Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)

high Nessus Plugin ID 325574

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of kernel installed on the remote host is prior to 5.10.259-258.1043. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-124 advisory.

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449)

In the Linux kernel, the following vulnerability has been resolved:

ext4: validate p_idx bounds in ext4_ext_correct_indexes (CVE-2026-31449)

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (CVE-2026-31708)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: require a full NFS mode SID before reading mode bits (CVE-2026-43350)

In the Linux kernel, the following vulnerability has been resolved:

lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)

In the Linux kernel, the following vulnerability has been resolved:

udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

In the Linux kernel, the following vulnerability has been resolved:

thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021)

In the Linux kernel, the following vulnerability has been resolved:

ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)

In the Linux kernel, the following vulnerability has been resolved:

dm-thin: fix metadata refcount underflow (CVE-2026-46107)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (CVE-2026-46159)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160)

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix uninit-value by validating catalog record size (CVE-2026-46169)

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Avoid OOB font access if console rotation fails (CVE-2026-46191)

In the Linux kernel, the following vulnerability has been resolved:

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196)

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292)

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix held lock freed on hfsplus_fill_super() (CVE-2026-46299)

In the Linux kernel, the following vulnerability has been resolved:

tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

In the Linux kernel, the following vulnerability has been resolved:

ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

In the Linux kernel, the following vulnerability has been resolved:

sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebtables: fix OOB read in compat_mtw_from_user (CVE-2026-52927)

In the Linux kernel, the following vulnerability has been resolved:

sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

In the Linux kernel, the following vulnerability has been resolved:

ipc/shm: serialize orphan cleanup with shm_nattch updates (CVE-2026-52930)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943)

In the Linux kernel, the following vulnerability has been resolved:

fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (CVE-2026-52946)

In the Linux kernel, the following vulnerability has been resolved:

i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (CVE-2026-52948)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_fw: fix NULL dereference of old filters before change() (CVE-2026-53080)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix truncation for block sizes >= 4G (CVE-2026-53133)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_fib: fix stale stack leak via the OIFNAME register (CVE-2026-53134)

In the Linux kernel, the following vulnerability has been resolved:

fuse: reject fuse_notify() pagecache ops on directories (CVE-2026-53168)

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srp: bound SRP_RSP sense copy by the received length (CVE-2026-53186)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: kl5kusb105: fix bulk-out buffer overflow (CVE-2026-53194)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (CVE-2026-53195)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

In the Linux kernel, the following vulnerability has been resolved:

hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (CVE-2026-53199)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_tunnel: fix use-after-free on object destroy (CVE-2026-53212)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (CVE-2026-53218)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: avoid leaking percpu counter pointers (CVE-2026-53219)

In the Linux kernel, the following vulnerability has been resolved:

ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (CVE-2026-53221)

In the Linux kernel, the following vulnerability has been resolved:

net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (CVE-2026-53225)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix possible kfree_skb of ERR_PTR (CVE-2026-53227)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

In the Linux kernel, the following vulnerability has been resolved:

netlabel: validate unlabeled address and mask attribute lengths (CVE-2026-53238)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

In the Linux kernel, the following vulnerability has been resolved:

net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (CVE-2026-53245)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (CVE-2026-53249)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: make ebt_snat ARP rewrite writable (CVE-2026-53266)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: add mutex to guard hook reference counting (CVE-2026-53269)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix NULL pointer dereference in bond_do_ioctl()

In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() whichcan return NULL if the requested interface name does not exist. However,the subsequent slave_dbg() call is placed before the NULL check:

slave_dev = __dev_get_by_name(net, ifr->ifr_slave);slave_dbg(bond_dev, slave_dev, slave_dev=%p:\n, slave_dev); //hereif (!slave_dev)return -ENODEV;

The slave_dbg() macro expands to netdev_dbg(bond_dev, (slave %s): fmt,(slave_dev)->name, ...) which unconditionally dereferences slave_dev->namebefore the NULL check is performed. This results in a NULL pointerdereference kernel oops when a user calls bonding ioctl (e.g.SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slaveinterface name.

This is reachable from userspace via the bonding ioctl interface withCAP_NET_ADMIN capability, making it a potential local denial-of-servicevector.

Fix by moving the slave_dbg() call after the NULL check. (CVE-2026-53337)

In the Linux kernel, the following vulnerability has been resolved:

signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

When a multi-threaded process receives a stop signal (e.g., SIGSTOP),do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on allthreads and sets signal->group_stop_count to the number of threads. Ifone of the threads concurrently calls execve(), de_thread() invokeszap_other_threads() to kill all other threads. zap_other_threads()aborts the pending group stop by resetting signal->group_stop_count to 0and clears the JOBCTL_PENDING_MASK for all other threads. However, itfails to clear the job control flags for the calling thread.

When execve() completes, the calling thread returns to user mode andchecks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag,it calls do_signal_stop(), which invokes task_participate_group_stop().Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement thealready- zero signal->group_stop_count, triggering a warning:

sig->group_stop_count == 0WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373task_participate_group_stop+0x215/0x2d0Call Trace:<TASK>do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619get_signal+0xa8c/0x1330 kernel/signal.c:2884arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100entry_SYSCALL_64_after_hwframe+0x77/0x7f</TASK>

Fix this race condition by clearing the JOBCTL_PENDING_MASK for thecalling thread in zap_other_threads(), ensuring it does not retain anystale job control state after the thread group is destroyed. This alignswith other functions that tear down a thread group and abort groupstops, such as zap_process() and complete_signal(), which correctlyclear these flags for all threads including the current one.
(CVE-2026-53352)

In the Linux kernel, the following vulnerability has been resolved:

arm64: errata: Mitigate TLBI errata on various Arm CPUs

A number of CPUs developed by Arm suffer from errata whereby a broadcastTLBI;DSB sequence may complete before the global observation of writeswhich are translated by an affected TLB entry.

These errata ONLY affect the completion of memory accesses which havebeen translated by an invalidated TLB entry, and these errata DO NOTaffect the actual invalidation of TLB entries. TLB entries are removedcorrectly.

This issue has been assigned CVE ID CVE-2025-10263.

To mitigate this issue, Arm recommends that software follows anyaffected TLBI;DSB sequence with an additional TLBI;DSB, which willensure that all memory write effects affected by the first TLBI havebeen globally observed. The additional TLBI can use any operation thatis broadcast to affected CPUs, and the additional DSB can use any optionthat is sufficient to complete the additional TLBI.

The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigatethe issue. Enable this workaround for affected CPUs, and update thesilicon errata documentation accordingly.

Note that due to the manner in which Arm develops IP and tracks errata,some CPUs share a common erratum number. (CVE-2026-53354)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

In the Linux kernel, the following vulnerability has been resolved:

net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

The receive-side GARP attribute parser computes dlen with reversedoperands:

dlen = sizeof(*ga) - ga->len;

ga->len is the on-wire attribute length and includes the GARP attributeheader. For normal attributes with data, ga->len is larger thansizeof(*ga), so the subtraction underflows in unsigned arithmetic.

The resulting value is later passed to garp_attr_lookup(), whose lengthargument is u8. After truncation, the parsed data length usually nolonger matches the length stored for locally registered attributes, soreceived Join/Leave events are ignored. This breaks the GARP receive pathfor common attributes, such as GVRP VLAN registration attributes.

Compute the data length as the attribute length minus the header length. (CVE-2026-63868)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)

In the Linux kernel, the following vulnerability has been resolved:

scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced thedescriptor cursor by an attacker- supplied fip_dlen without everrequiring dlen >= sizeof(struct fip_desc) in the default branch. Thenamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checkedtheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor(fip_dtype >= 128, which the standard requires receivers to silentlyignore) skipped that check entirely.

An unauthenticated L2 peer on the FCoE control VLAN could hangfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitelyby emitting one FIP CVL frame whose single descriptor had fip_dtype ==FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytesper iteration and the loop condition rlen >= sizeof(*desc) stayed trueforever, blocking every subsequent FIP frame on that controller.

Tighten the outer dlen guard to also reject dlen < sizeof(structfip_desc), so a malformed descriptor whose length cannot even cover thedescriptor header is rejected before the switch. This is the samelower-bound the named cases already apply and is the minimum scope thatcloses the loop. (CVE-2026-63890)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Add the missing sanity check on the size of interrupt-in transfers toavoid parsing stale or uninitialised slab data (and leaking it to userspace). (CVE-2026-63897)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: mct_u232: fix memory corruption with small endpoint (CVE-2026-63898)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: keyspan: fix missing indat transfer sanity check

Add the missing sanity check on the size of usa49wg indat transfers toavoid parsing stale or uninitialised slab data. (CVE-2026-63900)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix memory corruption with small endpoints

Add the missing bulk-out buffer size sanity checks to avoidout-of-bounds memory accesses or slab corruption should a maliciousdevice report smaller buffers than expected. (CVE-2026-63901)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: cypress_m8: validate interrupt packet headers

cypress_read_int_callback() parses the interrupt-in buffer according tothe selected Cypress packet format.
Format 1 has a two-byte status/countheader and format 2 has a one-byte combined status/count header.
Theusb-serial core sizes the interrupt-in buffer from the endpointdescriptor's wMaxPacketSize, and successful interrupt transfers cancomplete short when URB_SHORT_NOT_OK is not set.

Check that the completed packet contains the selected header beforereading it. Malformed short reports are ignored and the interrupt URB isresubmitted through the existing retry path, preventing out-of- boundsheader-byte reads.

KASAN report as below:KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0Read of size 1Call trace:cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009)__usb_hcd_giveback_urb()dummy_timer()

[ johan: use constants in header length sanity checks ] (CVE-2026-63902)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: belkin_sa: validate interrupt status length

The Belkin interrupt callback treats interrupt data as a four-bytestatus report and reads LSR/MSR fields at offsets 2 and 3. Theinterrupt-in buffer length is derived from endpoint wMaxPacketSize, andshort interrupt transfers may complete successfully with a smalleractual_length.

Check the completed interrupt packet length before parsing statusfields so short interrupt endpoints and short successful packets areignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()Read of size 1Call trace:belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)__usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)dummy_timer() (?:?) (CVE-2026-63903)

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: check URB actual_length for interrupt-IN notifications

USBTMC devices can use an optional interrupt endpoint for notificationmessages. These typically contain two-byte headers indicating thepayload format, but the driver does not check if these headers arepresent before accessing the data buffers. In cases where the URBactual_length is not enough to fit these headers, the driver will eithercause an out-of-bounds read, or consume stale leftover data from aprevious notification.

Fix by checking if actual_data contains enough bytes for the headers,otherwise resubmit URB to the interrupt endpoint. (CVE-2026-63904)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()before esp_output_tail() allocates the destination page frag. Thehead-side gate currently checks skb->data_len and tailen separately, butthe tail code allocates a single destination frag from the combinedpost-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds apage. Otherwise skb_page_frag_refill() may fall back to a single page whilethe destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6. (CVE-2026-63912)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: route MIGRATE notifications to caller's netns (CVE-2026-63914)

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODEusage is always located in the first field (field[0]) of the feature report.However, a device can specify HID_DG_INPUTMODE in a different field.

If HID_DG_INPUTMODE is in a field other than the first one and the firstfield has a report_count smaller than the usage_index of HID_DG_INPUTMODE,this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID_DG_INPUTMODE in 'structhid_data' during feature mapping. In wacom_hid_set_device_mode(), usethis stored field index to access the correct field and add boundschecks to ensure both the field index and the value index are withinvalid ranges before writing. (CVE-2026-63916)

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_changelink(). (CVE-2026-63917)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

In the Linux kernel, the following vulnerability has been resolved:

ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

After patch 1/2 in this series, vti6_update() unlinks and relinksthe tunnel through t->net.
vti6_siocdevprivate() still usesdev_net(dev) for the collision lookup. For a tunnel moved throughIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.

SIOCCHGTUNNEL on a migrated tunnel then runs:

net = dev_net(dev) /* migrated netns */t = vti6_locate(net, &p1, false) /* misses target in t->net */...t = netdev_priv(dev)vti6_update(t, &p1, false) /* mutates t->net's hash
*/

A caller in the migrated netns picks params that match a tunnelin the creation netns. The lookup in dev_net(dev) finds nothing.vti6_update() prepends the migrated tunnel at the head of thecreation netns hash bucket for those params. Later lookups inthe creation netns resolve to the migrated device. xfrm receivedelivers the matched packets through a device the caller controls.

Reachable from an unprivileged user namespace (unshare --user--map-root-user --net). Cross tenant scope on container hosts.

Switch the SIOCCHGTUNNEL path on a non fallback device to uset->net for the lookup. The lookup now matches the netnsvti6_update() operates on.

Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) beforethe lookup. The check at the top of the case is againstdev_net(dev)->user_ns, which after migration is the attacker'snetns. A caller there can pick params absent from self->net,the lookup returns NULL, t becomes self, and vti6_update()inserts the device into the creation netns hash. The new checkrequires CAP_NET_ADMIN in the creation netns user_ns too.

SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keepdev_net(dev), which equals init_net there.
(CVE-2026-63921)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.Let's recompute nh pointer to make sure any change won't mess things up. (CVE-2026-63924)

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

In the Linux kernel, the following vulnerability has been resolved:

bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

When bpf_msg_push_data() inserts data in the middle of a scatterlistentry, it splits the original entry into a left fragment and a rightfragment.

The right fragment offset is page-local, but the code advances it with`start`, which is the message-global insertion point. For inserts into anon-first SG entry, this over-advances the offset and leaves the splitlayout inconsistent.

Advance the right fragment offset by the fragment-local delta,`start - offset`, which matches the length removed from the front of theoriginal entry. (CVE-2026-63926)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: omninet: fix memory corruption with small endpoint

Make sure that the bulk-out buffers are at least as large as thehardcoded transfer size to avoid user- controlled slab corruption shoulda malicious device report a smaller endpoint max packet size thanexpected. (CVE-2026-63928)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: cypress_m8: fix memory corruption with small endpoint

Make sure that the interrupt-out endpoint max packet size is at leasteight bytes to avoid user-controlled slab corruption or NULL-pointerdereference should a malicious device report a smaller size.
(CVE-2026-63956)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: safe_serial: fix memory corruption with small endpoint (CVE-2026-63957)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix race between sctp_wait_for_connect and peeloff

sctp_wait_for_connect() drops and re-acquires the socket lock whilewaiting for the association to reach ESTABLISHED state. During thiswindow, another thread can peeloff the association to a new socket viagetsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. Afterre-acquiring the old socket lock, sctp_wait_for_connect() returnssuccess without noticing the migration -- the caller then accessesthe association under the wrong lock in sctp_datamsg_from_user().

Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()already has, returning an error if the association was migrated whilewe slept. (CVE-2026-63971)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_d ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update kernel' or or 'yum update --advisory ALAS2KERNEL-5.10-2026-124' to update your system.

Plugin Details

Severity: High

ID: 325574

File Name: al2_ALASKERNEL-5_10-2026-124.nasl

Version: 1.6

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 7/8/2026

Updated: 8/13/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53196

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-53195

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-livepatch-5.10.259-258.1043, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:python-perf-debuginfo, p-cpe:/a:amazon:linux:python-perf

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/8/2026

Vulnerability Publication Date: 4/3/2026

Reference Information

CVE: CVE-2026-23449, CVE-2026-31449, CVE-2026-31533, CVE-2026-31708, CVE-2026-43350, CVE-2026-43492, CVE-2026-45850, CVE-2026-45991, CVE-2026-46021, CVE-2026-46052, CVE-2026-46086, CVE-2026-46107, CVE-2026-46137, CVE-2026-46159, CVE-2026-46160, CVE-2026-46169, CVE-2026-46191, CVE-2026-46196, CVE-2026-46292, CVE-2026-46299, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52910, CVE-2026-52912, CVE-2026-52923, CVE-2026-52924, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52943, CVE-2026-52946, CVE-2026-52948, CVE-2026-53080, CVE-2026-53133, CVE-2026-53134, CVE-2026-53168, CVE-2026-53176, CVE-2026-53186, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53199, CVE-2026-53212, CVE-2026-53218, CVE-2026-53219, CVE-2026-53221, CVE-2026-53223, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53238, CVE-2026-53239, CVE-2026-53245, CVE-2026-53249, CVE-2026-53264, CVE-2026-53266, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53337, CVE-2026-53352, CVE-2026-53354, CVE-2026-53356, CVE-2026-63868, CVE-2026-63887, CVE-2026-63888, CVE-2026-63890, CVE-2026-63897, CVE-2026-63898, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63928, CVE-2026-63956, CVE-2026-63957, CVE-2026-63971, CVE-2026-63984, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64002, CVE-2026-64005, CVE-2026-64007, CVE-2026-64009, CVE-2026-64012, CVE-2026-64118, CVE-2026-64170

Detections

Analytics

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)

high Nessus Plugin ID 325574

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

Vulnerability Information

Reference Information