Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

medium Nessus Plugin ID 345814

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory.

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

When CONFIG_BPF_LSM=y is set, BPF inode storage maps(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,if the BPF LSM is not explicitly enabled at boot time (e.g. omittedfrom the lsm= boot parameter), lsm_prepare() is never executed forthe BPF LSM.

Consequently, the BPF inode security blob offset(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains atits default compiled size of 8 bytes instead of being updated to avalid offset past the reserved struct rcu_head (typically 16 bytesor more).

When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGEmap, bpf_inode() evaluates inode->i_security + 8. This erroneouslyaliases the struct rcu_head.func callback pointer at the beginningof the inode->i_security blob. During subsequent map element cleanupor inode destruction, writing NULL to owner_storage clears the queuedRCU callback pointer. When rcu_do_batch() later executes the queuedcallback, it attempts an instruction fetch at address 0x0, triggeringan immediate kernel panic.

Fix this by introducing a global bpf_lsm_initialized boolean flagmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()when the LSM framework successfully registers the BPF LSM. Gate mapallocation in inode_storage_map_alloc() on this flag, returning-EOPNOTSUPP if the BPF LSM is in turn uninitialized.

This fail-fast approach prevents userspace from allocating inodestorage maps when the supporting BPF LSM infrastructure is absent,avoiding zombie map states. (CVE-2026-64192)

In the Linux kernel, the following vulnerability has been resolved:

mm: do file ownership checks with the proper mount idmap (CVE-2026-64294)

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Support for hardening against JIT spraying (CVE-2026-64508)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543)

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Detach event groups during remove_on_exec

perf_event_remove_on_exec() removes events by callingperf_event_exit_event(). For top-level events, this removes the event fromthe context with DETACH_EXIT only.

This can leave inconsistent group state when a removed event is a groupleader and the group contains siblings without remove_on_exec. If the groupwas active, the surviving siblings can remain active and attached to theremoved leader's sibling list, but are no longer represented by a validgroup leader on the PMU context active lists.

A later close of the removed leader uses DETACH_GROUP and can promote thestill-active siblings from this stale group state. The next schedule-in canthen add an already-linked active_list entry again, corrupting the PMUcontext active list.

With DEBUG_LIST enabled, this is caught as a list_add double-add inmerge_sched_in().

Fix this by detaching group relationships when remove_on_exec removes anevent. This preserves the existing task-exit and revoke behavior, whileensuring surviving siblings are ungrouped before the removed event leavesthe context. (CVE-2026-64556)

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)

In the Linux kernel, the following vulnerability has been resolved:

rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: reject free space cache with more entries than pages (CVE-2026-64567)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

In the Linux kernel, the following vulnerability has been resolved:

nexthop: initialize extack in nh_res_bucket_migrate() (CVE-2026-64576)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579)

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (CVE-2026-64580)

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (CVE-2026-68093)

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe() (CVE-2026-68096)

In the Linux kernel, the following vulnerability has been resolved:

tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

In the Linux kernel, the following vulnerability has been resolved:

pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

In the Linux kernel, the following vulnerability has been resolved:

ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127)

In the Linux kernel, the following vulnerability has been resolved:

super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

In the Linux kernel, the following vulnerability has been resolved:

geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146)

In the Linux kernel, the following vulnerability has been resolved:

libceph: remove debugfs files before client teardown (CVE-2026-68153)

In the Linux kernel, the following vulnerability has been resolved:

libceph: reject zero bucket types in crush_decode (CVE-2026-68154)

In the Linux kernel, the following vulnerability has been resolved:

libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

In the Linux kernel, the following vulnerability has been resolved:

libceph: guard missing CRUSH type name lookup (CVE-2026-68157)

In the Linux kernel, the following vulnerability has been resolved:

libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158)

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: disallow overlapping input ranges for damon_set_regions() (CVE-2026-68164)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: validate ranges in damon_set_regions() (CVE-2026-68165)

In the Linux kernel, the following vulnerability has been resolved:

cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (CVE-2026-68184)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: set have_execfd only once the interpreter is opened (CVE-2026-68186)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (CVE-2026-68243)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Do not leak siblings[] on proto context error (CVE-2026-68244)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Return NULL on error in active_instance (CVE-2026-68248)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: bound EDID block reads to the response buffer (CVE-2026-68255)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Add missing nospec on parallel submit slot (CVE-2026-68269)

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (CVE-2026-68277)

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (CVE-2026-68279)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297)

In the Linux kernel, the following vulnerability has been resolved:

sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320)

In the Linux kernel, the following vulnerability has been resolved:

rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322)

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Bound the early ACPI HID map (CVE-2026-68325)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix devconf_all NULL dereference when IPv6 is disabled (CVE-2026-68336)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate DFS referral PathConsumed (CVE-2026-68343)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject unhashed UDP sockets on sockmap update (CVE-2026-68386)

In the Linux kernel, the following vulnerability has been resolved:

smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (CVE-2026-68422)

In the Linux kernel, the following vulnerability has been resolved:

IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Fix use-after-free on vendor module reload (CVE-2026-68428)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound get_version reply decode to front len (CVE-2026-68433)

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate vmw_surface_metadata::array_size (CVE-2026-68446)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: free mapping node on duplicate reloc root insert (CVE-2026-68450)

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: Reject an invalid concurrent positioning ranges count (CVE-2026-72030)

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix refcount leak in i_ipmi_request() (CVE-2026-72040)

In the Linux kernel, the following vulnerability has been resolved:

dm-verity: make error counter atomic (CVE-2026-72096)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it (CVE-2026-72110)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing device refcount for CAN filter removal (CVE-2026-72113)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: validate frame length in bcm_rx_setup() for RTR replies (CVE-2026-72114)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: track a single source interface for ANYDEV timeout/throttle ops (CVE-2026-72115)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix stale rx/tx ops after device removal (CVE-2026-72116)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() (CVE-2026-72117)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix CAN frame rx/tx statistics (CVE-2026-72118)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates (CVE-2026-72119)

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add locking when updating filter and timer values (CVE-2026-72121)

In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (CVE-2026-72172)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: validate split-point offset in indx_insert_into_buffer (CVE-2026-72191)

In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (CVE-2026-72253)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

In the Linux kernel, the following vulnerability has been resolved:

tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392)

In the Linux kernel, the following vulnerability has been resolved:

sctp: add INIT verification after cookie unpacking (CVE-2026-72398)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347)

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer (CVE-2026-74443)

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (CVE-2026-74444)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465)

In the Linux kernel, the following vulnerability has been resolved:

sctp: prevent peer transport count overflow (CVE-2026-74469)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475)

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP (CVE-2026-74476)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

In the Linux kernel, the following vulnerability has been resolved:

mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: reject a flag character as the field delimiter (CVE-2026-74485)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: restore write access when removing an entry (CVE-2026-74487)

In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492)

In the Linux kernel, the following vulnerability has been resolved:

audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: don't free uninitialized dev_name on error path (CVE-2026-74519)

In the Linux kernel, the following vulnerability has been resolved:

net: do not send ICMP/NDISC Redirects when peer allocation fails (CVE-2026-74550)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557)

In the Linux kernel, the following vulnerability has been resolved:

rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)

In the Linux kernel, the following vulnerability has been resolved:

keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566)

In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: initialize rtm_tos in mpls_getroute() (CVE-2026-74577)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579)

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581)

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear new_transport when removing a peer (CVE-2026-74586)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587)

In the Linux kernel, the following vulnerability has been resolved:

sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589)

In the Linux kernel, the following vulnerability has been resolved:

sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595)

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (CVE-2026-74597)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix Route Information option length validation (CVE-2026-74598)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels() (CVE-2026-74608)

In the Linux kernel, the following vulnerability has been resolved:

tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609)

In the Linux kernel, the following vulnerability has been resolved:

veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: avoid refilling the RX queue after teardown (CVE-2026-74613)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks (CVE-2026-74614)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615)

In the Linux kernel, the following vulnerability has been resolved:

xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: defer invalid log until after unlock (CVE-2026-74624)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_cursor() (CVE-2026-74635)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636)

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_dma: Clear stale RX state on shutdown (CVE-2026-74654)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu() (CVE-2026-74656)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)

In the Linux kernel, the following vulnerability has been resolved:

futex: Prevent robust futex exit race some more (CVE-2026-74658)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660)

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: publish queues before arming timer (CVE-2026-74662)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: reallocate update replies for mismatched IDs (CVE-2026-74664)

In the Linux kernel, the following vulnerability has been resolved:

packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)

In the Linux kernel, the following vulnerability has been resolved:

net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667)

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

In the Linux kernel, the following vulnerability has been resolved:

ima: fix out-of-bounds read in xattr_verify() (CVE-2026- ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel --releasever 2023.12.20260914' or or 'dnf update --advisory ALAS2023-2026-2143 --releasever 2023.12.20260914' to update your system.

Plugin Details

Severity: Medium

ID: 345814

File Name: al2023_ALAS2023-2026-2143.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 9/14/2026

Updated: 9/14/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.01

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64294

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool-debuginfo, p-cpe:/a:amazon:linux:bpftool, p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel-debuginfo, p-cpe:/a:amazon:linux:kernel-devel, p-cpe:/a:amazon:linux:kernel-headers, p-cpe:/a:amazon:linux:kernel-livepatch-6.1.186-228.374, p-cpe:/a:amazon:linux:kernel-modules-extra-common, p-cpe:/a:amazon:linux:kernel-modules-extra, p-cpe:/a:amazon:linux:kernel-tools-debuginfo, p-cpe:/a:amazon:linux:kernel-tools-devel, p-cpe:/a:amazon:linux:kernel-tools, p-cpe:/a:amazon:linux:kernel, p-cpe:/a:amazon:linux:perf-debuginfo, p-cpe:/a:amazon:linux:perf, p-cpe:/a:amazon:linux:python3-perf-debuginfo, p-cpe:/a:amazon:linux:python3-perf

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/14/2026

Vulnerability Publication Date: 5/26/2026

Reference Information

CVE: CVE-2026-46158, CVE-2026-46170, CVE-2026-53090, CVE-2026-64192, CVE-2026-64294, CVE-2026-64507, CVE-2026-64508, CVE-2026-64542, CVE-2026-64543, CVE-2026-64556, CVE-2026-64562, CVE-2026-64563, CVE-2026-64567, CVE-2026-64572, CVE-2026-64576, CVE-2026-64579, CVE-2026-64580, CVE-2026-68082, CVE-2026-68093, CVE-2026-68096, CVE-2026-68117, CVE-2026-68121, CVE-2026-68123, CVE-2026-68127, CVE-2026-68132, CVE-2026-68136, CVE-2026-68142, CVE-2026-68146, CVE-2026-68153, CVE-2026-68154, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68159, CVE-2026-68162, CVE-2026-68164, CVE-2026-68165, CVE-2026-68184, CVE-2026-68186, CVE-2026-68243, CVE-2026-68244, CVE-2026-68248, CVE-2026-68253, CVE-2026-68254, CVE-2026-68255, CVE-2026-68269, CVE-2026-68277, CVE-2026-68278, CVE-2026-68279, CVE-2026-68284, CVE-2026-68297, CVE-2026-68300, CVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68325, CVE-2026-68336, CVE-2026-68343, CVE-2026-68376, CVE-2026-68386, CVE-2026-68388, CVE-2026-68399, CVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68432, CVE-2026-68433, CVE-2026-68446, CVE-2026-68450, CVE-2026-72030, CVE-2026-72040, CVE-2026-72096, CVE-2026-72099, CVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72121, CVE-2026-72172, CVE-2026-72191, CVE-2026-72242, CVE-2026-72252, CVE-2026-72253, CVE-2026-72288, CVE-2026-72299, CVE-2026-72392, CVE-2026-72398, CVE-2026-72413, CVE-2026-72416, CVE-2026-74347, CVE-2026-74443, CVE-2026-74444, CVE-2026-74464, CVE-2026-74465, CVE-2026-74469, CVE-2026-74471, CVE-2026-74473, CVE-2026-74475, CVE-2026-74476, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74487, CVE-2026-74490, CVE-2026-74492, CVE-2026-74512, CVE-2026-74516, CVE-2026-74518, CVE-2026-74519, CVE-2026-74550, CVE-2026-74557, CVE-2026-74563, CVE-2026-74564, CVE-2026-74565, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577, CVE-2026-74579, CVE-2026-74581, CVE-2026-74582, CVE-2026-74583, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601, CVE-2026-74608, CVE-2026-74609, CVE-2026-74612, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74620, CVE-2026-74624, CVE-2026-74630, CVE-2026-74632, CVE-2026-74635, CVE-2026-74636, CVE-2026-74637, CVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74660, CVE-2026-74662, CVE-2026-74663, CVE-2026-74664, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74671, CVE-2026-74672, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74683, CVE-2026-74684, CVE-2026-74688, CVE-2026-74696, CVE-2026-74700, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74714, CVE-2026-74717, CVE-2026-74720, CVE-2026-74722, CVE-2026-74724, CVE-2026-74726, CVE-2026-74730, CVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746, CVE-2026-74748, CVE-2026-80527, CVE-2026-80528, CVE-2026-80529, CVE-2026-80534, CVE-2026-80536, CVE-2026-80557, CVE-2026-80558, CVE-2026-80561, CVE-2026-80572, CVE-2026-80574, CVE-2026-80586, CVE-2026-80589, CVE-2026-80590, CVE-2026-80681, CVE-2026-80686, CVE-2026-80714, CVE-2026-80715, CVE-2026-80717, CVE-2026-80725, CVE-2026-80726, CVE-2026-80731, CVE-2026-80733, CVE-2026-80737, CVE-2026-80742, CVE-2026-80744, CVE-2026-80756, CVE-2026-80757, CVE-2026-80765, CVE-2026-80781, CVE-2026-80792, CVE-2026-80793, CVE-2026-80805, CVE-2026-80808, CVE-2026-80888, CVE-2026-80890, CVE-2026-80893, CVE-2026-80901, CVE-2026-80904, CVE-2026-80906, CVE-2026-80913

Detections

Analytics