, even if it is present in one of the lower layer file systems.
For the userspace implementations of OverlayFS (fuse-overlayfs),
whiteout objects can be created from userspace as well:
* mknod(2) with S_IFCHR and makedev(0, 0)
* renameat2(2) with RENAME_WHITEOUT,
creating the whiteout in the old place of the moved file.
This commit guards whiteout creation in both of these cases with
LANDLOCK_ACCESS_FS_MAKE_REG. Whiteout objects are *not* considered
character devices and are not bound to a driver.
LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as a
whiteout object: creating one is the only S_IFCHR creation that the VFS
exempts from CAP_MKNOD, so it is as unprivileged as creating a regular
file, while LANDLOCK_ACCESS_FS_MAKE_CHAR and
LANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation of devices that
expose a kernel interface [1].
For the mknod(2) case, introduce a Landlock erratum. The creation of
whiteout objects through mknod(2) was previously guarded using
LANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded using
LANDLOCK_ACCESS_FS_MAKE_REG.
For the renameat2(2) case, fix a bug: Before this commit, renameat2(2)
with RENAME_WHITEOUT would create a directory entry even when all
LANDLOCK_ACCESS_FS_MAKE_* rights were denied.
This does not affect normal renames within layered OverlayFS mounts:
When doing a regular rename() on a mounted fuse-overlayfs, it is the
fuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT,
and only the Landlock domain of that daemon is checked there.
Depends-on: 49c9e09d9610 ("landlock: Fix handling of disconnected directories")
Depends-on: fe72ce6710cb ("landlock: Add errata documentation section")
[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching right, and
add link(2) to the user doc] (CVE-2026-89560)
In the Linux kernel, the following vulnerability has been resolved:
ip6_gre: fix hardware header length for NBMA tunnels (CVE-2026-89562)
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (CVE-2026-89563)
In the Linux kernel, the following vulnerability has been resolved:
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (CVE-2026-89565)
In the Linux kernel, the following vulnerability has been resolved:
dm array: reject an array block whose value size is not the caller's (CVE-2026-89573)
In the Linux kernel, the following vulnerability has been resolved:
dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVE-2026-89579)
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)
In the Linux kernel, the following vulnerability has been resolved:
fsnotify: Fix stale object mask after concurrent mark updates (CVE-2026-89595)
In the Linux kernel, the following vulnerability has been resolved:
entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
In the Linux kernel, the following vulnerability has been resolved:
efivarfs: Rate limit statfs() handler (CVE-2026-89604)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)
In the Linux kernel, the following vulnerability has been resolved:
audit: avoid dropping live tree ref on fsnotify rule autoremove
audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree. (CVE-2026-89643)
In the Linux kernel, the following vulnerability has been resolved:
ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
In the Linux kernel, the following vulnerability has been resolved:
ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
In the Linux kernel, the following vulnerability has been resolved:
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then
took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap
the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as
cnr_stateid, so any NFSv4.2 client can drive it) reaches
manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on
the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical
section as idr_alloc_cyclic(), so a concurrent lookup either misses the
entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after
allocation and switch _free_cpntf_state_locked() to list_del_init() so a
stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and
skips the list_add, preserving NFS4_COPY_STID semantics. (CVE-2026-89684)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710)
In the Linux kernel, the following vulnerability has been resolved:
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (CVE-2026-89711)
In the Linux kernel, the following vulnerability has been resolved:
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)
In the Linux kernel, the following vulnerability has been resolved:
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)
In the Linux kernel, the following vulnerability has been resolved:
Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
In the Linux kernel, the following vulnerability has been resolved:
device property: fix infinite loop in fwnode_for_each_child_node() (CVE-2026-89744)
In the Linux kernel, the following vulnerability has been resolved:
mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)
In the Linux kernel, the following vulnerability has been resolved:
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)
In the Linux kernel, the following vulnerability has been resolved:
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (CVE-2026-89776)
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
In the Linux kernel, the following vulnerability has been resolved:
isofs: fix out-of-bounds page array access on empty zisofs block (CVE-2026-89778)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value (CVE-2026-89779)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (CVE-2026-89781)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: reject restart table growth beyond U16_MAX entries (CVE-2026-89782)
In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (CVE-2026-89783)
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784)
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (CVE-2026-89785)
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir() (CVE-2026-89786)
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (CVE-2026-89816)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Guard against NULL driver_data in i915_pci_probe() (CVE-2026-89822)
In the Linux kernel, the following vulnerability has been resolved:
drm: fix race between partial drm_dev_register() failure and ioctl (CVE-2026-89823)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (CVE-2026-89927)
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930)
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: reject an arena whose nfree is below the lane count (CVE-2026-89965)
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: check the data direction of a C2HData PDU (CVE-2026-89973)
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix debugfs UAF on adapter removal (CVE-2026-89983)
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/intel: Fix kernel address leakages in LBR stack (CVE-2026-89984)
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Protect kprobe_blacklist with RCU (CVE-2026-89988)
In the Linux kernel, the following vulnerability has been resolved:
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (CVE-2026-89989)
In the Linux kernel, the following vulnerability has been resolved:
cpuidle: dt_idle_genpd: kfree() the original name allocation (CVE-2026-89992)
In the Linux kernel, the following vulnerability has been resolved:
dm: fix resume-vs-remove race (CVE-2026-89997)
In the Linux kernel, the following vulnerability has been resolved:
dm: fix race when loading and unloading a table (CVE-2026-89998)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
In the Linux kernel, the following vulnerability has been resolved:
xhci: fix lost bounce buffers on TDs spanning several ring segments (CVE-2026-90015)
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (CVE-2026-90049)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_htb: limit htb_classify inner-class filter hops (CVE-2026-90053)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix corruption of urgent data on multi-segment retransmit (CVE-2026-90054)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (CVE-2026-90058)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: move hardware offload step after building the chain blob (CVE-2026-90062)
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: Ensure that TCP packets don't overflow gso_segs (CVE-2026-90063)
In the Linux kernel, the following vulnerability has been resolved:
libceph: validate banner payload length (CVE-2026-90067)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: restore skb->dev on the slave failure path (CVE-2026-90071)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (CVE-2026-90072)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (CVE-2026-90073)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq_codel: clamp default quantum and mtu (CVE-2026-90075)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: use wq_has_sleeper() in rds_cong_map_updated() (CVE-2026-90081)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pnfs: key the data server cache on the NFS version (CVE-2026-90102)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (CVE-2026-90103)
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash (CVE-2026-90110)
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: Reject descending VLAN tunnel ranges (CVE-2026-90114)
In the Linux kernel, the following vulnerability has been resolved:
cuse: wait for pending RCU callbacks on module exit (CVE-2026-90140)
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix integer overflow in ftp helper port/address parsing (CVE-2026-90141)
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject negative optlen in cgroup getsockopt hook (CVE-2026-90157)
In the Linux kernel, the following vulnerability has been resolved:
lwt_bpf: Restore reserved headroom after xmit program (CVE-2026-90160)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: serialize configfs attribute updates with device setup (CVE-2026-90184)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: serialize configfs attribute stores with the lock (CVE-2026-90185)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: reject per-device queue resize for shared tag set (CVE-2026-90186)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: free global tag_set on init error path (CVE-2026-90188)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: register configfs subsystem after creating default devices (CVE-2026-90189)
In the Linux kernel, the following vulnerability has been resolved:
null_blk: use DEFINE_MUTEX for the file-scope mutex (CVE-2026-90190)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: scan: fix bus ID cleanup on device_add() failures (CVE-2026-90194)
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (CVE-2026-90202)
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check block offset is not negative (CVE-2026-90203)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (CVE-2026-90248)
In the Linux kernel, the following vulnerability has been resolved:
hugetlbfs: release subpool on fill_super failure (CVE-2026-90283)
In the Linux kernel, the following vulnerability has been resolved:
firmware_loader: do not queue completed sysfs fallback requests (CVE-2026-90284)
In the Linux kernel, the following vulnerability has been resolved:
arm64: hibernate: Restore DAIF state on error (CVE-2026-90290)
In the Linux kernel, the following vulnerability has been resolved:
fat: release buffer head after rebuilding parent (CVE-2026-90318)
In the Linux kernel, the following vulnerability has been resolved:
HID: synchronize input before cleaning up a failed probe (CVE-2026-90329)
In the Linux kernel, the following vulnerability has been resolved:
tty: clear cdev pointer after cdev_add() failure (CVE-2026-90334)
In the Linux kernel, the following vulnerability has been resolved:
iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix potential UAF in bpf_netns_link_update_prog (CVE-2026-90393)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (CVE-2026-90416)
In the Linux kernel, the following vulnerability has been resolved:
isofs: release zisofs block pointer buffer head (CVE-2026-90434)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix integer overflow of user QP buffer size (CVE-2026-90435)
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix buffer_head leak in ext4_init_orphan_info (CVE-2026-92494)
In the Linux kernel, the following vulnerability has been resolved:
ext4: drain in-flight DIO before buffered write fallback (CVE-2026-92501)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (CVE-2026-92521)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: validate MADT IOAPIC entry bounds (CVE-2026-92522)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523)
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (CVE-2026-92524)
In the Linux kernel, the following vulnerability has been resolved:
software node: Fix software_node_get_reference_args() with index -1 (CVE-2026-93046)
In the Linux kernel, the following vulnerability has been resolved:
uio: Fix stale info pointer in failed registration path (CVE-2026-93054)
In the Linux kernel, the following vulnerability has been resolved:
UDF symlink pathComponent header OOB read (CVE-2026-93055)
In the Linux kernel, the following vulnerability has been resolved:
dax: read holder_ops once in dax_holder_notify_failure() (CVE-2026-93073)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Drain RCU callbacks during module teardown (CVE-2026-93109)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Wait for RCU callbacks before unloading ib_core (CVE-2026-93110)
In the Linux kernel, the following vulnerability has been resolved:
usb: fix UAF when probe runs concurrent to dyn ID removal (CVE-2026-93117)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix use-after-free on mm_struct in bpf_find_vma() (CVE-2026-93137)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (CVE-2026-93138)
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Fix overflow in update_tg_cfs_runnable() (CVE-2026-93182)
In the Linux kernel, the following vulnerability has been resolved:
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (CVE-2026-93189)
In the Linux kernel, the following vulnerability has been resolved:
PCI/proc: Use file_ns_capable() when checking config space read access (CVE-2026-93206)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden DFS cache against invalid target hints (CVE-2026-93210)
In the Linux kernel, the following vulnerability has been resolved:
of: fix out-of-bounds read in of_alias_scan() stem parser (CVE-2026-93213)
In the Linux kernel, the following vulnerability has been resolved:
signal: avoid shared siginfo namespace rewrites (CVE-2026-93222)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: use RCU iterator to dump route exceptions (CVE-2026-93226)
In the Linux kernel, the following vulnerability has been resolved:
arm64: hibernate: mask DAIF before restoring hibernated kernel (CVE-2026-93256)
In the Linux kernel, the following vulnerability has been resolved:
md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)
In the Linux kernel, the following vulnerability has been resolved:
ext4: skip extra isize expansion during mount to prevent deadlock (CVE-2026-93268)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid leaking refcount in cifs_queue_oplock_break() (CVE-2026-97557)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces (CVE-2026-98164)
Affected Packages:
kernel
Issue Correction:
Run dnf update kernel --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3197 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
python3-perf-6.1.188-233.385.amzn2023.aarch64
kernel-livepatch-6.1.188-233.385-1.0-0.amzn2023.aarch64
kernel-modules-extra-common-6.1.188-233.385.amzn2023.aarch64
kernel-modules-extra-6.1.188-233.385.amzn2023.aarch64
perf-debuginfo-6.1.188-233.385.amzn2023.aarch64
kernel-headers-6.1.188-233.385.amzn2023.aarch64
python3-perf-debuginfo-6.1.188-233.385.amzn2023.aarch64
kernel-tools-devel-6.1.188-233.385.amzn2023.aarch64
kernel-tools-debuginfo-6.1.188-233.385.amzn2023.aarch64
kernel-tools-6.1.188-233.385.amzn2023.aarch64
bpftool-6.1.188-233.385.amzn2023.aarch64
perf-6.1.188-233.385.amzn2023.aarch64
bpftool-debuginfo-6.1.188-233.385.amzn2023.aarch64
kernel-6.1.188-233.385.amzn2023.aarch64
kernel-debuginfo-6.1.188-233.385.amzn2023.aarch64
kernel-debuginfo-common-aarch64-6.1.188-233.385.amzn2023.aarch64
kernel-devel-6.1.188-233.385.amzn2023.aarch64
src:
kernel-6.1.188-233.385.amzn2023.src
x86_64:
bpftool-debuginfo-6.1.188-233.385.amzn2023.x86_64
kernel-headers-6.1.188-233.385.amzn2023.x86_64
perf-debuginfo-6.1.188-233.385.amzn2023.x86_64
kernel-livepatch-6.1.188-233.385-1.0-0.amzn2023.x86_64
kernel-tools-debuginfo-6.1.188-233.385.amzn2023.x86_64
kernel-tools-6.1.188-233.385.amzn2023.x86_64
kernel-modules-extra-common-6.1.188-233.385.amzn2023.x86_64
kernel-tools-devel-6.1.188-233.385.amzn2023.x86_64
kernel-debuginfo-6.1.188-233.385.amzn2023.x86_64
python3-perf-6.1.188-233.385.amzn2023.x86_64
kernel-6.1.188-233.385.amzn2023.x86_64
kernel-debuginfo-common-x86_64-6.1.188-233.385.amzn2023.x86_64
python3-perf-debuginfo-6.1.188-233.385.amzn2023.x86_64
kernel-modules-extra-6.1.188-233.385.amzn2023.x86_64
bpftool-6.1.188-233.385.amzn2023.x86_64
perf-6.1.188-233.385.amzn2023.x86_64
kernel-devel-6.1.188-233.385.amzn2023.x86_64