Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)

medium Nessus Plugin ID 365279

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3196 advisory.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (CVE-2026-100070)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions (CVE-2026-63858)

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: add and use xtables_unregister_table_exit

Previous change added xtables_unregister_table_pre_exit to detach thetable from the packetpath and to unlink it from the active table list.In case of rmmod, userspace that is doing set/getsockopt for this tablewill not be able to re-instantiate the table:1. The larval table has been removed already2. existing instantiated table is no longer on the xt pernet table list.

This adds the second stage helper:

unlink the table from the dying list, free the hook ops (if any) and dothe audit notification. It replaces xt_unregister_table(). (CVE-2026-64078)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: x_tables: allocate hook ops while under mutex

arp/ip(6)t_register_table() add the table to the per-netns list viaxt_register_table() before allocating the per-netns hook ops copyvia kmemdup_array(). This leaves a window where the table isvisible in the list with ops=NULL.

If the pernet exit happens runs concurrently the pre_exit callback findsthe table via xt_find_table() and passes the NULL ops pointer tonf_unregister_net_hooks(), causing a NULL dereference:

general protection fault in nf_unregister_net_hooks+0xbc/0x150RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)Call Trace:ipt_unregister_table_pre_exitiptable_mangle_net_pre_exitops_pre_exit_listcleanup_net

Fix by moving the ops allocation into the xtables core so the table isnever in the list without valid ops.
Also ensure the table is no longerprocessing packets before its torn down on error unwind.nf_register_net_hooks might have published at least one hook; callsynchronize_rcu() if there was an error.

audit log register message gets deferred until all operations havepassed, this avoids need to emit another ureg message in case oferror unwinding.

Based on earlier patch by Tristan Madani. (CVE-2026-64079)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (CVE-2026-64216)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies (CVE-2026-64520)

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)

In the Linux kernel, the following vulnerability has been resolved:

tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)

In the Linux kernel, the following vulnerability has been resolved:

super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)

In the Linux kernel, the following vulnerability has been resolved:

net: serialize netif_running() check in enqueue_to_backlog() (CVE-2026-72493)

In the Linux kernel, the following vulnerability has been resolved:

tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: don't leak the user namespace when the mount fails (CVE-2026-74483)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: restore write access when removing an entry (CVE-2026-74487)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (CVE-2026-74517)

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear new_transport when removing a peer (CVE-2026-74586)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix use-after-free of cached ASCONF chunk (CVE-2026-74587)

In the Linux kernel, the following vulnerability has been resolved:

sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix sk_redir use-after-free in send verdict (CVE-2026-74589)

In the Linux kernel, the following vulnerability has been resolved:

ima: Instantiate file_truncate and path_truncate hooks (CVE-2026-74592)

In the Linux kernel, the following vulnerability has been resolved:

sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (CVE-2026-74595)

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (CVE-2026-74597)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix Route Information option length validation (CVE-2026-74598)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (CVE-2026-74602)

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Fix use-after-free in eventfs_remove_rec() (CVE-2026-74606)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels() (CVE-2026-74608)

In the Linux kernel, the following vulnerability has been resolved:

tipc: read le->link under the node lock in tipc_node_link_down() (CVE-2026-74609)

In the Linux kernel, the following vulnerability has been resolved:

tls: don't leave a full plaintext sk_msg ring unpushed (CVE-2026-74610)

In the Linux kernel, the following vulnerability has been resolved:

veth: fix skb length accounting after XDP frag adjustment (CVE-2026-74612)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: avoid refilling the RX queue after teardown (CVE-2026-74613)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks (CVE-2026-74614)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not arm the ageing timer on a device that is down (CVE-2026-74615)

In the Linux kernel, the following vulnerability has been resolved:

xdp: reject clones that overrun skb_shared_info tailroom (CVE-2026-74616)

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: don't warn when the mount is completed from another user namespace (CVE-2026-74618)

In the Linux kernel, the following vulnerability has been resolved:

ovl: don't warn when the mount is completed from another user namespace (CVE-2026-74619)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: defer invalid log until after unlock (CVE-2026-74624)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent in6_dev_get() from resurrecting inet6_dev (CVE-2026-74630)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Prevent subbuf order change when resizing is disabled (CVE-2026-74634)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_cursor() (CVE-2026-74635)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race between update_event_fields and, event_define_fields (CVE-2026-74636)

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653)

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_dma: Clear stale RX state on shutdown (CVE-2026-74654)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu() (CVE-2026-74656)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)

In the Linux kernel, the following vulnerability has been resolved:

futex: Prevent robust futex exit race some more (CVE-2026-74658)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebt_nflog: pin the NFLOG backend (CVE-2026-74660)

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: publish queues before arming timer (CVE-2026-74662)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: reallocate update replies for mismatched IDs (CVE-2026-74664)

In the Linux kernel, the following vulnerability has been resolved:

net: fix skb length accounting after generic XDP frag adjustment (CVE-2026-74665)

In the Linux kernel, the following vulnerability has been resolved:

packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)

In the Linux kernel, the following vulnerability has been resolved:

net/packet: reset the MAC header on the packet-socket transmit path (CVE-2026-74667)

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: stop estimator after disabled calc phase (CVE-2026-74670)

In the Linux kernel, the following vulnerability has been resolved:

ima: fix out-of-bounds read in xattr_verify() (CVE-2026-74671)

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (CVE-2026-74672)

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - fix information leak in evdev_pass_values() (CVE-2026-74673)

In the Linux kernel, the following vulnerability has been resolved:

vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (CVE-2026-74675)

In the Linux kernel, the following vulnerability has been resolved:

vt: add permission check for KDSKBMETA ioctl (CVE-2026-74676)

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks (CVE-2026-74683)

In the Linux kernel, the following vulnerability has been resolved:

net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684)

In the Linux kernel, the following vulnerability has been resolved:

sctp: clear control chunk transport if it is being removed (CVE-2026-74688)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TFO max_qlen accounting across reuseport migration (CVE-2026-74696)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700)

In the Linux kernel, the following vulnerability has been resolved:

net/openvswitch: check Ethernet header length in key_extract() (CVE-2026-74701)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (CVE-2026-74704)

In the Linux kernel, the following vulnerability has been resolved:

udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

In the Linux kernel, the following vulnerability has been resolved:

xsk: require at least 16 bytes of TX metadata (CVE-2026-74710)

In the Linux kernel, the following vulnerability has been resolved:

bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (CVE-2026-74714)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: fw_tracer, return NULL on create error (CVE-2026-74717)

In the Linux kernel, the following vulnerability has been resolved:

devlink: fix net namespace reference leak in reload (CVE-2026-74718)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic (CVE-2026-74720)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix memory leak in btrfs_do_encoded_write() (CVE-2026-74722)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (CVE-2026-74724)

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (CVE-2026-74726)

In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (CVE-2026-74730)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_bpf: reject dev-bound programs bound to a different device (CVE-2026-74736)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: skip hash tables in u32_bind_class() (CVE-2026-74739)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain (CVE-2026-74740)

In the Linux kernel, the following vulnerability has been resolved:

veth: fix queue index used to wake the peer txq in veth_poll (CVE-2026-74742)

In the Linux kernel, the following vulnerability has been resolved:

macvlan: inherit needed_headroom and needed_tailroom from lowerdev (CVE-2026-74743)

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix refcount race between list:set GC and swap (CVE-2026-74748)

In the Linux kernel, the following vulnerability has been resolved:

perf: Reject exited events as group leaders (CVE-2026-74753)

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix hanging __ceph_get_caps() with stale mds_wanted (CVE-2026-80527)

In the Linux kernel, the following vulnerability has been resolved:

ceph: avoid fs reclaim while using current->journal_info (CVE-2026-80528)

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't swallow dquot recovery verification errors (CVE-2026-80529)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534)

In the Linux kernel, the following vulnerability has been resolved:

xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557)

In the Linux kernel, the following vulnerability has been resolved:

libceph: Avoid using invalid osd indices from primary_temp (CVE-2026-80558)

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix multiple unsafe decodes in decode_locker() (CVE-2026-80561)

In the Linux kernel, the following vulnerability has been resolved:

Input: byd - synchronize timer deletion before freeing private data (CVE-2026-80572)

In the Linux kernel, the following vulnerability has been resolved:

Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (CVE-2026-80574)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: Fix pointer desynchronization in fb_io_read() (CVE-2026-80578)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fastopen: only mark MPTFO subflows with SYN data (CVE-2026-80585)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: avoid combining some incoming suboptions (CVE-2026-80587)

In the Linux kernel, the following vulnerability has been resolved:

block: stop the timeout timer when releasing a never added disk (CVE-2026-80589)

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

In the Linux kernel, the following vulnerability has been resolved:

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (CVE-2026-80671)

In the Linux kernel, the following vulnerability has been resolved:

igc: remove napi_synchronize() in igc_down() (CVE-2026-80715)

In the Linux kernel, the following vulnerability has been resolved:

net: gro: properly validate BIG TCP aggregation criteria (CVE-2026-80725)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (CVE-2026-80726)

In the Linux kernel, the following vulnerability has been resolved:

x86/mce: Set up the polling timer before CMCI discovery (CVE-2026-80727)

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (CVE-2026-80731)

In the Linux kernel, the following vulnerability has been resolved:

net: remove WARN_ON_ONCE() from sk_mc_loop() (CVE-2026-80733)

In the Linux kernel, the following vulnerability has been resolved:

serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (CVE-2026-80739)

In the Linux kernel, the following vulnerability has been resolved:

af_packet: Don't send zero-byte data in tpacket_snd(). (CVE-2026-80742)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (CVE-2026-80744)

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a permission value exceeding the class permission count (CVE-2026-80755)

In the Linux kernel, the following vulnerability has been resolved:

selinux: do not cancel a policy conversion that never started (CVE-2026-80756)

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common (CVE-2026-80757)

In the Linux kernel, the following vulnerability has been resolved:

HID: hyperv: validate initial device info bounds (CVE-2026-80765)

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix OOB read of field->usage in hid_set_field() (CVE-2026-80781)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: fix memory leak from alloc-during-teardown race (CVE-2026-80784)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793)

In the Linux kernel, the following vulnerability has been resolved:

xfs: validate attr entry pointer before field access (CVE-2026-80805)

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable DAX on new encrypted files (CVE-2026-80806)

In the Linux kernel, the following vulnerability has been resolved:

ext4: stop retrying saturated xattr cache entries (CVE-2026-80808)

In the Linux kernel, the following vulnerability has been resolved:

usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

In the Linux kernel, the following vulnerability has been resolved:

usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't queue packet path object notifications (CVE-2026-80837)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: keep the last remote linked during FDB flush (CVE-2026-80838)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix xfrm_state_construct() auth-trunc leak (CVE-2026-80843)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: avoid lock inversion in nat keepalive work (CVE-2026-80845)

In the Linux kernel, the following vulnerability has been resolved:

tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852)

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on open O_TRUNC DAX failure (CVE-2026-80855)

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on setattr writeback failure (CVE-2026-80856)

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix usage of page_frag_cache (CVE-2026-80862)

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fail tls_sw_splice_read() after a failed async decrypt (CVE-2026-80904)

In the Linux kernel, the following vulnerability has been resolved:

net: packet: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80906)

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject an unclaimed class value in security_get_classes() (CVE-2026-80912)

In the Linux kernel, the following vulnerability has been resolved:

selinux: require every boolean value to be defined (CVE-2026-80913)

In the Linux kernel, the following vulnerability has been resolved:

HID: core: fix number/pointer type confusion on long items (CVE-2026-80918)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: flush works in dependency order (CVE-2026-80932)

In the Linux kernel, the following vulnerability has been resolved:

dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)

In the Linux kernel, the following vulnerability has been resolved:

seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)

In the Linux kernel, the following vulnerability has been resolved:

net: cap advertised IP tunnel headroom (CVE-2026-80978)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout (CVE-2026-81002)

In the Linux kernel, the following vulnerability has been resolved:

ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448)

In the Linux kernel, the following vulnerability has been resolved:

iommu/sva: Set handle->dev before the SVA handle is visible (CVE-2026-89451)

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Put PCI device after handling PPR faults (CVE-2026-89453)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix stream->outcnt underflow on duplicate RECONF responses

A cached RECONF chunk may contain more than one request parameter. Aduplicate response can therefore find and process the same ADD_OUT requestagain while another parameter is still outstanding, rolling back outcnttwice and possibly underflowing it.

Track outstanding request types as bits and clear each bit after its firstresponse. Later responses for the same request are then ignored. (CVE-2026-89476)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)

In the Linux kernel, the following vulnerability has been resolved:

sctp: drop a chunk if its transport was removed (CVE-2026-89478)

In the Linux kernel, the following vulnerability has been resolved:

sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

In the Linux kernel, the following ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.12 --releasever 2023.12.20261012' or or 'dnf update --advisory ALAS2023-2026-3196 --releasever 2023.12.20261012' to update your system.

Plugin Details

Severity: Medium

ID: 365279

File Name: al2023_ALAS2023-2026-3196.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 10/12/2026

Updated: 10/12/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.35

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-98164

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.12-debuginfo, p-cpe:/a:amazon:linux:bpftool6.12, p-cpe:/a:amazon:linux:kernel-livepatch-6.12.110-135.201, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-devel, p-cpe:/a:amazon:linux:kernel6.12-headers, p-cpe:/a:amazon:linux:kernel6.12-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.12-modules-extra, p-cpe:/a:amazon:linux:kernel6.12-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-tools-devel, p-cpe:/a:amazon:linux:kernel6.12-tools, p-cpe:/a:amazon:linux:kernel6.12, p-cpe:/a:amazon:linux:perf6.12-debuginfo, p-cpe:/a:amazon:linux:perf6.12, p-cpe:/a:amazon:linux:python3-perf6.12-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.12

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/12/2026

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-100070, CVE-2026-63858, CVE-2026-63979, CVE-2026-64078, CVE-2026-64079, CVE-2026-64210, CVE-2026-64216, CVE-2026-64520, CVE-2026-68082, CVE-2026-68118, CVE-2026-68132, CVE-2026-68159, CVE-2026-72493, CVE-2026-74268, CVE-2026-74334, CVE-2026-74474, CVE-2026-74483, CVE-2026-74487, CVE-2026-74517, CVE-2026-74582, CVE-2026-74583, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74592, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601, CVE-2026-74602, CVE-2026-74606, CVE-2026-74608, CVE-2026-74609, CVE-2026-74610, CVE-2026-74612, CVE-2026-74613, CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74618, CVE-2026-74619, CVE-2026-74620, CVE-2026-74624, CVE-2026-74630, CVE-2026-74632, CVE-2026-74634, CVE-2026-74635, CVE-2026-74636, CVE-2026-74637, CVE-2026-74653, CVE-2026-74654, CVE-2026-74656, CVE-2026-74657, CVE-2026-74658, CVE-2026-74660, CVE-2026-74662, CVE-2026-74663, CVE-2026-74664, CVE-2026-74665, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74670, CVE-2026-74671, CVE-2026-74672, CVE-2026-74673, CVE-2026-74675, CVE-2026-74676, CVE-2026-74683, CVE-2026-74684, CVE-2026-74688, CVE-2026-74696, CVE-2026-74700, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74710, CVE-2026-74714, CVE-2026-74717, CVE-2026-74718, CVE-2026-74720, CVE-2026-74722, CVE-2026-74724, CVE-2026-74726, CVE-2026-74730, CVE-2026-74736, CVE-2026-74739, CVE-2026-74740, CVE-2026-74742, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746, CVE-2026-74748, CVE-2026-74753, CVE-2026-80527, CVE-2026-80528, CVE-2026-80529, CVE-2026-80530, CVE-2026-80534, CVE-2026-80536, CVE-2026-80557, CVE-2026-80558, CVE-2026-80561, CVE-2026-80572, CVE-2026-80574, CVE-2026-80578, CVE-2026-80585, CVE-2026-80586, CVE-2026-80587, CVE-2026-80589, CVE-2026-80590, CVE-2026-80671, CVE-2026-80715, CVE-2026-80725, CVE-2026-80726, CVE-2026-80727, CVE-2026-80731, CVE-2026-80733, CVE-2026-80737, CVE-2026-80739, CVE-2026-80742, CVE-2026-80744, CVE-2026-80755, CVE-2026-80756, CVE-2026-80757, CVE-2026-80765, CVE-2026-80781, CVE-2026-80784, CVE-2026-80792, CVE-2026-80793, CVE-2026-80805, CVE-2026-80806, CVE-2026-80808, CVE-2026-80824, CVE-2026-80830, CVE-2026-80837, CVE-2026-80838, CVE-2026-80840, CVE-2026-80842, CVE-2026-80843, CVE-2026-80845, CVE-2026-80852, CVE-2026-80855, CVE-2026-80856, CVE-2026-80862, CVE-2026-80904, CVE-2026-80906, CVE-2026-80912, CVE-2026-80913, CVE-2026-80918, CVE-2026-80932, CVE-2026-80963, CVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80994, CVE-2026-81002, CVE-2026-81005, CVE-2026-89448, CVE-2026-89451, CVE-2026-89453, CVE-2026-89476, CVE-2026-89477, CVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89482, CVE-2026-89483, CVE-2026-89484, CVE-2026-89485, CVE-2026-89487, CVE-2026-89488, CVE-2026-89501, CVE-2026-89502, CVE-2026-89508, CVE-2026-89515, CVE-2026-89525, CVE-2026-89536, CVE-2026-89538, CVE-2026-89539, CVE-2026-89540, CVE-2026-89541, CVE-2026-89542, CVE-2026-89547, CVE-2026-89548, CVE-2026-89549, CVE-2026-89550, CVE-2026-89551, CVE-2026-89552, CVE-2026-89554, CVE-2026-89555, CVE-2026-89557, CVE-2026-89558, CVE-2026-89559, CVE-2026-89560, CVE-2026-89562, CVE-2026-89563, CVE-2026-89565, CVE-2026-89566, CVE-2026-89567, CVE-2026-89573, CVE-2026-89574, CVE-2026-89575, CVE-2026-89579, CVE-2026-89580, CVE-2026-89581, CVE-2026-89586, CVE-2026-89588, CVE-2026-89593, CVE-2026-89595, CVE-2026-89603, CVE-2026-89604, CVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89618, CVE-2026-89634, CVE-2026-89636, CVE-2026-89640, CVE-2026-89643, CVE-2026-89645, CVE-2026-89647, CVE-2026-89649, CVE-2026-89650, CVE-2026-89651, CVE-2026-89652, CVE-2026-89653, CVE-2026-89655, CVE-2026-89656, CVE-2026-89657, CVE-2026-89658, CVE-2026-89662, CVE-2026-89663, CVE-2026-89666, CVE-2026-89669, CVE-2026-89671, CVE-2026-89680, CVE-2026-89683, CVE-2026-89684, CVE-2026-89688, CVE-2026-89690, CVE-2026-89691, CVE-2026-89694, CVE-2026-89696, CVE-2026-89699, CVE-2026-89702, CVE-2026-89703, CVE-2026-89704, CVE-2026-89706, CVE-2026-89707, CVE-2026-89710, CVE-2026-89711, CVE-2026-89712, CVE-2026-89713, CVE-2026-89726, CVE-2026-89741, CVE-2026-89743, CVE-2026-89744, CVE-2026-89747, CVE-2026-89752, CVE-2026-89753, CVE-2026-89756, CVE-2026-89768, CVE-2026-89771, CVE-2026-89776, CVE-2026-89777, CVE-2026-89778, CVE-2026-89779, CVE-2026-89781, CVE-2026-89782, CVE-2026-89783, CVE-2026-89784, CVE-2026-89785, CVE-2026-89786, CVE-2026-89816, CVE-2026-89822, CVE-2026-89823, CVE-2026-89927, CVE-2026-89929, CVE-2026-89930, CVE-2026-89932, CVE-2026-89965, CVE-2026-89973, CVE-2026-89983, CVE-2026-89984, CVE-2026-89986, CVE-2026-89988, CVE-2026-89989, CVE-2026-89990, CVE-2026-89992, CVE-2026-89995, CVE-2026-89997, CVE-2026-89998, CVE-2026-90011, CVE-2026-90012, CVE-2026-90015, CVE-2026-90048, CVE-2026-90049, CVE-2026-90053, CVE-2026-90054, CVE-2026-90058, CVE-2026-90062, CVE-2026-90063, CVE-2026-90067, CVE-2026-90071, CVE-2026-90072, CVE-2026-90073, CVE-2026-90075, CVE-2026-90076, CVE-2026-90081, CVE-2026-90102, CVE-2026-90103, CVE-2026-90109, CVE-2026-90110, CVE-2026-90114, CVE-2026-90115, CVE-2026-90138, CVE-2026-90139, CVE-2026-90140, CVE-2026-90141, CVE-2026-90147, CVE-2026-90148, CVE-2026-90150, CVE-2026-90151, CVE-2026-90157, CVE-2026-90159, CVE-2026-90160, CVE-2026-90178, CVE-2026-90184, CVE-2026-90185, CVE-2026-90186, CVE-2026-90187, CVE-2026-90188, CVE-2026-90189, CVE-2026-90190, CVE-2026-90194, CVE-2026-90199, CVE-2026-90200, CVE-2026-90201, CVE-2026-90202, CVE-2026-90203, CVE-2026-90218, CVE-2026-90227, CVE-2026-90235, CVE-2026-90241, CVE-2026-90243, CVE-2026-90248, CVE-2026-90250, CVE-2026-90275, CVE-2026-90283, CVE-2026-90284, CVE-2026-90290, CVE-2026-90313, CVE-2026-90318, CVE-2026-90325, CVE-2026-90329, CVE-2026-90334, CVE-2026-90358, CVE-2026-90364, CVE-2026-90385, CVE-2026-90388, CVE-2026-90389, CVE-2026-90390, CVE-2026-90392, CVE-2026-90393, CVE-2026-90400, CVE-2026-90416, CVE-2026-90426, CVE-2026-90428, CVE-2026-90434, CVE-2026-90435, CVE-2026-92489, CVE-2026-92494, CVE-2026-92501, CVE-2026-92502, CVE-2026-92507, CVE-2026-92508, CVE-2026-92509, CVE-2026-92510, CVE-2026-92511, CVE-2026-92512, CVE-2026-92515, CVE-2026-92521, CVE-2026-92522, CVE-2026-92523, CVE-2026-92524, CVE-2026-93045, CVE-2026-93046, CVE-2026-93048, CVE-2026-93054, CVE-2026-93055, CVE-2026-93073, CVE-2026-93109, CVE-2026-93110, CVE-2026-93117, CVE-2026-93134, CVE-2026-93137, CVE-2026-93138, CVE-2026-93150, CVE-2026-93163, CVE-2026-93172, CVE-2026-93173, CVE-2026-93174, CVE-2026-93182, CVE-2026-93189, CVE-2026-93205, CVE-2026-93206, CVE-2026-93207, CVE-2026-93210, CVE-2026-93211, CVE-2026-93212, CVE-2026-93213, CVE-2026-93222, CVE-2026-93226, CVE-2026-93229, CVE-2026-93239, CVE-2026-93240, CVE-2026-93250, CVE-2026-93256, CVE-2026-93262, CVE-2026-93268, CVE-2026-93269, CVE-2026-93275, CVE-2026-97547, CVE-2026-97557, CVE-2026-98164

Detections

Analytics