ALAS2027-2026-007

References: CVE-2026-0799  CVE-2026-31911  CVE-2026-31912  CVE-2026-6244  CVE-2026-6554 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures. (CVE-2026-0799)

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. (CVE-2026-31911)

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. (CVE-2026-31912)

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. (CVE-2026-6244)

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. (CVE-2026-6554)

Issue Correction:
Run yum update libpcap to update your system.

New Packages:

aarch64:
    libpcap-debuginfo-1.10.7-1.amzn2027.aarch64
    libpcap-debugsource-1.10.7-1.amzn2027.aarch64
    libpcap-1.10.7-1.amzn2027.aarch64
    libpcap-devel-1.10.7-1.amzn2027.aarch64

src:
    libpcap-1.10.7-1.amzn2027.src

x86_64:
    libpcap-debugsource-1.10.7-1.amzn2027.x86_64
    libpcap-debuginfo-1.10.7-1.amzn2027.x86_64
    libpcap-1.10.7-1.amzn2027.x86_64
    libpcap-devel-1.10.7-1.amzn2027.x86_64