Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23145: In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref CVE-2026-23144: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure CVE-2026-23142: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure CVE-2026-23141: In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() CVE-2026-23128: In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() CVE-2026-23126: In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list CVE-2026-23125: In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT CVE-2026-23124: In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() CVE-2026-23119: In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() CVE-2026-23113: In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop CVE-2026-23110: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23107: In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA CVE-2026-23105: In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag CVE-2026-23103: In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port CVE-2026-23099: In the Linux kernel, the following vulnerability has been resolved: bonding: limit BOND_MODE_8023AD to Ethernet devices CVE-2026-23097: In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios CVE-2026-23095: In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. CVE-2026-23086: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size CVE-2026-23085: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses CVE-2026-23083: In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. CVE-2026-23074: In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc CVE-2026-23071: In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine CVE-2026-23069: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() CVE-2026-23060: In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec CVE-2026-23057: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb CVE-2026-23054: In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table CVE-2026-23053: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() CVE-2026-23050: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() CVE-2026-23038: In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() CVE-2026-23035: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv CVE-2026-23032: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items CVE-2026-23025: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n CVE-2026-23011: In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust CVE-2026-23010: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). CVE-2026-23005: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 CVE-2026-23003: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() CVE-2026-23002: In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context CVE-2026-23001: In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() CVE-2026-23000: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure CVE-2026-22999: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() CVE-2026-22996: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv CVE-2025-71194: In the
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.68-92.122 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.68-92.122.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.68-92.122.amzn2023 |
Vulnerabilities 48
-
High 8.2
fs/ntfs3: Initialize allocated memory before use
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3) Memory is …
-
High 7.8
net/sched: sch_qfq: do not free existing class in qfq_change_class()
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we …
-
High 7.8CVE-2026-23001 Public exploit
macvlan: fix possible UAF in macvlan_forward_source()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…
-
High 7.8CVE-2026-23010 Public exploit
ipv6: Fix use-after-free in inet6_addr_del().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before…
-
High 7.8
net/sched: Enforce that teql can only be used as root qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…
-
High 7.8
ipvlan: Make the addrs_lock be per port
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.…
-
High 7.8
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits th…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
High 7.5
gue: Fix skb memleak with inner IP protocol 0.
In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype f…
-
Unscored —
bpf: Reject narrower access to pointer ctx fields
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk be…
-
Unscored —
sched_ext: Fix possible deadlock in the deferred_irq_workfn()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if th…
-
Unscored —
exfat: fix refcount leak in exfat_find
In the Linux kernel, the following vulnerability has been resolved: exfat: fix refcount leak in exfat_find Fix refcount leaks in `exfat_find` related to `exfat_get_dentry_set`. Function `exfat_get_dentry_set` would increase the reference counter of `es->bh` o…
-
Unscored —
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() From the memory-barriers.txt document regarding memory barrier ordering guarantees: (*) These guarantees do not apply to bitfie…
-
Unscored —
bpf: Do not let BPF test infra emit invalid GSO types to stack
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not let BPF test infra emit invalid GSO types to stack Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_feat…
-
Unscored —
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction withou…
-
Unscored —
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is us…
-
Unscored —
net/mlx5e: Fix crash on profile change rollback failure
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up wit…
-
Unscored —CVE-2026-23002 Public exploit
lib/buildid: use __kernel_read() for sleepable context
In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to u…
-
Unscored —CVE-2026-23005 Public exploit
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled fea…
-
Unscored —
ipv4: ip_gre: make ipgre_header() robust
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1…
-
Unscored —
mm/page_alloc: prevent pcp corruption with SMP=n
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .o…
-
Unscored —
null_blk: fix kmemleak by releasing references to fault configfs items
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating…
-
Unscored —
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails. Pass netdev to mlx5e_destroy_netdev() to g…
-
Unscored —
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without…
-
Unscored —
pNFS: Fix a deadlock when returning a delegation during open()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0…
-
Unscored —
NFS: Fix a deadlock involving nfs_release_folio()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_r…
-
Unscored —
net: hv_netvsc: reject RSS hash key programming without RX indirection table
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_fil…
-
Unscored —
vsock/virtio: Coalesce only linear skb
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_C…
-
Unscored —
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_aut…
-
Unscored —
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_c…
-
Unscored —
regmap: Fix race condition in hwspinlock irqsave routine
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates…
-
Unscored —
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit…
-
Unscored —
irqchip/gic-v3-its: Avoid truncating memory addresses
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit…
-
Unscored —
vsock/virtio: cap TX credit to local buffer size
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE va…
-
Unscored —
migrate: correct lock ordering for hugetlb file folios
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…
-
Unscored —
bonding: limit BOND_MODE_8023AD to Ethernet devices
In the Linux kernel, the following vulnerability has been resolved: bonding: limit BOND_MODE_8023AD to Ethernet devices BOND_MODE_8023AD makes sense for ARPHRD_ETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr…
-
Unscored —
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring…
-
Unscored —
scsi: core: Wake up the error handler when final completions race against each other
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes whe…
-
Unscored —
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Currently this is checked before running the pending work. Normally this is quite fine, as work items either end up blocking (which w…
-
Unscored —
bonding: provide a net pointer to __skb_flow_dissect()
In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), ei…
-
Unscored —
ipv6: annotate data-race in ndisc_router_discovery()
In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_…
-
Unscored —
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ===============================…
-
Unscored —
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_cr…
-
Unscored —
arm64: Set __nocfi on swsusp_arch_resume()
In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_…
-
Unscored —
btrfs: send: check for inline extents in range_is_hole_in_parent()
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This …
-
Unscored —
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectorie…
-
Unscored —
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are…
-
Unscored —
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38591.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68333.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68351.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68358.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68365.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68725.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22996.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22999.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23001.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23002.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23005.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23010.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23011.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23025.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23032.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23038.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23050.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23053.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23054.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23057.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23060.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23069.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23074.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23085.html