Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-296
Advisory Release Date: 2026-11-02 09:00 Pacific
Advisory Updated Date: 2026-11-02 14:32 Pacific
Severity:
Important
Issue Overview:
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-108094:
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
Affected Packages:
mutter
Issue Correction:
Run dnf update mutter --releasever 2027.0.20261102 or dnf update --advisory ALAS2027-2026-296 --releasever 2027.0.20261102 to update your system.
New Packages:
aarch64:
mutter-devkit-50.3-2.amzn2027.aarch64
mutter-devel-debuginfo-50.3-2.amzn2027.aarch64
mutter-debuginfo-50.3-2.amzn2027.aarch64
mutter-devkit-debuginfo-50.3-2.amzn2027.aarch64
mutter-devel-50.3-2.amzn2027.aarch64
mutter-50.3-2.amzn2027.aarch64
mutter-tests-debuginfo-50.3-2.amzn2027.aarch64
mutter-tests-50.3-2.amzn2027.aarch64
mutter-debugsource-50.3-2.amzn2027.aarch64
noarch:
mutter-common-50.3-2.amzn2027.noarch
src:
mutter-50.3-2.amzn2027.src
x86_64:
mutter-debuginfo-50.3-2.amzn2027.x86_64
mutter-devel-debuginfo-50.3-2.amzn2027.x86_64
mutter-devkit-50.3-2.amzn2027.x86_64
mutter-devkit-debuginfo-50.3-2.amzn2027.x86_64
mutter-tests-50.3-2.amzn2027.x86_64
mutter-devel-50.3-2.amzn2027.x86_64
mutter-tests-debuginfo-50.3-2.amzn2027.x86_64
mutter-debugsource-50.3-2.amzn2027.x86_64
mutter-50.3-2.amzn2027.x86_64