Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3448)

critical Nessus Plugin ID 379864

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3448 advisory.

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (CVE-2026-89754)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (CVE-2026-98863)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: udp: Create exceptions before socket matching (CVE-2026-99077)

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103)

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ (CVE-2026-99105)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flower: validate mask pointer after nla_next() (CVE-2026-99112)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: don't truncate the port group walk on teardown (CVE-2026-99117)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing (CVE-2026-99118)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: validate packet source for connected sockets (CVE-2026-99123)

In the Linux kernel, the following vulnerability has been resolved:

page_pool: keep frag_offset aligned for odd-sized requests (CVE-2026-99127)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate chunk length in the inqueue parser (CVE-2026-99128)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cancel: don't spin on local work the task can't run (CVE-2026-99130)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix capability check in xfs (CVE-2026-99131)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix infinite loop on discard with large tag size (CVE-2026-99135)

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (CVE-2026-99138)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (CVE-2026-99139)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check operator stack capacity before pushing (CVE-2026-99142)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Keep the predicate limit separate from program capacity (CVE-2026-99143)

In the Linux kernel, the following vulnerability has been resolved:

drm/exec: don't immediately add prelocked obj to array of locked objs (CVE-2026-99147)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CVE-2026-99153)

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (CVE-2026-99155)

In the Linux kernel, the following vulnerability has been resolved:

scsi: st: Fix use-after-free race between st_remove() and st_open() (CVE-2026-99156)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix false warning in ring_buffer_map_get_reader() (CVE-2026-99158)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() (CVE-2026-99159)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not show buffer_meta for CPUs without a buffer (CVE-2026-99160)

In the Linux kernel, the following vulnerability has been resolved:

sctp: revalidate output stream after association connect wait (CVE-2026-99165)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167)

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: free the sbi after a grace period (CVE-2026-99171)

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfs_inode after an rcu grace period too (CVE-2026-99173)

In the Linux kernel, the following vulnerability has been resolved:

ext4: free the sbi after a grace period (CVE-2026-99174)

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: prevent mark additions during connector teardown (CVE-2026-99175)

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (CVE-2026-99176)

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (CVE-2026-99178)

In the Linux kernel, the following vulnerability has been resolved:

autofs: ignore notification errors from a replaced pipe (CVE-2026-99181)

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix perf_pmu_migrate_context() leaving events behind (CVE-2026-99187)

In the Linux kernel, the following vulnerability has been resolved:

calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() (CVE-2026-99191)

In the Linux kernel, the following vulnerability has been resolved:

netlink: avoid hashing the network namespace pointer (CVE-2026-99201)

In the Linux kernel, the following vulnerability has been resolved:

pipe: preserve existing fasync readers on writer setup failure (CVE-2026-99203)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206)

In the Linux kernel, the following vulnerability has been resolved:

netlink: reset skb headers before unicast and multicast filtering (CVE-2026-99211)

In the Linux kernel, the following vulnerability has been resolved:

vsock: treat TCP_CLOSING as once-established (CVE-2026-99213)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths (CVE-2026-99216)

In the Linux kernel, the following vulnerability has been resolved:

coredump: hold RCU while releasing parked threads (CVE-2026-99218)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Initialize modname and offset in print_rec() (CVE-2026-99219)

In the Linux kernel, the following vulnerability has been resolved:

asymmetric_keys: reject trust keys without IDs (CVE-2026-99220)

In the Linux kernel, the following vulnerability has been resolved:

keys/trusted_keys: return immediately after TPM unseal failure (CVE-2026-99221)

In the Linux kernel, the following vulnerability has been resolved:

keys: Protect the read method check against type removal (CVE-2026-99222)

In the Linux kernel, the following vulnerability has been resolved:

keys: make keyring indexes independent of kernel addresses (CVE-2026-99223)

In the Linux kernel, the following vulnerability has been resolved:

keys: Check the authorization payload in process keyring searches (CVE-2026-99225)

In the Linux kernel, the following vulnerability has been resolved:

keys: Avoid the owner account dereference in named keyring lookup (CVE-2026-99226)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: prevent cancel reference wrap (CVE-2026-99227)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: don't lose the signal that ends work (CVE-2026-99228)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/wait: don't spin on a stuck overflow list (CVE-2026-99229)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: own the request before clearing ->head (CVE-2026-99231)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Reject incomplete event filter expressions (CVE-2026-99236)

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper (CVE-2026-99244)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: Fix key_reject_and_link() race with keyring restriction (CVE-2026-99245)

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock (CVE-2026-99246)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Do not initialize tracefs work if tracing is disabled (CVE-2026-99247)

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: make zap_pid_ns_processes() freezable (CVE-2026-99249)

In the Linux kernel, the following vulnerability has been resolved:

printk: Postpone kthread startup (CVE-2026-99250)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Avoid infinite retry loop in init_vp_index() (CVE-2026-99251)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: don't flood a cancelling task with task_work (CVE-2026-99254)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: don't hide a link from cancellations (CVE-2026-99255)

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix issue with background work locking (CVE-2026-99256)

In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (CVE-2026-99258)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update kernel6.12 --releasever 2023.12.20261112' or or 'dnf update --advisory ALAS2023-2026-3448 --releasever 2023.12.20261112' to update your system.

Plugin Details

Severity: Critical

ID: 379864

File Name: al2023_ALAS2023-2026-3448.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.82

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-99153

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bpftool6.12-debuginfo, p-cpe:/a:amazon:linux:bpftool6.12, p-cpe:/a:amazon:linux:kernel-livepatch-6.12.115-140.210, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-aarch64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-x86_64, p-cpe:/a:amazon:linux:kernel6.12-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-devel, p-cpe:/a:amazon:linux:kernel6.12-headers, p-cpe:/a:amazon:linux:kernel6.12-modules-extra-common, p-cpe:/a:amazon:linux:kernel6.12-modules-extra, p-cpe:/a:amazon:linux:kernel6.12-tools-debuginfo, p-cpe:/a:amazon:linux:kernel6.12-tools-devel, p-cpe:/a:amazon:linux:kernel6.12-tools, p-cpe:/a:amazon:linux:kernel6.12, p-cpe:/a:amazon:linux:perf6.12-debuginfo, p-cpe:/a:amazon:linux:perf6.12, p-cpe:/a:amazon:linux:python3-perf6.12-debuginfo, p-cpe:/a:amazon:linux:python3-perf6.12

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 6/19/2026

Reference Information

CVE: CVE-2026-89754, CVE-2026-98863, CVE-2026-99077, CVE-2026-99103, CVE-2026-99105, CVE-2026-99110, CVE-2026-99112, CVE-2026-99117, CVE-2026-99118, CVE-2026-99121, CVE-2026-99123, CVE-2026-99127, CVE-2026-99128, CVE-2026-99130, CVE-2026-99131, CVE-2026-99135, CVE-2026-99136, CVE-2026-99138, CVE-2026-99139, CVE-2026-99142, CVE-2026-99143, CVE-2026-99147, CVE-2026-99153, CVE-2026-99155, CVE-2026-99156, CVE-2026-99158, CVE-2026-99159, CVE-2026-99160, CVE-2026-99165, CVE-2026-99167, CVE-2026-99169, CVE-2026-99171, CVE-2026-99173, CVE-2026-99174, CVE-2026-99175, CVE-2026-99176, CVE-2026-99178, CVE-2026-99181, CVE-2026-99187, CVE-2026-99191, CVE-2026-99201, CVE-2026-99203, CVE-2026-99206, CVE-2026-99211, CVE-2026-99213, CVE-2026-99216, CVE-2026-99218, CVE-2026-99219, CVE-2026-99220, CVE-2026-99221, CVE-2026-99222, CVE-2026-99223, CVE-2026-99225, CVE-2026-99226, CVE-2026-99227, CVE-2026-99228, CVE-2026-99229, CVE-2026-99231, CVE-2026-99236, CVE-2026-99244, CVE-2026-99245, CVE-2026-99246, CVE-2026-99247, CVE-2026-99249, CVE-2026-99250, CVE-2026-99251, CVE-2026-99254, CVE-2026-99255, CVE-2026-99256, CVE-2026-99258

Detections

Analytics