Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-99999: In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. CVE-2026-74688: In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed CVE-2026-74582: In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths CVE-2026-64564: In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | kernel | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-aarch64 | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-debuginfo-common-x86_64 | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-devel | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-headers | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-livepatch-4.14.355-287.753 | 0:1.0-0.amzn2 |
| Amazon Linux · 2 | kernel-tools | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-tools-debuginfo | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | kernel-tools-devel | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | perf | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | perf-debuginfo | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | python-perf | 0:4.14.355-287.753.amzn2 |
| Amazon Linux · 2 | python-perf-debuginfo | 0:4.14.355-287.753.amzn2 |
Vulnerabilities 4
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
Critical 9.8
sctp: clear control chunk transport if it is being removed
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok i…
-
Critical 9.3CVE-2026-99999 Public exploit
ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…
-
High 7.8
packet: use consistent hard_header_len in non-ring send paths
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…