Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)

medium Nessus Plugin ID 341880

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2071 advisory.

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

When CONFIG_BPF_LSM=y is set, BPF inode storage maps(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,if the BPF LSM is not explicitly enabled at boot time (e.g. omittedfrom the lsm= boot parameter), lsm_prepare() is never executed forthe BPF LSM.

Consequently, the BPF inode security blob offset(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains atits default compiled size of 8 bytes instead of being updated to avalid offset past the reserved struct rcu_head (typically 16 bytesor more).

When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGEmap, bpf_inode() evaluates inode->i_security + 8. This erroneouslyaliases the struct rcu_head.func callback pointer at the beginningof the inode->i_security blob. During subsequent map element cleanupor inode destruction, writing NULL to owner_storage clears the queuedRCU callback pointer. When rcu_do_batch() later executes the queuedcallback, it attempts an instruction fetch at address 0x0, triggeringan immediate kernel panic.

Fix this by introducing a global bpf_lsm_initialized boolean flagmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()when the LSM framework successfully registers the BPF LSM. Gate mapallocation in inode_storage_map_alloc() on this flag, returning-EOPNOTSUPP if the BPF LSM is in turn uninitialized.

This fail-fast approach prevents userspace from allocating inodestorage maps when the supporting BPF LSM infrastructure is absent,avoiding zombie map states. (CVE-2026-64192)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: driver: Check ACPI_COMPANION() against NULL during probe (CVE-2026-64227)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep dynamic inner array lookups nullable (CVE-2026-64353)

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (part 1) (CVE-2026-64371)

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)

In the Linux kernel, the following vulnerability has been resolved:

vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} (CVE-2026-64532)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543)

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (CVE-2026-64544)

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)

In the Linux kernel, the following vulnerability has been resolved:

drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: fix len check in receive_big() (CVE-2026-64552)

In the Linux kernel, the following vulnerability has been resolved:

net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (CVE-2026-64555)

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Check for a stale page fault, i.e. for an invalid and/or obsolete root,after making MMU pages available for the shadow MMU. If reclaiming shadowpages zaps an in-use root, i.e. marks it invalid, then KVM will attempt tomap memory into an invalid root. On its own, populating an invalid root isfine, but because child shadow pages inherit their parent's role, anychildren created during the map/fetch will be created as invalid pages,thus violating KVM's invariant that invalid pages are never on the list ofactive MMU pages.

Note, the underlying flaw has existed since KVM first started trackinginvalid roots in 2008 (commit 2e53d63acba7, KVM: MMU: ignore zapped rootpagetables), but the true badness only came along in 2020 (Linux 5.9)with the invariant that invalid shadow pages can't be on the list ofactive pages.

Note #2, inheriting role.invalid when creating child shadow pages is alsofar from ideal; that flaw will be addressed separately. (CVE-2026-64561)

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081)

In the Linux kernel, the following vulnerability has been resolved:

binder: cache secctx size before release zeroes it (CVE-2026-68458)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reload ip header after head reallocation (CVE-2026-68476)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix more places with wrong ipv6 transport offsets (CVE-2026-68477)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: free mlx5_st_idx_data on final dealloc (CVE-2026-72006)

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (CVE-2026-72010)

In the Linux kernel, the following vulnerability has been resolved:

tracing/osnoise: Call synchronize_rcu() when unregistering (CVE-2026-72012)

In the Linux kernel, the following vulnerability has been resolved:

drbd: reject data replies with an out-of-range payload size (CVE-2026-72014)

In the Linux kernel, the following vulnerability has been resolved:

cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() (CVE-2026-72016)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (CVE-2026-72020)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: use parsed transport offset in SCTP state lookup (CVE-2026-72021)

In the Linux kernel, the following vulnerability has been resolved:

mm/compaction: handle free_pages_prepare() properly in compaction_free() (CVE-2026-72027)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, fix matcher leak on resize target setup failure (CVE-2026-72032)

In the Linux kernel, the following vulnerability has been resolved:

fhandle: reject detached mounts in capable_wrt_mount() (CVE-2026-72034)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72035)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-72036)

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix refcount leak in i_ipmi_request() (CVE-2026-72040)

In the Linux kernel, the following vulnerability has been resolved:

espintcp: use sk_msg_free_partial to fix partial send (CVE-2026-72041)

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix user refcount underflow in event delivery (CVE-2026-72042)

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051)

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

In the Linux kernel, the following vulnerability has been resolved:

net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053)

In the Linux kernel, the following vulnerability has been resolved:

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72054)

In the Linux kernel, the following vulnerability has been resolved:

net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72055)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: preserve tc_skb_cb across defragmentation (CVE-2026-72057)

In the Linux kernel, the following vulnerability has been resolved:

net: sit: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72061)

In the Linux kernel, the following vulnerability has been resolved:

gpio: tegra: do not call pinctrl for GPIO direction (CVE-2026-72063)

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066)

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Preserve per instance callback errors (CVE-2026-72067)

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() (CVE-2026-72068)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Fix use-after-free in user_event_mm_dup() (CVE-2026-72071)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084)

In the Linux kernel, the following vulnerability has been resolved:

dma-fence: Make dma_fence_dedup_array() robust against 0-count input (CVE-2026-72095)

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: make error counter atomic (CVE-2026-72096)

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: fix a possible NULL pointer dereference (CVE-2026-72097)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix a bug if the bio is out of limits (CVE-2026-72100)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix leaking uninitialized kernel memory (CVE-2026-72101)

In the Linux kernel, the following vulnerability has been resolved:

dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

In the Linux kernel, the following vulnerability has been resolved:

dm-log: fix a bitset_size overflow on 32bit machines (CVE-2026-72105)

In the Linux kernel, the following vulnerability has been resolved:

dm-ioctl: fix a possible overflow in list_version_get_info (CVE-2026-72106)

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure (CVE-2026-72108)

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it (CVE-2026-72110)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reset register bounds before narrowing retval range in check_mem_access() (CVE-2026-72111)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing rcu list annotations and operations (CVE-2026-72120)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123)

In the Linux kernel, the following vulnerability has been resolved:

netdev-genl: report NAPI thread PID in the caller's pid namespace (CVE-2026-72127)

In the Linux kernel, the following vulnerability has been resolved:

NFS: Charge unstable writes by request size, not folio size (CVE-2026-72132)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72136)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: nat_keepalive: avoid double free on send error (CVE-2026-72137)

In the Linux kernel, the following vulnerability has been resolved:

xen/gntdev: fix error handling in ioctl (CVE-2026-72138)

In the Linux kernel, the following vulnerability has been resolved:

tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (CVE-2026-72139)

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix uninitialized xprt_create_args structure (CVE-2026-72150)

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt (CVE-2026-72151)

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (CVE-2026-72152)

In the Linux kernel, the following vulnerability has been resolved:

mtd: spi-nor: swp: Improve locking user experience (CVE-2026-72155)

In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172)

In the Linux kernel, the following vulnerability has been resolved:

fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (CVE-2026-72174)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (CVE-2026-72176)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (CVE-2026-72177)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: always put unsuccessfully committed target pids (CVE-2026-72178)

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path (CVE-2026-72183)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: validate split-point offset in indx_insert_into_buffer (CVE-2026-72191)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head (CVE-2026-72192)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: cap RESTART_TABLE free-chain walker at rt->used (CVE-2026-72193)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow (CVE-2026-72194)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound attr_off in UpdateResidentValue against data_off (CVE-2026-72195)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass (CVE-2026-72196)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length (CVE-2026-72197)

In the Linux kernel, the following vulnerability has been resolved:

mm/memory_hotplug: fix incorrect altmap passing in error path (CVE-2026-72212)

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (CVE-2026-72213)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (CVE-2026-72217)

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218)

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlm_file leak when nlm_do_fopen() fails (CVE-2026-72219)

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: harden rq_procinfo lifecycle to prevent double-free (CVE-2026-72220)

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Free arena sub-allocations on discover_arenas() error path (CVE-2026-72223)

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Free arenas on btt_init() error paths (CVE-2026-72224)

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (CVE-2026-72225)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: mcast: avoid OOB read of num_dests header (CVE-2026-72227)

In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

In the Linux kernel, the following vulnerability has been resolved:

selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: fix zone comparison in tuple dedup (CVE-2026-72247)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (CVE-2026-72250)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_nat_sip: reload possible stale data pointer (CVE-2026-72251)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_cluster: reject template conntracks in hash match (CVE-2026-72256)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: vesafb: fix memory leak in vesafb_probe() (CVE-2026-72266)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: efifb: fix memory leak in efifb_probe() (CVE-2026-72273)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (CVE-2026-72274)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (CVE-2026-72275)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (CVE-2026-72276)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory (CVE-2026-72277)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Re-translate VNCR before injecting abort (CVE-2026-72278)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR (CVE-2026-72279)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (CVE-2026-72280)

In the Linux kernel, the following vulnerability has been resolved:

KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (CVE-2026-72282)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails (CVE-2026-72283)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (CVE-2026-72284)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (CVE-2026-72286)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (CVE-2026-72290)

In the Linux kernel, the following vulnerability has been resolved:

net: ife: require ETH_HLEN to be pullable in ife_decode() (CVE-2026-72296)

In the Linux kernel, the following vulnerability has been resolved:

tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix overflow in passthrough ioctl bounds check (CVE-2026-72310)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

In the Linux kernel, the following vulnerability has been resolved:

cifs: validate DFS referral string offsets (CVE-2026-72318)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: ensure inner headers in ICMP errors are in headroom (CVE-2026-72319)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: Fix potential UAF in MLD delayed work (CVE-2026-72322)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323)

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (CVE-2026-72325)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cake: reject overhead values that underflow length (CVE-2026-72326)

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Consume empty data records in tls_sw_read_sock() (CVE-2026-72330)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload (CVE-2026-72338)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix HV VHCA stats agent registration race (CVE-2026-72342)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_connmark: reject invalid shift parameters (CVE-2026-72347)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (CVE-2026-72348)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (CVE-2026-72349)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_u32: reject invalid shift counts (CVE-2026-72350)

In the Linux kernel, the following vulnerability has been resolved:

gue: validate REMCSUM private option length (CVE-2026-72351)

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: Fix hid_bpf_get_data() range check (CVE-2026-72352)

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix missing credit release on failure in cifs_issue_read() (CVE-2026-72356)

In the Linux kernel, the following vulnerability has been resolved:

uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline (CVE-2026-72357)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix folio state after ENOMEM whilst under writeback iteration (CVE-2026-72363)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix writeback error handling (CVE-2026-72364)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix writethrough to use collection offload (CVE-2026-72365)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_create_write_req() to handle async cache object creation (CVE-2026-72366)

In the Linux kernel, the following vulnerability has been resolved:

iomap: guard io_size EOF trim against concurrent truncate underflow (CVE-2026-72367)

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix reinitialisation o ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.18 --releasever 2023.12.20260831' or or 'dnf update --advisory ALAS2023-2026-2071 --releasever 2023.12.20260831' to update your system.

Plugin Details

Severity: Medium

ID: 341880

File Name: al2023_ALAS2023-2026-2071.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 8/31/2026

Updated: 8/31/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.68

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64227

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.18-debuginfo, p-cpe:/a:amazon:linux:bpftool6.18, p-cpe:/a:amazon:linux:kernel-livepatch-6.18.41-94.142, p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.18-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.18-debuginfo, p-cpe:/a:amazon:linux:kernel6.18-devel, p-cpe:/a:amazon:linux:kernel6.18-headers, p-cpe:/a:amazon:linux:kernel6.18-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.18-modules-extra, p-cpe:/a:amazon:linux:kernel6.18-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.18-tools-devel, p-cpe:/a:amazon:linux:kernel6.18-tools, p-cpe:/a:amazon:linux:kernel6.18, p-cpe:/a:amazon:linux:microvm-kernel6.18, p-cpe:/a:amazon:linux:perf6.18-debuginfo, p-cpe:/a:amazon:linux:perf6.18, p-cpe:/a:amazon:linux:python3-perf6.18-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.18

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/31/2026

Vulnerability Publication Date: 6/24/2026

Reference Information

CVE: CVE-2026-53005, CVE-2026-64192, CVE-2026-64227, CVE-2026-64287, CVE-2026-64352, CVE-2026-64353, CVE-2026-64371, CVE-2026-64375, CVE-2026-64472, CVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64538, CVE-2026-64542, CVE-2026-64543, CVE-2026-64544, CVE-2026-64545, CVE-2026-64546, CVE-2026-64548, CVE-2026-64551, CVE-2026-64552, CVE-2026-64553, CVE-2026-64555, CVE-2026-64560, CVE-2026-64561, CVE-2026-68081, CVE-2026-68458, CVE-2026-68476, CVE-2026-68477, CVE-2026-72006, CVE-2026-72010, CVE-2026-72012, CVE-2026-72014, CVE-2026-72016, CVE-2026-72020, CVE-2026-72021, CVE-2026-72027, CVE-2026-72032, CVE-2026-72034, CVE-2026-72035, CVE-2026-72036, CVE-2026-72040, CVE-2026-72041, CVE-2026-72042, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054, CVE-2026-72055, CVE-2026-72057, CVE-2026-72061, CVE-2026-72063, CVE-2026-72066, CVE-2026-72067, CVE-2026-72068, CVE-2026-72071, CVE-2026-72072, CVE-2026-72083, CVE-2026-72084, CVE-2026-72095, CVE-2026-72096, CVE-2026-72097, CVE-2026-72099, CVE-2026-72100, CVE-2026-72101, CVE-2026-72102, CVE-2026-72105, CVE-2026-72106, CVE-2026-72108, CVE-2026-72110, CVE-2026-72111, CVE-2026-72120, CVE-2026-72123, CVE-2026-72127, CVE-2026-72132, CVE-2026-72136, CVE-2026-72137, CVE-2026-72138, CVE-2026-72139, CVE-2026-72150, CVE-2026-72151, CVE-2026-72152, CVE-2026-72155, CVE-2026-72172, CVE-2026-72174, CVE-2026-72176, CVE-2026-72177, CVE-2026-72178, CVE-2026-72183, CVE-2026-72191, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194, CVE-2026-72195, CVE-2026-72196, CVE-2026-72197, CVE-2026-72212, CVE-2026-72213, CVE-2026-72217, CVE-2026-72218, CVE-2026-72219, CVE-2026-72220, CVE-2026-72221, CVE-2026-72222, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72227, CVE-2026-72242, CVE-2026-72243, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251, CVE-2026-72252, CVE-2026-72255, CVE-2026-72256, CVE-2026-72266, CVE-2026-72273, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276, CVE-2026-72277, CVE-2026-72278, CVE-2026-72279, CVE-2026-72280, CVE-2026-72282, CVE-2026-72283, CVE-2026-72284, CVE-2026-72286, CVE-2026-72288, CVE-2026-72289, CVE-2026-72290, CVE-2026-72296, CVE-2026-72299, CVE-2026-72310, CVE-2026-72317, CVE-2026-72318, CVE-2026-72319, CVE-2026-72320, CVE-2026-72321, CVE-2026-72322, CVE-2026-72323, CVE-2026-72325, CVE-2026-72326, CVE-2026-72330, CVE-2026-72338, CVE-2026-72341, CVE-2026-72342, CVE-2026-72343, CVE-2026-72347, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350, CVE-2026-72351, CVE-2026-72352, CVE-2026-72356, CVE-2026-72357, CVE-2026-72363, CVE-2026-72364, CVE-2026-72365, CVE-2026-72366, CVE-2026-72367, CVE-2026-72375, CVE-2026-72379, CVE-2026-72383, CVE-2026-72385, CVE-2026-72389, CVE-2026-72390, CVE-2026-72392, CVE-2026-72398, CVE-2026-72400, CVE-2026-72405, CVE-2026-72416, CVE-2026-72418, CVE-2026-72419, CVE-2026-72420, CVE-2026-72421, CVE-2026-72425, CVE-2026-72427, CVE-2026-72428, CVE-2026-72433, CVE-2026-72434, CVE-2026-72435, CVE-2026-72436, CVE-2026-72437, CVE-2026-72444, CVE-2026-72447, CVE-2026-72450, CVE-2026-72451, CVE-2026-72452, CVE-2026-72466, CVE-2026-72470, CVE-2026-72472, CVE-2026-72476, CVE-2026-72478, CVE-2026-72487, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74257, CVE-2026-74259, CVE-2026-74262, CVE-2026-74264, CVE-2026-74266, CVE-2026-74267, CVE-2026-74268, CVE-2026-74270, CVE-2026-74271, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74286, CVE-2026-74287, CVE-2026-74288, CVE-2026-74290, CVE-2026-74296, CVE-2026-74297, CVE-2026-74305, CVE-2026-74308, CVE-2026-74310, CVE-2026-74316, CVE-2026-74318, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329, CVE-2026-74330, CVE-2026-74331, CVE-2026-74335, CVE-2026-74337, CVE-2026-74344, CVE-2026-74346, CVE-2026-74352, CVE-2026-74355, CVE-2026-74356, CVE-2026-74358, CVE-2026-74359, CVE-2026-74360, CVE-2026-74361, CVE-2026-74363, CVE-2026-74364, CVE-2026-74365, CVE-2026-74371, CVE-2026-74372, CVE-2026-74376, CVE-2026-74379, CVE-2026-74380, CVE-2026-74382, CVE-2026-74383, CVE-2026-74384, CVE-2026-74393, CVE-2026-74395, CVE-2026-74396, CVE-2026-74397, CVE-2026-74398, CVE-2026-74399, CVE-2026-74400, CVE-2026-74405, CVE-2026-74406, CVE-2026-74417, CVE-2026-74424, CVE-2026-74439, CVE-2026-74578

Detections

Analytics