Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel ...

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3192 advisory.

An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory on KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This could result in disclosure of host memory or a denial of service.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (CVE-2026-100070)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf_refcount field as unique (CVE-2026-100074)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (CVE-2026-68289)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject redirect helpers without a bpf_net_context (CVE-2026-68337)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix busy dentry warning on unmount after DIO (CVE-2026-72315)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix barriering when walking subrequest list (CVE-2026-72355)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mask pseudo pointer values in verifier logs (CVE-2026-72402)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix writes_pending and barrier reference leaks on discard failures (CVE-2026-72438)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard __get_user acesss with access_ok for uprobe_multi data (CVE-2026-74258)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). (CVE-2026-74289)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347)

In the Linux kernel, the following vulnerability has been resolved:

fou: Fix use-after-free in fou_create() (CVE-2026-74496)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: initialise workingset state before folio split (CVE-2026-80729)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: honor task_work cancellation

io_waitid_cb() may run through the fallback task_work path whentask_work_add() can no longer queue work to the originating task. Thefallback runs from a kworker and io_uring marks such task work ascanceled through tw.cancel.

io_waitid_cb() currently ignores tw.cancel and calls __do_wait().waitid is task-context dependent:
__do_wait() performs child lookuprelative to current, and the retry path also usescurrent->signal->wait_chldexit. If the callback runs from the fallbackkworker, current is therefore not the task that submitted the request.

Honor tw.cancel before entering __do_wait(). Complete the request with-ECANCELED and skip the siginfo copy, since canceled task work may runwithout the submitting task's userspace execution context.

Keep the existing siginfo handling for normal waitid completion andexplicit cancellation. (CVE-2026-81010)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (CVE-2026-89776)

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

In the Linux kernel, the following vulnerability has been resolved:

isofs: fix out-of-bounds page array access on empty zisofs block (CVE-2026-89778)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate ef->size covers the record's name and value (CVE-2026-89779)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (CVE-2026-89781)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject restart table growth beyond U16_MAX entries (CVE-2026-89782)

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (CVE-2026-89783)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (CVE-2026-89785)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bounds read in ext4_read_inline_dir() (CVE-2026-89786)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: avoid divide by zero in rt6_multipath_rebalance (CVE-2026-89790)

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (CVE-2026-89796)

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Drop tt->restore after successful restore (CVE-2026-89815)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Remove VM-wide VNCR mapping counter (CVE-2026-89915)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping (CVE-2026-89917)

In the Linux kernel, the following vulnerability has been resolved:

nvme: skip the zoned limits update if the zone info query failed (CVE-2026-89971)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987)

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (CVE-2026-89996)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Take trace_array reference before accessing its ftrace_ops (CVE-2026-90002)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Take trace_array reference when opening options file (CVE-2026-90013)

In the Linux kernel, the following vulnerability has been resolved:

tcp: reject non zerocopy devmem tx (CVE-2026-90051)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_htb: limit htb_classify inner-class filter hops (CVE-2026-90053)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix corruption of urgent data on multi-segment retransmit (CVE-2026-90054)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (CVE-2026-90058)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: move hardware offload step after building the chain blob (CVE-2026-90062)

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: Ensure that TCP packets don't overflow gso_segs (CVE-2026-90063)

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate banner payload length (CVE-2026-90067)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_teql: restore skb->dev on the slave failure path (CVE-2026-90071)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (CVE-2026-90072)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (CVE-2026-90073)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq_codel: clamp default quantum and mtu (CVE-2026-90075)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fq: add overflow bounds to quantum and initial quantum (CVE-2026-90076)

In the Linux kernel, the following vulnerability has been resolved:

net: fix a resource leak in copy_net_ns() error handling path (CVE-2026-90077)

In the Linux kernel, the following vulnerability has been resolved:

net/rds: use wq_has_sleeper() in rds_cong_map_updated() (CVE-2026-90081)

In the Linux kernel, the following vulnerability has been resolved:

xsk: honor XDP_TX_METADATA in zero-copy path (CVE-2026-90086)

In the Linux kernel, the following vulnerability has been resolved:

arm64: process: Fix context switching MTE store-only tag check (CVE-2026-90094)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (CVE-2026-90097)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pnfs: key the data server cache on the NFS version (CVE-2026-90102)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (CVE-2026-90103)

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue (CVE-2026-90109)

In the Linux kernel, the following vulnerability has been resolved:

inetpeer: randomize RB-tree node comparison using SipHash (CVE-2026-90110)

In the Linux kernel, the following vulnerability has been resolved:

netdevsim: update queue NAPI association on queue reset (CVE-2026-90113)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: Reject descending VLAN tunnel ranges (CVE-2026-90114)

In the Linux kernel, the following vulnerability has been resolved:

xsk: fix NULL pointer dereference in __xsk_rcv() (CVE-2026-90115)

In the Linux kernel, the following vulnerability has been resolved:

virtio_balloon: quiesce balloon work before device shutdown (CVE-2026-90129)

In the Linux kernel, the following vulnerability has been resolved:

vsock: don't check the listener's sk_err in vsock_accept() (CVE-2026-90138)

In the Linux kernel, the following vulnerability has been resolved:

fuse: check for NULL root inode in fuse_fill_super_submount (CVE-2026-90139)

In the Linux kernel, the following vulnerability has been resolved:

cuse: wait for pending RCU callbacks on module exit (CVE-2026-90140)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix integer overflow in ftp helper port/address parsing (CVE-2026-90141)

In the Linux kernel, the following vulnerability has been resolved:

bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146)

In the Linux kernel, the following vulnerability has been resolved:

clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() (CVE-2026-90147)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (CVE-2026-90148)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149)

In the Linux kernel, the following vulnerability has been resolved:

pnfs/blocklayout: Fix device leaks on parse failure (CVE-2026-90150)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative optlen in cgroup getsockopt hook (CVE-2026-90157)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks (CVE-2026-90159)

In the Linux kernel, the following vulnerability has been resolved:

lwt_bpf: Restore reserved headroom after xmit program (CVE-2026-90160)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix interlaced ztailpacking pclusters (CVE-2026-90161)

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) Fix core_data leak on CPUs without PTS (CVE-2026-90178)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute updates with device setup (CVE-2026-90184)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: serialize configfs attribute stores with the lock (CVE-2026-90185)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: reject per-device queue resize for shared tag set (CVE-2026-90186)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free zones array on device power-off (CVE-2026-90187)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: free global tag_set on init error path (CVE-2026-90188)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: register configfs subsystem after creating default devices (CVE-2026-90189)

In the Linux kernel, the following vulnerability has been resolved:

null_blk: use DEFINE_MUTEX for the file-scope mutex (CVE-2026-90190)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: scan: fix bus ID cleanup on device_add() failures (CVE-2026-90194)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject out-of-range evcn in mi_enum_attr() (CVE-2026-90199)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix integer overflow in MFT cluster validation (CVE-2026-90200)

In the Linux kernel, the following vulnerability has been resolved:

net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race (CVE-2026-90201)

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (CVE-2026-90202)

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check block offset is not negative (CVE-2026-90203)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218)

In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: release descriptor pools on probe failure (CVE-2026-90233)

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE (CVE-2026-90235)

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Flush context cache with correct SID when tearing down aliases (CVE-2026-90240)

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Tear down scalable-mode context on probe failure (CVE-2026-90241)

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down copied context entry (CVE-2026-90243)

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma: Restore locking around msi_page_list (CVE-2026-90244)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix mmap_lock leak in irq_work path (CVE-2026-90247)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (CVE-2026-90248)

In the Linux kernel, the following vulnerability has been resolved:

bpf, cgroup: Fix storage null-ptr-deref after replacing prog (CVE-2026-90250)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (CVE-2026-90259)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: don't clobber the extent buffer when zeroing it out (CVE-2026-90260)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: always wait for ordered extents to avoid OE races (CVE-2026-90264)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject load-acquire from pointers requiring fault protection (CVE-2026-90269)

In the Linux kernel, the following vulnerability has been resolved:

perf: arm_pmuv3: Zero initialize hw_id branch stack field (CVE-2026-90272)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: don't set array_frozen in raid1_takeover() (CVE-2026-90275)

In the Linux kernel, the following vulnerability has been resolved:

md: wait for behind writes before destroying bitmap (CVE-2026-90278)

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: round bitmap stripes with sector division (CVE-2026-90279)

In the Linux kernel, the following vulnerability has been resolved:

hugetlbfs: release subpool on fill_super failure (CVE-2026-90283)

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: do not queue completed sysfs fallback requests (CVE-2026-90284)

In the Linux kernel, the following vulnerability has been resolved:

arm64: hibernate: Restore DAIF state on error (CVE-2026-90290)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check load-acquire src ptr type before the load (CVE-2026-90312)

In the Linux kernel, the following vulnerability has been resolved:

bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed (CVE-2026-90313)

In the Linux kernel, the following vulnerability has been resolved:

fat: release buffer head after rebuilding parent (CVE-2026-90318)

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: skip dying blkg in blkcg_activate_policy()

When switching IO schedulers on a block device, blkcg_activate_policy()can race with concurrent blkcg deletion, leading to a use-after-free inrcu_accelerate_cbs.

T1: T2:blkg_destroykill(&blkg->refcnt) // blkg->refcnt=1->0blkg_release // call_rcu(__blkg_release)...blkg_free_workfn->pd_free_fn(pd)elv_iosched_storeelevator_switch...iterate blkg listblkg_get(blkg) // blkg->refcnt=0->1list_del_init(&blkg->q_node)blkg_put(pinned_blkg) // blkg->refcnt=1->0blkg_release // call_rcu againrcu_accelerate_cbs // uaf

Fix this by checking hlist_unhashed(&blkg->blkcg_node) before gettinga reference to the blkg. This is the same check used in blkg_destroy()to detect if a blkg has already been destroyed. If the blkg is alreadyunhashed, skip processing it since it's being destroyed. (CVE-2026-90325)

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix race between policy activation and blkg destruction (CVE-2026-90326)

In the Linux kernel, the following vulnerability has been resolved:

HID: synchronize input before cleaning up a failed probe (CVE-2026-90329)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: replace forgeable discard filler with a keyed sector marker (CVE-2026-90333)

In the Linux kernel, the following vulnerability has been resolved:

tty: clear cdev pointer after cdev_add() failure (CVE-2026-90334)

In the Linux kernel, the following vulnerability has been resolved:

serial: amba-pl011: keep console clock enabled for atomic writes (CVE-2026-90338)

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: Fix trampoline stack size for 128-bit arguments (CVE-2026-90358)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: Unregister cpufreq notifier on init failure (CVE-2026-90364)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: create serial pool adding rdev to array with serialize_policy=1 (CVE-2026-90385)

In the Linux kernel, the following vulnerability has been resolved:

iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388)

In the Linux kernel, the following vulnerability has been resolved:

md: scope memalloc_noio to allocation critical sections (CVE-2026-90389)

In the Linux kernel, the following vulnerability has been resolved:

md/bitmap: resume array on backlog_store() error path (CVE-2026-90390)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential UAF when reading bpf link info (CVE-2026-90392)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential UAF in bpf_netns_link_update_prog (CVE-2026-90393)

In the Linux kernel, the following vulnerability has been resolved:

block: fix dio leak on metadata mapping error (CVE-2026-90396)

In the Linux kernel, the following vulnerability has been resolved:

md: recheck spare changes before starting sync (CVE-2026-90400)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (CVE-2026-90416)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path (CVE-2026-90424)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID (CVE-2026-90425)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (CVE-2026-90426)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (CVE-2026-90428)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init (CVE-2026-90429)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (CVE-2026-90430)

In the Linux kernel, the following vulnerability has been resolved:

isofs: release zisofs block pointer buffer head (CVE-2026-90434)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix integer overflow of user QP buffer size (CVE-2026-90435)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix skb double-free in xfrm_dev_direct_output() (CVE-2026-92489)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix buffer_head leak in ext4_init_orphan_info (CVE-2026-92494)

In the Linux kernel, the following vulnerability has been resolved:

ext4: validate readdir offset before accessing dirent (CVE-2026-92499)

In the Linux kernel, the following vulnerability has been resolved:

ext4: use fsdata to track inline data write state and fix race (CVE-2026-92500)

In the Linux kernel, the following vulnerability has been resolved:

ext4: drain in-flight DIO before buffered write fallback (CVE-2026-92501)

In the Linux kernel, the following vulnerability has been resolved:

ext4: clear stale xarray tags on folios skipped during writeback (CVE-2026-92502)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve unique-field state across nested structs (CVE-2026-92515)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix offset warn check for bpf_res_spin_lock (CVE-2026-92516)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure (CVE-2026-92520)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (CVE-2026-92521)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: processor: validate MADT IOAPIC entry bounds (CVE-2026-92522)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523)

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (CVE-2026-92524)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject arena frees below the arena base (CVE-2026-93045)

In the Linux kernel, the following vulnerability has been resolved:

software node: Fix software_node_get_reference_args() with index -1 (CVE-2026-93046)

In the Linux kernel, the following vulnerability has been resolved:

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (CVE-2026-93048)

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix stale info pointer in failed registration path (CVE-2026-93054)

In the Linux kernel, the following vulnerability has been resolved:

UDF symlink pathComponent header OOB read (CVE-2026-93055)

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Take cpa_lock around large-page collapse (CVE-2026-93066)

In the Linux kernel ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.18 --releasever 2023.12.20261012' or or 'dnf update --advisory ALAS2023-2026-3192 --releasever 2023.12.20261012' to update your system.

Detections

Analytics

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)

high Nessus Plugin ID 365258

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

Vulnerability Information

Reference Information