Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2-2026-3289 6 CVEs

Important: kernel security update (Amazon Linux 2)

Published May 4, 2026 · Updated Jun 16, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-46028: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests CVE-2026-43078: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl CVE-2026-43077: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption CVE-2026-43033: In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption CVE-2026-31431: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place To mitigate this issue, we recommend that customers disable loading of the algif_aead module by running the following commands as an administrator user: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead Some Amazon Linux 2 systems on the ARM64 architecture may fail the above rmmod command as they have the algif_aead module built-in. In this case, the following command and a reboot will mitigate the issue: sudo grubby --update-kernel ALL --args "initcall_blacklist=algif_aead_init" CVE-2026-23060: In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.355-281.727 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.355-281.727.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.355-281.727.amzn2
Amazon Linux · 2 perf 0:4.14.355-281.727.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.355-281.727.amzn2
Amazon Linux · 2 python-perf 0:4.14.355-281.727.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.355-281.727.amzn2

Vulnerabilities 6

  • High 7.8
    CVE-2026-31431 Exploited Public exploit EPSS 98%

    crypto: algif_aead - Revert to operating out-of-place

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux Alpine
    KEV May 1, 2026
  • High 7.8
    CVE-2026-43033

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption

    In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43078

    crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-23060

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

    In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_aut…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43077

    crypto: algif_aead - Fix minimum RX size check for decryption

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-46028

    crypto: algif_aead - snapshot IV for async AEAD requests

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-23060.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-31431.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43033.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43077.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43078.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-46028.html