Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)

medium Nessus Plugin ID 322087

Language:

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1881 advisory.

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)

In the Linux kernel, the following vulnerability has been resolved:

ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ipcomp: Free destination pages on acomp errors (CVE-2026-52932)

In the Linux kernel, the following vulnerability has been resolved:

tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix uninit-value in fuse_dentry_revalidate() (CVE-2026-53311)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)

In the Linux kernel, the following vulnerability has been resolved:

serial: zs: Convert to use a platform device (CVE-2026-63876)

In the Linux kernel, the following vulnerability has been resolved:

serial: dz: Convert to use a platform device (CVE-2026-63877)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change_handle and handle_delete (CVE-2026-63885)

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (CVE-2026-63896)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()before esp_output_tail() allocates the destination page frag. Thehead-side gate currently checks skb->data_len and tailen separately, butthe tail code allocates a single destination frag from the combinedpost-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds apage. Otherwise skb_page_frag_refill() may fall back to a single page whilethe destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6. (CVE-2026-63912)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: route MIGRATE notifications to caller's netns (CVE-2026-63914)

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_changelink(). (CVE-2026-63917)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

After patch 1/2 in this series, vti6_update() unlinks and relinksthe tunnel through t->net.
vti6_siocdevprivate() still usesdev_net(dev) for the collision lookup. For a tunnel moved throughIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.

SIOCCHGTUNNEL on a migrated tunnel then runs:

net = dev_net(dev) /* migrated netns */t = vti6_locate(net, &p1, false) /* misses target in t->net */...t = netdev_priv(dev)vti6_update(t, &p1, false) /* mutates t->net's hash
*/

A caller in the migrated netns picks params that match a tunnelin the creation netns. The lookup in dev_net(dev) finds nothing.vti6_update() prepends the migrated tunnel at the head of thecreation netns hash bucket for those params. Later lookups inthe creation netns resolve to the migrated device. xfrm receivedelivers the matched packets through a device the caller controls.

Reachable from an unprivileged user namespace (unshare --user--map-root-user --net). Cross tenant scope on container hosts.

Switch the SIOCCHGTUNNEL path on a non fallback device to uset->net for the lookup. The lookup now matches the netnsvti6_update() operates on.

Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) beforethe lookup. The check at the top of the case is againstdev_net(dev)->user_ns, which after migration is the attacker'snetns. A caller there can pick params absent from self->net,the lookup returns NULL, t becomes self, and vti6_update()inserts the device into the creation netns hash. The new checkrequires CAP_NET_ADMIN in the creation netns user_ns too.

SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keepdev_net(dev), which equals init_net there.
(CVE-2026-63921)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.Let's recompute nh pointer to make sure any change won't mess things up. (CVE-2026-63924)

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

In the Linux kernel, the following vulnerability has been resolved:

bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

When bpf_msg_push_data() inserts data in the middle of a scatterlistentry, it splits the original entry into a left fragment and a rightfragment.

The right fragment offset is page-local, but the code advances it with`start`, which is the message-global insertion point. For inserts into anon-first SG entry, this over-advances the offset and leaves the splitlayout inconsistent.

Advance the right fragment offset by the fragment-local delta,`start - offset`, which matches the length removed from the front of theoriginal entry. (CVE-2026-63926)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (CVE-2026-63937)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Check PSC request indices against the actual size of the buffer (CVE-2026-63938)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Compute the correct max length of the in-GHCB scratch area (CVE-2026-63939)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Ignore Port I/O requests of length '0'

Explicitly ignore Port I/O requests of length '0' (or count '0'), so thatsetting up the software scratch area (and other code) doesn't have toworry about underflowing the length, and to allow for WARNing on tryingto configure the scratch area with len==0. (CVE-2026-63940)

In the Linux kernel, the following vulnerability has been resolved:

mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one (CVE-2026-63950)

In the Linux kernel, the following vulnerability has been resolved:

memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible infinite loop in fib6_select_path() (CVE-2026-63968)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible infinite loop in rt6_fill_node() (CVE-2026-63969)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix race between sctp_wait_for_connect and peeloff

sctp_wait_for_connect() drops and re-acquires the socket lock whilewaiting for the association to reach ESTABLISHED state. During thiswindow, another thread can peeloff the association to a new socket viagetsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. Afterre-acquiring the old socket lock, sctp_wait_for_connect() returnssuccess without noticing the migration -- the caller then accessesthe association under the wrong lock in sctp_datamsg_from_user().

Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()already has, returning an error if the association was migrated whilewe slept. (CVE-2026-63971)

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Use spin_lock_bh for hn_lock (CVE-2026-63980)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVE-2026-63985)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (CVE-2026-63986)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CVE-2026-63987)

In the Linux kernel, the following vulnerability has been resolved:

bridge: Fix sleep in atomic context in sysfs path (CVE-2026-63988)

In the Linux kernel, the following vulnerability has been resolved:

bridge: Fix sleep in atomic context in netlink path (CVE-2026-63989)

In the Linux kernel, the following vulnerability has been resolved:

bonding: refuse to enslave CAN devices (CVE-2026-63990)

In the Linux kernel, the following vulnerability has been resolved:

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

In the Linux kernel, the following vulnerability has been resolved:

tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: cmis: validate start_cmd_payload_size from module (CVE-2026-63995)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: cmis: require exact CDB reply length (CVE-2026-63996)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: module: avoid leaking a netdev ref on module flash errors (CVE-2026-63997)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: module: call ethnl_ops_complete() on module flash errors (CVE-2026-63998)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999)

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (CVE-2026-64003)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: Do not re-initialize smc hashtables (CVE-2026-64005)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix dst corruption in same register operation

For lshift and rshift, the shift operations are performed in a loop over32-bit words. The loop calculates the shifted value and write it to dst,and then immediately reads from src to calculate the carry for the nextiteration. Because src and dst could point to the same memory location,the carry is incorrectly calculated using the newly modified dst valueinstead of the original src value.

Adding a temporary local variable to cache the original value beforewriting to dst and using it for the carry calculation solves theproblem. In addition, partial overlap is rejected from control plane forall kind of operations including byteorder. This was tested with thefollowing bytecode:

table test_table ip flags 0 use 1 handle 1ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1ip test_table test_chain 2[ immediate reg 1 0x44332211 0x88776655 ][ bitwise reg 1 = ( reg 1 << 0x08000000 ) ][ cmp eq reg 1 0x66443322 0x00887766 ][ counter pkts 0 bytes 0 ]ip test_table test_chain 4 3[ immediate reg 1 0x44332211 0x88776655 ][ bitwise reg 1 = ( reg 1 << 0x08000000 ) ][ cmp eq reg 1 0x55443322 0x00887766 ][ counter pkts 21794 bytes 1917798 ] (CVE-2026-64006)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

synproxy_tstamp_adjust() rewrites the TCP timestamp option in placeand then patches the TCP checksum via inet_proto_csum_replace4() onthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() andipv6_synproxy_hook() obtain that pointer with skb_header_pointer()before calling in, so it may either alias skb->head directly orpoint at the caller's on-stack _tcph buffer.

Between obtaining the pointer and using it, the function callsskb_ensure_writable(skb, optend), which on a cloned or non-linearskb invokes pskb_expand_head() and frees the old skb->head. Afterthat point the cached th is stale:

caller (ipv[46]_synproxy_hook)th = skb_header_pointer(skb, ..., &_tcph)synproxy_tstamp_adjust(skb, protoff, th, ...)skb_ensure_writable(skb, optend)pskb_expand_head() /* kfree(old skb->head)
*/...inet_proto_csum_replace4(&th->check, ...)/* writes into freed head, orinto the caller's stack copyleaving the on-wire checksumstale */

The option bytes are written through skb->data and are fine; onlythe checksum update goes through th and so lands in the wrongplace. The result is either a write into freed slab memory or apacket leaving with a checksum that does not match its payload.

Fix by re-deriving th from skb->data + protoff immediately afterskb_ensure_writable() succeeds, so the subsequent checksum updatetargets the linear, writable header. (CVE-2026-64007)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Check for underflow in xfrm_state_mtu (CVE-2026-64009)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-64012)

In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find()in find_key_to_update() without holding the RCU read lock, while theassoc_array_gc() code really is designed around removing the node fromthe tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyringsemaphore hides any lifetime issues, but the persistent key handlinguses a different model.

Instead of extending the keyring locking, just do the simple RCU lockingthat the assoc_array was designed for. (CVE-2026-64015)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Blamed commit moved the TIME_WAIT-derived ISN from the skb controlblock to a per-CPU variable, assuming the value would always be consumedby tcp_conn_request() for the same packet that wrote it. That assumptionis violated by multiple drop paths between the producer(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer(tcp_conn_request()):

- min_ttl / min_hopcount check- xfrm policy check- tcp_inbound_hash() MD5/AO mismatch- tcp_filter() eBPF/SO_ATTACH_FILTER drop- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()- tcp_v{4,6}_cookie_check() returning NULL

When a packet is dropped on any of these paths, tcp_tw_isn is left set.

The next SYN processed on the same CPU then consumes the non zero value intcp_conn_request(), receiving a potentially predictable ISN.

This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpuvariable.

Note that tcp_v{4,6}_fill_cb() do not set it.

Very litle impact on overall code size/complexity:

$ scripts/bloat-o-meter -t vmlinux.old vmlinux.newadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)Function old new deltatcp_v6_rcv 3038 3042 +4tcp_v4_rcv 3035 3039 +4tcp_conn_request 2938 2923 -15Total: Before=24436060, After=24436053, chg -0.00% (CVE-2026-64024)

In the Linux kernel, the following vulnerability has been resolved:

bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() anddefers to psock->saved_data_ready when a TLS RX context is present,avoiding a conflict with the TLS strparser's ownership of the receivequeue (commit e91de6afa81c, bpf: Fix running sk_skb program typeswith ktls).

sk_psock_verdict_data_ready() has no equivalent guard. When a socketis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX isconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_readyas rx_ctx->saved_data_ready. On data arrival:

tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready-> saved_data_ready() = sk_psock_verdict_data_ready()-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()without calling tcp_eat_skb(), so copied_seq is not advanced.

tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), callstcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), andreturns with rx_ctx->strp.anchor.frag_list pointing at a psock- owned(potentially freed) skb. tls_decrypt_sg() subsequently walks thatfrag_list: use-after-free.

Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX contextis present, call psock->saved_data_ready (sock_def_readable) to wakerecv() waiters and return immediately, leaving the receive queueuntouched. TLS retains sole ownership of the queue and decrypts therecord normally through tls_sw_recvmsg(). (CVE-2026-64025)

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: rework the VALID marking (again) (CVE-2026-64027)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix managed cache race for unaligned extents (CVE-2026-64031)

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

In the Linux kernel, the following vulnerability has been resolved:

igc: set tx buffer type for SMD frames (CVE-2026-64035)

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts acaller-provided cpu argument. The function uses cpu for per-cpu rstatlookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass aninvalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==0x7fffffff triggers:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9index 2147483647 is out of range for type 'long unsigned int [64]'Call Trace:css_rstat_updatedbpf_iter_run_progcgroup_iter_seq_showbpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc andmove the common implementation to
__css_rstat_updated() for in-kernelcallers. (CVE-2026-64036)

In the Linux kernel, the following vulnerability has been resolved:

ovpn: respect peer refcount in CMD_NEW_PEER error path (CVE-2026-64044)

In the Linux kernel, the following vulnerability has been resolved:

ovpn: tcp - use cached peer pointer in ovpn_tcp_close() (CVE-2026-64045)

In the Linux kernel, the following vulnerability has been resolved:

net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046)

In the Linux kernel, the following vulnerability has been resolved:

net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

When an sk_msg scatterlist ring wraps (sg.end < sg.start),tls_push_record() chains the tail portion of the ring to the headusing sg_chain(). An extra entry in the sg array is reserved forthis:

struct sk_msg_sg {[...]/* The extra two elements:* 1) used for chaining the front and sections when the list becomes* partitioned (e.g. end < start). The crypto APIs require the* chaining;* 2) to chain tailer SG entries after the message.*/struct scatterlist data[MAX_MSG_FRAGS + 2];

The current code uses MAX_SKB_FRAGS + 1 as the ring size:

sg_chain(&msg_pl->sg.data[msg_pl->sg.start],MAX_SKB_FRAGS - msg_pl->sg.start + 1,msg_pl->sg.data);

This places the chain pointer at

sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =&data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =data[start + (MAX_SKB_FRAGS - start + 1) - 1] =data[MAX_SKB_FRAGS]

instead of the true last entry. This is likely due to a race ofthe commit under Fixes landing close tocommit 031097d9e079 (bpf: sk_msg, zap ingress queue on psock down)

Convert to ARRAY_SIZE and drop the data[start] / - start (as suggestedby Sabrina). (CVE-2026-64047)

In the Linux kernel, the following vulnerability has been resolved:

block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052)

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: reject duplicate leaves in GROUP request (CVE-2026-64054)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix folio->private handling in netfs_perform_write() (CVE-2026-64059)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix leak of request in netfs_write_begin() error handling

Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read(). (CVE-2026-64060)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix early put of sink folio in netfs_read_gaps() (CVE-2026-64061)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential deadlock in write-through mode (CVE-2026-64062)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix streaming write being overwritten (CVE-2026-64063)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (CVE-2026-64064)

In the Linux kernel, the following vulnerability has been resolved:

netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call (CVE-2026-64065)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_read_to_pagecache() to pause on subreq failure (CVE-2026-64066)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix cancellation of a DIO and single read subrequests (CVE-2026-64069)

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix use-after-free in nvme_free_host_mem() (CVE-2026-64071)

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix bio leak on mapping failure (CVE-2026-64072)

In the Linux kernel, the following vulnerability has been resolved:

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073)

In the Linux kernel, the following vulnerability has been resolved:

fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap (CVE-2026-64074)

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Fix unregister_fprobe() to wait for RCU grace period (CVE-2026-64075)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: eb_tables: close module init race (CVE-2026-64076)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: add and use xtables_unregister_table_exit

Previous change added xtables_unregister_table_pre_exit to detach thetable from the packetpath and to unlink it from the active table list.In case of rmmod, userspace that is doing set/getsockopt f ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.18 --releasever 2023.12.20260622' or or 'dnf update --advisory ALAS2023-2026-1881 --releasever 2023.12.20260622' to update your system.

Plugin Details

Severity: Medium

ID: 322087

File Name: al2023_ALAS2023-2026-1881.nasl

Version: 1.5

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/22/2026

Updated: 7/31/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-53365

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.18-debuginfo, p-cpe:/a:amazon:linux:bpftool6.18, p-cpe:/a:amazon:linux:kernel-livepatch-6.18.35-68.127, p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.18-debuginfo, p-cpe:/a:amazon:linux:kernel6.18-devel, p-cpe:/a:amazon:linux:kernel6.18-headers, p-cpe:/a:amazon:linux:kernel6.18-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.18-modules-extra, p-cpe:/a:amazon:linux:kernel6.18-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.18-tools-devel, p-cpe:/a:amazon:linux:kernel6.18-tools, p-cpe:/a:amazon:linux:kernel6.18, p-cpe:/a:amazon:linux:microvm-kernel6.18, p-cpe:/a:amazon:linux:perf6.18-debuginfo, p-cpe:/a:amazon:linux:perf6.18, p-cpe:/a:amazon:linux:python3-perf6.18-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.18

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/22/2026

Vulnerability Publication Date: 5/1/2026

Reference Information

CVE: CVE-2025-71289, CVE-2026-31709, CVE-2026-46244, CVE-2026-46315, CVE-2026-46316, CVE-2026-46317, CVE-2026-46321, CVE-2026-46322, CVE-2026-52912, CVE-2026-52915, CVE-2026-52921, CVE-2026-52923, CVE-2026-52932, CVE-2026-52937, CVE-2026-52943, CVE-2026-53277, CVE-2026-53311, CVE-2026-53360, CVE-2026-53365, CVE-2026-63875, CVE-2026-63876, CVE-2026-63877, CVE-2026-63884, CVE-2026-63885, CVE-2026-63889, CVE-2026-63896, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63937, CVE-2026-63938, CVE-2026-63939, CVE-2026-63940, CVE-2026-63950, CVE-2026-63952, CVE-2026-63962, CVE-2026-63968, CVE-2026-63969, CVE-2026-63971, CVE-2026-63980, CVE-2026-63984, CVE-2026-63985, CVE-2026-63986, CVE-2026-63987, CVE-2026-63988, CVE-2026-63989, CVE-2026-63990, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-63995, CVE-2026-63996, CVE-2026-63997, CVE-2026-63998, CVE-2026-63999, CVE-2026-64003, CVE-2026-64005, CVE-2026-64006, CVE-2026-64007, CVE-2026-64009, CVE-2026-64012, CVE-2026-64015, CVE-2026-64024, CVE-2026-64025, CVE-2026-64027, CVE-2026-64031, CVE-2026-64032, CVE-2026-64035, CVE-2026-64036, CVE-2026-64044, CVE-2026-64045, CVE-2026-64046, CVE-2026-64047, CVE-2026-64052, CVE-2026-64053, CVE-2026-64054, CVE-2026-64059, CVE-2026-64060, CVE-2026-64061, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064, CVE-2026-64065, CVE-2026-64066, CVE-2026-64069, CVE-2026-64071, CVE-2026-64072, CVE-2026-64073, CVE-2026-64074, CVE-2026-64075, CVE-2026-64076, CVE-2026-64077, CVE-2026-64078, CVE-2026-64080, CVE-2026-64081, CVE-2026-64098, CVE-2026-64104, CVE-2026-64105, CVE-2026-64106, CVE-2026-64108, CVE-2026-64109, CVE-2026-64110, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64120, CVE-2026-64121, CVE-2026-64122, CVE-2026-64124, CVE-2026-64130, CVE-2026-64131, CVE-2026-64132, CVE-2026-64136, CVE-2026-64149, CVE-2026-64150, CVE-2026-64153, CVE-2026-64156, CVE-2026-64157, CVE-2026-64158, CVE-2026-64163, CVE-2026-64164, CVE-2026-64166, CVE-2026-64172, CVE-2026-64180, CVE-2026-64181, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64186, CVE-2026-64190, CVE-2026-64217

Detections

Analytics