Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)

medium Nessus Plugin ID 373466

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3335 advisory.

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix busy dentry warning on unmount after DIO (CVE-2026-72315)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,it can allocate a reader page with an outdated order. This isn't a bigissue, the user can still re-allocate a new reader page and try again.

However, what is more problematic is if the value of subbuf_orderchanges in the middle of ring_buffer_alloc_read_page(). In that case,bpage->order might not match the actual allocated memory.

Use bpage->order for the allocation to prevent this race. (CVE-2026-89503)

In the Linux kernel, the following vulnerability has been resolved:

sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)

In the Linux kernel, the following vulnerability has been resolved:

ceph: cap delegated inode count in ceph_parse_deleg_inos() (CVE-2026-89648)

In the Linux kernel, the following vulnerability has been resolved:

pidfd: hold exec_update_lock around namespace ioctl (CVE-2026-89766)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912)

In the Linux kernel, the following vulnerability has been resolved:

nvme: skip the zoned limits update if the zone info query failed (CVE-2026-89971)

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (CVE-2026-89996)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Take trace_array reference before accessing its ftrace_ops (CVE-2026-90002)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Take trace_array reference when opening options file (CVE-2026-90013)

In the Linux kernel, the following vulnerability has been resolved:

bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146)

In the Linux kernel, the following vulnerability has been resolved:

lockd: fix swapped arguments in nlmsvc_match_ip() (CVE-2026-93231)

In the Linux kernel, the following vulnerability has been resolved:

mm/secretmem: properly account locked pages (CVE-2026-93243)

In the Linux kernel, the following vulnerability has been resolved:

drm/sysfb: simpledrm: Improve stride validation (CVE-2026-93244)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix cifsFileInfo reference leak in deferred close (CVE-2026-97558)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fail DACL rewrite when the new DACL exceeds 64K (CVE-2026-97559)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (CVE-2026-97566)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: prevent race between disconnect() and rtx (CVE-2026-97567)

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix use-after-free of the source's parent directory (CVE-2026-97594)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: cttimeout: prevent UAF during module unload (CVE-2026-97609)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: don't overconsume buffers when using MSG_TRUNC (CVE-2026-97618)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rw: end write accounting from ->ki_complete (CVE-2026-97619)

In the Linux kernel, the following vulnerability has been resolved:

genetlink: pin family module during policy dump (CVE-2026-97901)

In the Linux kernel, the following vulnerability has been resolved:

bootconfig: Fix integer overflow in initrd size check (CVE-2026-97906)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Take trace_array reference when opening a tracer options file (CVE-2026-97933)

In the Linux kernel, the following vulnerability has been resolved:

reboot: fix cad_pid use-after-free race (CVE-2026-97938)

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory (CVE-2026-97939)

In the Linux kernel, the following vulnerability has been resolved:

configfs: unhash the dentry before dropping the item in rmdir (CVE-2026-97949)

In the Linux kernel, the following vulnerability has been resolved:

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (CVE-2026-97950)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark NULL kptr stores precise (CVE-2026-98034)

In the Linux kernel, the following vulnerability has been resolved:

bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks (CVE-2026-98084)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (CVE-2026-98101)

In the Linux kernel, the following vulnerability has been resolved:

nvdimm: pmem: keep PREFLUSH before data writes (CVE-2026-98161)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix server->total_read for compound encrypted PDUs (CVE-2026-98167)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix reparse buffer bounds in cifs_query_reparse_point() (CVE-2026-98168)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential OOB read in smb3_enum_snapshots() (CVE-2026-98169)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (CVE-2026-98170)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (CVE-2026-98171)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of iface in cifs_try_adding_channels() (CVE-2026-98173)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix rlist race and missing initialization (CVE-2026-98174)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean_demultiplex_info() (CVE-2026-98175)

In the Linux kernel, the following vulnerability has been resolved:

Input: zero ff_effect before compat copy in input_ff_effect_from_user (CVE-2026-98201)

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - zero absinfo before partial copy in EVIOCSABS (CVE-2026-98205)

In the Linux kernel, the following vulnerability has been resolved:

selinux: recheck intermediate backing files on mprotect() (CVE-2026-98214)

In the Linux kernel, the following vulnerability has been resolved:

selinux: preserve user SID across nested backing files (CVE-2026-98215)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix tpm2_load_cmd() boundary check (CVE-2026-98221)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: save input state data before secpath resets (CVE-2026-98229)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: use hlist_del_init_rcu for state_cache and state_cache_input (CVE-2026-98230)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: serialize state GC with device state flush (CVE-2026-98231)

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() (CVE-2026-98232)

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error (CVE-2026-98233)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: hhf: cap hh_flows_limit at change time (CVE-2026-98234)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: release tail references on DELACTION failure (CVE-2026-98235)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: xfrm: use full sockets in local error paths (CVE-2026-98241)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() (CVE-2026-98245)

In the Linux kernel, the following vulnerability has been resolved:

arm64: percpu: Fix LSE operations on {8,16}-bit types (CVE-2026-98248)

In the Linux kernel, the following vulnerability has been resolved:

arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (CVE-2026-98249)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: avoid reallocating confirmed conntrack labels (CVE-2026-98251)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (CVE-2026-98252)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Serialize join and leave on copy_to_user failure (CVE-2026-98253)

In the Linux kernel, the following vulnerability has been resolved:

tcp: exclude old ACKs from tcp fast path (CVE-2026-98255)

In the Linux kernel, the following vulnerability has been resolved:

exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (CVE-2026-98261)

In the Linux kernel, the following vulnerability has been resolved:

ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (CVE-2026-98262)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort transaction on failure to update inode for hole punching and reflinking (CVE-2026-98269)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: do not leave stale header offsets after pskb_carve() (CVE-2026-98271)

In the Linux kernel, the following vulnerability has been resolved:

net: lock the socket in sock_gettstamp() (CVE-2026-98276)

In the Linux kernel, the following vulnerability has been resolved:

tcp: do not let tcp_rmem be set below 4096 (CVE-2026-98299)

In the Linux kernel, the following vulnerability has been resolved:

tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (CVE-2026-98300)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: move switchdev call outside rcu (CVE-2026-98301)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup (CVE-2026-98303)

In the Linux kernel, the following vulnerability has been resolved:

seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (CVE-2026-98306)

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (CVE-2026-98319)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_nat: fully initialise new_addr in netmap setup (CVE-2026-98322)

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: wait for RCU readers before releasing dma_device (CVE-2026-98342)

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (CVE-2026-98343)

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: Fix device kref underflow in dma_chan_put() (CVE-2026-98344)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mad: Fix receive buffer leak when PKey enforcement fails (CVE-2026-98354)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (CVE-2026-98359)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (CVE-2026-98363)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

In the Linux kernel, the following vulnerability has been resolved:

esp: downgrade zerocopy managed frags before mutating skb frags (CVE-2026-98368)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (CVE-2026-98369)

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: preserve mremap address delta when skipping page tables (CVE-2026-98373)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (CVE-2026-98374)

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: drop RX packets with a short Ethernet header (CVE-2026-98375)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use array_map_meta_equal for percpu array inner map replacement (CVE-2026-98376)

In the Linux kernel, the following vulnerability has been resolved:

vlan: require the MAC header to be present in __vlan_insert_inner_tag() (CVE-2026-98377)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Skip unsettled links in link iterator (CVE-2026-98378)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rpfilter: reject routes without inet6_dev (CVE-2026-98379)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject IDR error pointers when deleting actions (CVE-2026-98380)

In the Linux kernel, the following vulnerability has been resolved:

veth: manage XDP program pointers during channel resize (CVE-2026-98381)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject dev-bound-only programs on other devices (CVE-2026-98382)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (CVE-2026-98383)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() (CVE-2026-98384)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids() (CVE-2026-98405)

In the Linux kernel, the following vulnerability has been resolved:

selinux: always fill AVC decision in avc_has_perm_noaudit() (CVE-2026-98413)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVE-2026-98440)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets (CVE-2026-98443)

In the Linux kernel, the following vulnerability has been resolved:

xfs: release orphanage dir inode if chown fails (CVE-2026-98448)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: close completed creates on compound wait errors (CVE-2026-98450)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes (CVE-2026-98451)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clean up failed cached directory opens (CVE-2026-98452)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: close handle after create-context parsing failure (CVE-2026-98453)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads (CVE-2026-98454)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix spurious warning for benign stage 2 teardown race (CVE-2026-98468)

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() (CVE-2026-98477)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (CVE-2026-98479)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: skip expired catchall elements on insert and delete (CVE-2026-98484)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion (CVE-2026-98487)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: fix helper UAF due to extensions realloc (CVE-2026-98490)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)

In the Linux kernel, the following vulnerability has been resolved:

net: arp: terminate device name before lookup (CVE-2026-98495)

In the Linux kernel, the following vulnerability has been resolved:

packet: use ubuf_info completion for TX_RING packets (CVE-2026-98503)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() (CVE-2026-98505)

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: do not dissolve gigantic pages without runtime support (CVE-2026-98506)

In the Linux kernel, the following vulnerability has been resolved:

mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (CVE-2026-98507)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix NULL pointer dereference on fence allocation failure (CVE-2026-98508)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix memory leak of fence event on execbuffer failure (CVE-2026-98509)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: fix incorrect RCU teardown order (CVE-2026-98521)

In the Linux kernel, the following vulnerability has been resolved:

drm/client: fix restore of partially initialized client (CVE-2026-98523)

In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: fix kernel stack leak to user-space in error path (CVE-2026-98528)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST (CVE-2026-98531)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)

In the Linux kernel, the following vulnerability has been resolved:

writeback: report a Tasks-RCU quiescent state per cgwb drain pass (CVE-2026-98536)

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in flush dependency check (CVE-2026-98537)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's WARNING in do_new_mount saga (CVE-2026-98539)

In the Linux kernel, the following vulnerability has been resolved:

fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT (CVE-2026-98541)

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: bound the ATA passthru sense descriptor writes (CVE-2026-98545)

In the Linux kernel, the following vulnerability has been resolved:

af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (CVE-2026-98547)

In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error (CVE-2026-98548)

In the Linux kernel, the following vulnerability has been resolved:

tcp: prevent collapsing skbs across boundary in rtx queue (CVE-2026-98549)

In the Linux kernel, the following vulnerability has been resolved:

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (CVE-2026-98550)

In the Linux kernel, the following vulnerability has been resolved:

autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (CVE-2026-98553)

In the Linux kernel, the following vulnerability has been resolved:

vlan: ensure sufficient headroom in vlan_dev_hard_header() (CVE-2026-98554)

In the Linux kernel, the following vulnerability has been resolved:

net: xps: reject an out of range traffic class (CVE-2026-98567)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies (CVE-2026-98568)

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: Reject enabling collect metadata through changelink (CVE-2026-98569)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (CVE-2026-98573)

In the Linux kernel, the following vulnerability has been resolved:

sctp: hold asoc or transport before mod_timer() in timer handlers (CVE-2026-98586)

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (CVE-2026-98588)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bpf_sock context code generation (CVE-2026-98590)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bounds check for skb-backed dynptrs (CVE-2026-98591)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix dst leak for uncached routes. (CVE-2026-98596)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (CVE-2026-98606)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (CVE-2026-98607)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (CVE-2026-98608)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak when drm_gem_handle_create() fails (CVE-2026-98609)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (CVE-2026-98610)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check params size before reading reserved fields (CVE-2026-98611)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Bound ownership depth through local kptrs and graph roots (CVE-2026-98613)

In the Linux kernel, the following vulnerability has been resolved:

sctp: avoid livelock while updating retransmit path (CVE-2026-98614)

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets (CVE-2026-98621)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (CVE-2026-98624)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish HW_DEAD after worker is done (CVE-2026-98625)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Restrict CO-RE poisoning to relocatable instructions (CVE-2026-98626)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: fix manual hash table handle IDR aliasing (CVE-2026-98629)

In the Linux kernel, the following vulnerability has been resolved:

xsk: Use a 32-bit compare in xsk_map_gen_lookup (CVE-2026-98631)

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd_zbc: Reject disks with too many zones (CVE-2026-98634)

In the Linux kernel, the following vulnerability has been resolved:

squashfs: Add dictionary size range check to prevent shift-out-of-bounds (CVE-2026-98636)

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: set up the frame pointer for the exception callback (CVE-2026-98641)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk (CVE-2026-98642)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds read of rtt_min in sock_ops (CVE-2026-98643)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (CVE-2026-98644)

In the Linux kernel, the following vulnerability has been resolved:

tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context (CVE-2026-98646)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf_struct_walk() (CVE-2026-98647)

In the Linux kernel, the following vulnerability has been resolved:

perf: Require kernel access for text po ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.12 --releasever 2023.12.20261028' or or 'dnf update --advisory ALAS2023-2026-3335 --releasever 2023.12.20261028' to update your system.

Plugin Details

Severity: Medium

ID: 373466

File Name: al2023_ALAS2023-2026-3335.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 10/29/2026

Updated: 10/29/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.33

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-98161

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.12-debuginfo, p-cpe:/a:amazon:linux:bpftool6.12, p-cpe:/a:amazon:linux:kernel-livepatch-6.12.113-138.209, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-devel, p-cpe:/a:amazon:linux:kernel6.12-headers, p-cpe:/a:amazon:linux:kernel6.12-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.12-modules-extra, p-cpe:/a:amazon:linux:kernel6.12-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-tools-devel, p-cpe:/a:amazon:linux:kernel6.12-tools, p-cpe:/a:amazon:linux:kernel6.12, p-cpe:/a:amazon:linux:perf6.12-debuginfo, p-cpe:/a:amazon:linux:perf6.12, p-cpe:/a:amazon:linux:python3-perf6.12-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.12

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 8/10/2026

Reference Information

CVE: CVE-2026-68399, CVE-2026-72315, CVE-2026-72463, CVE-2026-89500, CVE-2026-89503, CVE-2026-89520, CVE-2026-89633, CVE-2026-89638, CVE-2026-89648, CVE-2026-89766, CVE-2026-89912, CVE-2026-89971, CVE-2026-89996, CVE-2026-90002, CVE-2026-90013, CVE-2026-90146, CVE-2026-93231, CVE-2026-93243, CVE-2026-93244, CVE-2026-97558, CVE-2026-97559, CVE-2026-97566, CVE-2026-97567, CVE-2026-97594, CVE-2026-97597, CVE-2026-97609, CVE-2026-97618, CVE-2026-97619, CVE-2026-97901, CVE-2026-97906, CVE-2026-97933, CVE-2026-97938, CVE-2026-97939, CVE-2026-97949, CVE-2026-97950, CVE-2026-98034, CVE-2026-98084, CVE-2026-98101, CVE-2026-98161, CVE-2026-98167, CVE-2026-98168, CVE-2026-98169, CVE-2026-98170, CVE-2026-98171, CVE-2026-98173, CVE-2026-98174, CVE-2026-98175, CVE-2026-98201, CVE-2026-98205, CVE-2026-98214, CVE-2026-98215, CVE-2026-98221, CVE-2026-98222, CVE-2026-98229, CVE-2026-98230, CVE-2026-98231, CVE-2026-98232, CVE-2026-98233, CVE-2026-98234, CVE-2026-98235, CVE-2026-98241, CVE-2026-98245, CVE-2026-98248, CVE-2026-98249, CVE-2026-98251, CVE-2026-98252, CVE-2026-98253, CVE-2026-98255, CVE-2026-98260, CVE-2026-98261, CVE-2026-98262, CVE-2026-98269, CVE-2026-98271, CVE-2026-98276, CVE-2026-98299, CVE-2026-98300, CVE-2026-98301, CVE-2026-98303, CVE-2026-98306, CVE-2026-98319, CVE-2026-98320, CVE-2026-98322, CVE-2026-98342, CVE-2026-98343, CVE-2026-98344, CVE-2026-98354, CVE-2026-98359, CVE-2026-98363, CVE-2026-98364, CVE-2026-98368, CVE-2026-98369, CVE-2026-98373, CVE-2026-98374, CVE-2026-98375, CVE-2026-98376, CVE-2026-98377, CVE-2026-98378, CVE-2026-98379, CVE-2026-98380, CVE-2026-98381, CVE-2026-98382, CVE-2026-98383, CVE-2026-98384, CVE-2026-98405, CVE-2026-98413, CVE-2026-98432, CVE-2026-98440, CVE-2026-98443, CVE-2026-98448, CVE-2026-98450, CVE-2026-98451, CVE-2026-98452, CVE-2026-98453, CVE-2026-98454, CVE-2026-98468, CVE-2026-98477, CVE-2026-98479, CVE-2026-98484, CVE-2026-98485, CVE-2026-98487, CVE-2026-98490, CVE-2026-98491, CVE-2026-98495, CVE-2026-98503, CVE-2026-98505, CVE-2026-98506, CVE-2026-98507, CVE-2026-98508, CVE-2026-98509, CVE-2026-98521, CVE-2026-98523, CVE-2026-98528, CVE-2026-98531, CVE-2026-98532, CVE-2026-98536, CVE-2026-98537, CVE-2026-98539, CVE-2026-98541, CVE-2026-98545, CVE-2026-98547, CVE-2026-98548, CVE-2026-98549, CVE-2026-98550, CVE-2026-98553, CVE-2026-98554, CVE-2026-98567, CVE-2026-98568, CVE-2026-98569, CVE-2026-98573, CVE-2026-98586, CVE-2026-98588, CVE-2026-98590, CVE-2026-98591, CVE-2026-98596, CVE-2026-98606, CVE-2026-98607, CVE-2026-98608, CVE-2026-98609, CVE-2026-98610, CVE-2026-98611, CVE-2026-98613, CVE-2026-98614, CVE-2026-98621, CVE-2026-98624, CVE-2026-98625, CVE-2026-98626, CVE-2026-98629, CVE-2026-98631, CVE-2026-98634, CVE-2026-98636, CVE-2026-98641, CVE-2026-98642, CVE-2026-98643, CVE-2026-98644, CVE-2026-98646, CVE-2026-98647, CVE-2026-98655, CVE-2026-98681, CVE-2026-98686, CVE-2026-98695, CVE-2026-98696, CVE-2026-98697, CVE-2026-98713, CVE-2026-98716, CVE-2026-98717, CVE-2026-98720, CVE-2026-98728, CVE-2026-98750, CVE-2026-98751, CVE-2026-98752, CVE-2026-98753, CVE-2026-98763, CVE-2026-98771, CVE-2026-98772, CVE-2026-98773, CVE-2026-98790, CVE-2026-98791, CVE-2026-98792, CVE-2026-98793, CVE-2026-98794, CVE-2026-98797, CVE-2026-98801, CVE-2026-98805, CVE-2026-98807, CVE-2026-98811, CVE-2026-98831, CVE-2026-98833, CVE-2026-98840, CVE-2026-98841, CVE-2026-98844, CVE-2026-98845, CVE-2026-98846, CVE-2026-98850, CVE-2026-98851, CVE-2026-98852, CVE-2026-98854, CVE-2026-98855, CVE-2026-98856, CVE-2026-98857, CVE-2026-98858, CVE-2026-98859, CVE-2026-98862, CVE-2026-98923, CVE-2026-98925, CVE-2026-98927, CVE-2026-98933, CVE-2026-98934, CVE-2026-98935, CVE-2026-98937, CVE-2026-98947, CVE-2026-98950, CVE-2026-98953, CVE-2026-98955, CVE-2026-98959, CVE-2026-98969, CVE-2026-98979, CVE-2026-98980, CVE-2026-98982, CVE-2026-98984, CVE-2026-98990, CVE-2026-98992, CVE-2026-99005, CVE-2026-99006, CVE-2026-99007, CVE-2026-99025, CVE-2026-99030, CVE-2026-99031, CVE-2026-99033, CVE-2026-99036, CVE-2026-99037, CVE-2026-99040, CVE-2026-99043, CVE-2026-99052, CVE-2026-99053, CVE-2026-99054, CVE-2026-99055, CVE-2026-99057, CVE-2026-99058, CVE-2026-99059, CVE-2026-99062, CVE-2026-99063, CVE-2026-99064, CVE-2026-99067, CVE-2026-99071, CVE-2026-99072, CVE-2026-99073, CVE-2026-99074, CVE-2026-99078, CVE-2026-99079, CVE-2026-99080

Detections

Analytics