Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3402)

high Nessus Plugin ID 377900

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3402 advisory.

In the Linux kernel, the following vulnerability has been resolved:

ACPI: platform: Use acpi_bus_get_primary_device() (CVE-2026-100072)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf_refcount field as unique (CVE-2026-100074)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: module: call ethnl_ops_complete() on module flash errors (CVE-2026-63998)

In the Linux kernel, the following vulnerability has been resolved:

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix dst corruption in same register operation

For lshift and rshift, the shift operations are performed in a loop over32-bit words. The loop calculates the shifted value and write it to dst,and then immediately reads from src to calculate the carry for the nextiteration. Because src and dst could point to the same memory location,the carry is incorrectly calculated using the newly modified dst valueinstead of the original src value.

Adding a temporary local variable to cache the original value beforewriting to dst and using it for the carry calculation solves theproblem. In addition, partial overlap is rejected from control plane forall kind of operations including byteorder. This was tested with thefollowing bytecode:

table test_table ip flags 0 use 1 handle 1ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1ip test_table test_chain 2[ immediate reg 1 0x44332211 0x88776655 ][ bitwise reg 1 = ( reg 1 << 0x08000000 ) ][ cmp eq reg 1 0x66443322 0x00887766 ][ counter pkts 0 bytes 0 ]ip test_table test_chain 4 3[ immediate reg 1 0x44332211 0x88776655 ][ bitwise reg 1 = ( reg 1 << 0x08000000 ) ][ cmp eq reg 1 0x55443322 0x00887766 ][ counter pkts 21794 bytes 1917798 ] (CVE-2026-64006)

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts acaller-provided cpu argument. The function uses cpu for per-cpu rstatlookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass aninvalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==0x7fffffff triggers:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9index 2147483647 is out of range for type 'long unsigned int [64]'Call Trace:css_rstat_updatedbpf_iter_run_progcgroup_iter_seq_showbpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc andmove the common implementation to
__css_rstat_updated() for in-kernelcallers. (CVE-2026-64036)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix leak of request in netfs_write_begin() error handling

Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read(). (CVE-2026-64060)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: eb_tables: close module init race (CVE-2026-64076)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix metabuf leak in inode xattr initialization (CVE-2026-64146)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix zeropoint update where i_size > remote_i_size (CVE-2026-64159)

In the Linux kernel, the following vulnerability has been resolved:

net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190)

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions (CVE-2026-64388)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Unconditionally recompute CR8 intercept on PPR update (CVE-2026-64513)

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (CVE-2026-68081)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/mst: limit DP MST ESI service loop (CVE-2026-68241)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Fix NULL deref on sched_engine alloc failure (CVE-2026-68242)

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (CVE-2026-68312)

In the Linux kernel, the following vulnerability has been resolved:

tipc: serialize udp bearer replicast list updates (CVE-2026-68323)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation (CVE-2026-68400)

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() (CVE-2026-68401)

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() (CVE-2026-68421)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (CVE-2026-68441)

In the Linux kernel, the following vulnerability has been resolved:

ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (CVE-2026-72031)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (CVE-2026-72321)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_create_write_req() to handle async cache object creation (CVE-2026-72366)

In the Linux kernel, the following vulnerability has been resolved:

iomap: guard io_size EOF trim against concurrent truncate underflow (CVE-2026-72367)

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (CVE-2026-72404)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard conntrack opts error writes (CVE-2026-72423)

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix writes_pending leak on write request failures (CVE-2026-72439)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: fix writes_pending and barrier reference leaks on write failures (CVE-2026-72440)

In the Linux kernel, the following vulnerability has been resolved:

sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257)

In the Linux kernel, the following vulnerability has been resolved:

net: watchdog: fix refcount tracking races (CVE-2026-74264)

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: do not configure xps for XDP queues (CVE-2026-74317)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject sleepable BPF_LSM_CGROUP programs at load time (CVE-2026-74338)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1,raid10: fix bio accounting for split md cloned bios (CVE-2026-74373)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1,raid10: fix error-path detection with md_cloned_bio() (CVE-2026-74374)

In the Linux kernel, the following vulnerability has been resolved:

md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375)

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix folio_queue ENOMEM in writeback by adding a mempool (CVE-2026-74542)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (CVE-2026-74544)

In the Linux kernel, the following vulnerability has been resolved:

xsk: reclaim invalid Tx descriptors in ZC batch path (CVE-2026-74558)

In the Linux kernel, the following vulnerability has been resolved:

xsk: drain continuation descs after overflow in xsk_build_skb() (CVE-2026-74559)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: skip global block reserve accounting for rescue mounts (CVE-2026-74571)

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Use children field for rcu head and add memory barriers (CVE-2026-74605)

In the Linux kernel, the following vulnerability has been resolved:

tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (CVE-2026-74695)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix netns reference imbalance in conntrack kfuncs (CVE-2026-74715)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723)

In the Linux kernel, the following vulnerability has been resolved:

xfs: handle NULL b_addr in xfs_buf_free (CVE-2026-74728)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: revalidate ihl to prevent out-of-bounds access (CVE-2026-74747)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use (CVE-2026-74752)

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: pair EH runtime PM get and put (CVE-2026-74754)

In the Linux kernel, the following vulnerability has been resolved:

tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg (CVE-2026-80607)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject compressed segment that overflows the compressed input (CVE-2026-80631)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (CVE-2026-80634)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_expect: use conntrack GC to reap expectations (CVE-2026-80668)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie (CVE-2026-80738)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Wrap user-invoked calls to fb_set_var() in helper (CVE-2026-80786)

In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid busy looping in tipc_exit_net() (CVE-2026-80866)

In the Linux kernel, the following vulnerability has been resolved:

net: tap: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80905)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: defer eventfd signaling when queued from a wakeup handler (CVE-2026-80920)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (CVE-2026-89537)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

In the Linux kernel, the following vulnerability has been resolved:

cifs: call pagecache_isize_extended() in cifs_setsize() when extending (CVE-2026-89642)

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threadsvia a per-net freeme queue, preventing the shrinker and GC worker frombearing the cost of closing files (see ffb402596147). However, thequeue lives in a separately-allocated struct nfsd_fcache_disposal thatis freed by nfsd_free_fcache_disposal_net() during per-net teardown.The global shrinker, laundrette, and fsnotify callbacks can still beinside nfsd_file_dispose_list_delayed() dereferencing that pointer,causing a use- after-free.

Inline the spinlock and freeme list directly into struct nfsd_net (asfcache_dispose_lock and fcache_dispose_list), eliminating the separatelyallocated struct nfsd_fcache_disposal entirely. These fields now havethe same lifetime as the net namespace itself, so there is no danglingpointer to chase.

nfsd_file_cache_start_net() now just initializes the inline fields andcannot fail due to allocation.
nfsd_file_cache_shutdown_net() drainsthe inline list directly instead of freeing a separate struct.
Thealloc/free helpers are removed. (CVE-2026-89682)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (CVE-2026-89705)

In the Linux kernel, the following vulnerability has been resolved:

lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)

In the Linux kernel, the following vulnerability has been resolved:

mm/mglru: fix and remove redundant unevictable folio handling (CVE-2026-89757)

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (CVE-2026-89913)

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: transfer the pmd dirty bit to the folio on zap (CVE-2026-89987)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: skip double clone set expressions on element insert (CVE-2026-90061)

In the Linux kernel, the following vulnerability has been resolved:

xsk: honor XDP_TX_METADATA in zero-copy path (CVE-2026-90086)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (CVE-2026-90097)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: account classifier filter allocations to memcg (CVE-2026-90099)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.1: zero referring call lists before decoding (CVE-2026-90104)

In the Linux kernel, the following vulnerability has been resolved:

vxlan: fix reading neigh ha (CVE-2026-90105)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: arp/nd proxy: fix reading neigh ha (CVE-2026-90106)

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: do not clone dst in ip6mr_cache_report() (CVE-2026-90111)

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix resize of the RX ring (CVE-2026-90142)

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL deref in dpll_device_ops() during teardown race (CVE-2026-90144)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (CVE-2026-90149)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix interlaced ztailpacking pclusters (CVE-2026-90161)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check pointer type for all atomic RMW paths (CVE-2026-90177)

In the Linux kernel, the following vulnerability has been resolved:

blk-iocost: clear delay state when freeing policy data (CVE-2026-90182)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Compare iterator types during state pruning (CVE-2026-90217)

In the Linux kernel, the following vulnerability has been resolved:

NFS: Return a delegation the client fails to record (CVE-2026-90234)

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Flush context cache with correct SID when tearing down aliases (CVE-2026-90240)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix mmap_lock leak in irq_work path (CVE-2026-90247)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (CVE-2026-90259)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: don't clobber the extent buffer when zeroing it out (CVE-2026-90260)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: check if root is readonly when setting posix acl (CVE-2026-90263)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: always wait for ordered extents to avoid OE races (CVE-2026-90264)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: defrag: fix deadlock between defrag and delalloc space reservation (CVE-2026-90265)

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails (CVE-2026-90267)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Clear buf on error in __bpf_get_task_stack (CVE-2026-90300)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Invalidate RCU pointers after final spin unlock (CVE-2026-90317)

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix race between policy activation and blkg destruction (CVE-2026-90326)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: replace forgeable discard filler with a keyed sector marker (CVE-2026-90333)

In the Linux kernel, the following vulnerability has been resolved:

tty: skip cdev_del() when no cdev is registered (CVE-2026-90335)

In the Linux kernel, the following vulnerability has been resolved:

serial: core: clear freed pointers on uart_register_driver() failure (CVE-2026-90336)

In the Linux kernel, the following vulnerability has been resolved:

serial: core: do fallible allocations before the console can be registered (CVE-2026-90337)

In the Linux kernel, the following vulnerability has been resolved:

arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry (CVE-2026-90347)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject >8 byte return values on return-reading trampoline paths (CVE-2026-90359)

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix UAF when probe runs concurrent to dyn ID removal (CVE-2026-90421)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path (CVE-2026-90424)

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() (CVE-2026-90427)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix WARNING in bpf_tracing_link_release (CVE-2026-92485)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Zero queue and stack outputs on lock failure (CVE-2026-92520)

In the Linux kernel, the following vulnerability has been resolved:

esp: do not unref managed frag pages in esp_ssg_unref() (CVE-2026-93105)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject writes through untrusted BTF pointers (CVE-2026-93144)

In the Linux kernel, the following vulnerability has been resolved:

time/namespace: Validate nanosecond field in proc_timens_set_offset() (CVE-2026-93146)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject MEM_ALLOC BTF accesses past object bounds (CVE-2026-93148)

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/uncore: Fix uncore_box ref/unref ordering (CVE-2026-93181)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: convert nfsd_net boolean flags to unsigned long flags word (CVE-2026-93221)

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier (CVE-2026-93230)

In the Linux kernel, the following vulnerability has been resolved:

ACPI: bus: Introduce acpi_bus_get_primary_device() (CVE-2026-93251)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (CVE-2026-97477)

In the Linux kernel, the following vulnerability has been resolved:

driver core: Avoid warning when removing a device while its supplier is unbinding (CVE-2026-97479)

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: 8250: protect against NULL uart->port.dev in register (CVE-2026-97480)

In the Linux kernel, the following vulnerability has been resolved:

genirq/proc: Size interrupt directory names for 10-digit interrupt numbers (CVE-2026-97503)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (CVE-2026-97554)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (CVE-2026-97561)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (CVE-2026-97563)

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel: Prevent drain_pebs() reentry (CVE-2026-97960)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Move representor vnic reporter to eswitch devlink port (CVE-2026-97962)

In the Linux kernel, the following vulnerability has been resolved:

vhost: invalidate vring access on IOTLB transitions (CVE-2026-97988)

In the Linux kernel, the following vulnerability has been resolved:

virtio_ring: fix stale descriptor flags after a failed packed add (CVE-2026-97997)

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Do not reallocate GA log buffers on resume (CVE-2026-98003)

In the Linux kernel, the following vulnerability has been resolved:

bpf: mark a NULL call argument precise (CVE-2026-98019)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix subbuf resize races with trace_pipe_raw readers (CVE-2026-98032)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve inner map identity in callback frames (CVE-2026-98033)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep refcount_acquire nullable for borrowed RCU kptrs (CVE-2026-98038)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't infer non-NULL from a pointer with an unbounded offset (CVE-2026-98043)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject legacy packet loads from callbacks (CVE-2026-98044)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check ancestor frames for rbtree callbacks (CVE-2026-98047)

In the Linux kernel, the following vulnerability has been resolved:

bpf: don't rewrite bpf_fastcall patterns entered by a jump (CVE-2026-98048)

In the Linux kernel, the following vulnerability has been resolved:

bpf: zero extend the result of an arena 32-bit cmpxchg (CVE-2026-98049)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable (CVE-2026-98058)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark signal tracepoint siginfo arguments as scalar (CVE-2026-98062)

In the Linux kernel, the following vulnerability has been resolved:

erofs: disable LZ4 rolling decompression for now (CVE-2026-98067)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zstd: fix lost wakeup when waiting for a workspace (CVE-2026-98079)

In the Linux kernel, the following vulnerability has been resolved:

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge (CVE-2026-98085)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use rcu_assign_pointer() for __rcu list updates (CVE-2026-98099)

In the Linux kernel, the following vulnerability has been resolved:

bpf: check_cond_jmp_op(): properly infer if register is null (CVE-2026-98134)

In the Linux kernel, the following vulnerability has been resolved:

printk: Don't WARN on kthread_run failure. (CVE-2026-98147)

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use the DMA API for resource backing on Xen (CVE-2026-98156)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (CVE-2026-98715)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchange-range-to-eof file size exchange (CVE-2026-98974)

In the Linux kernel, the following vulnerability has been resolved:

xfs: stop exchanging reflink flags when exchanging mappings (CVE-2026-98975)

In the Linux kernel, the following vulnerability has been resolved:

namespace: handle mount locking for automounts correctly (CVE-2026-98977)

In the Linux kernel, the following vulnerability has been resolved:

namespace: unhash a dentry before detaching the mounts on it (CVE-2026-98981)

In the Linux kernel, the following vulnerability has been resolved:

namespace: check the mounts before reading their parents in pivot_root() (CVE-2026-98985)

In the Linux kernel, the following vulnerability has been resolved:

namespace: don't inherit MNT_UMOUNT in clone_mnt() (CVE-2026-98993)

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate pitch coming from userspace (CVE-2026-99002)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ch: Do not keep references to data transfer element devices (CVE-2026-99019)

In the Linux kernel, the following v ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.12 --releasever 2023.12.20261109' or or 'dnf update --advisory ALAS2023-2026-3402 --releasever 2023.12.20261109' to update your system.

Plugin Details

Severity: High

ID: 377900

File Name: al2023_ALAS2023-2026-3402.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/9/2026

Updated: 11/9/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.26

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-100072

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.12-debuginfo, p-cpe:/a:amazon:linux:bpftool6.12, p-cpe:/a:amazon:linux:kernel-livepatch-6.12.114-139.210, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-devel, p-cpe:/a:amazon:linux:kernel6.12-headers, p-cpe:/a:amazon:linux:kernel6.12-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.12-modules-extra, p-cpe:/a:amazon:linux:kernel6.12-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-tools-devel, p-cpe:/a:amazon:linux:kernel6.12-tools, p-cpe:/a:amazon:linux:kernel6.12, p-cpe:/a:amazon:linux:perf6.12-debuginfo, p-cpe:/a:amazon:linux:perf6.12, p-cpe:/a:amazon:linux:python3-perf6.12-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.12

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/9/2026

Vulnerability Publication Date: 7/19/2026

Reference Information

CVE: CVE-2026-100072, CVE-2026-100074, CVE-2026-63998, CVE-2026-63999, CVE-2026-64006, CVE-2026-64036, CVE-2026-64060, CVE-2026-64076, CVE-2026-64146, CVE-2026-64159, CVE-2026-64190, CVE-2026-64388, CVE-2026-64513, CVE-2026-68081, CVE-2026-68241, CVE-2026-68242, CVE-2026-68312, CVE-2026-68323, CVE-2026-68400, CVE-2026-68401, CVE-2026-68421, CVE-2026-68426, CVE-2026-68441, CVE-2026-68448, CVE-2026-72031, CVE-2026-72321, CVE-2026-72341, CVE-2026-72366, CVE-2026-72367, CVE-2026-72383, CVE-2026-72404, CVE-2026-72423, CVE-2026-72439, CVE-2026-72440, CVE-2026-74257, CVE-2026-74264, CVE-2026-74317, CVE-2026-74338, CVE-2026-74373, CVE-2026-74374, CVE-2026-74375, CVE-2026-74542, CVE-2026-74544, CVE-2026-74558, CVE-2026-74559, CVE-2026-74571, CVE-2026-74605, CVE-2026-74611, CVE-2026-74695, CVE-2026-74715, CVE-2026-74723, CVE-2026-74728, CVE-2026-74747, CVE-2026-74752, CVE-2026-74754, CVE-2026-80607, CVE-2026-80631, CVE-2026-80634, CVE-2026-80668, CVE-2026-80738, CVE-2026-80786, CVE-2026-80866, CVE-2026-80905, CVE-2026-80920, CVE-2026-89537, CVE-2026-89631, CVE-2026-89642, CVE-2026-89654, CVE-2026-89682, CVE-2026-89705, CVE-2026-89709, CVE-2026-89757, CVE-2026-89913, CVE-2026-89987, CVE-2026-90061, CVE-2026-90086, CVE-2026-90097, CVE-2026-90099, CVE-2026-90104, CVE-2026-90105, CVE-2026-90106, CVE-2026-90111, CVE-2026-90142, CVE-2026-90144, CVE-2026-90149, CVE-2026-90161, CVE-2026-90177, CVE-2026-90182, CVE-2026-90217, CVE-2026-90234, CVE-2026-90240, CVE-2026-90247, CVE-2026-90259, CVE-2026-90260, CVE-2026-90263, CVE-2026-90264, CVE-2026-90265, CVE-2026-90267, CVE-2026-90300, CVE-2026-90317, CVE-2026-90326, CVE-2026-90333, CVE-2026-90335, CVE-2026-90336, CVE-2026-90337, CVE-2026-90347, CVE-2026-90359, CVE-2026-90421, CVE-2026-90424, CVE-2026-90427, CVE-2026-92485, CVE-2026-92503, CVE-2026-92520, CVE-2026-93105, CVE-2026-93144, CVE-2026-93146, CVE-2026-93148, CVE-2026-93181, CVE-2026-93221, CVE-2026-93230, CVE-2026-93251, CVE-2026-97477, CVE-2026-97479, CVE-2026-97480, CVE-2026-97503, CVE-2026-97554, CVE-2026-97561, CVE-2026-97563, CVE-2026-97960, CVE-2026-97962, CVE-2026-97988, CVE-2026-97997, CVE-2026-98003, CVE-2026-98019, CVE-2026-98032, CVE-2026-98033, CVE-2026-98038, CVE-2026-98043, CVE-2026-98044, CVE-2026-98047, CVE-2026-98048, CVE-2026-98049, CVE-2026-98058, CVE-2026-98062, CVE-2026-98067, CVE-2026-98079, CVE-2026-98085, CVE-2026-98099, CVE-2026-98134, CVE-2026-98147, CVE-2026-98156, CVE-2026-98715, CVE-2026-98974, CVE-2026-98975, CVE-2026-98977, CVE-2026-98981, CVE-2026-98985, CVE-2026-98993, CVE-2026-99002, CVE-2026-99019, CVE-2026-99027, CVE-2026-99041, CVE-2026-99044, CVE-2026-99082, CVE-2026-99085, CVE-2026-99098

Detections

Analytics