Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23216: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() CVE-2026-23212: In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx CVE-2026-23209: In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() CVE-2026-23205: In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() CVE-2026-23198: In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd CVE-2026-23193: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() CVE-2026-23168: In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq safe CVE-2026-23156: In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() CVE-2026-23145: In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref CVE-2026-23144: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure CVE-2026-23142: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure CVE-2026-23128: In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() CVE-2026-23126: In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list CVE-2026-23125: In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT CVE-2026-23124: In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() CVE-2026-23119: In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() CVE-2026-23111: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() CVE-2026-23110: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23107: In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA CVE-2026-23105: In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag CVE-2026-23103: In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port CVE-2026-23102: In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context CVE-2026-23099: In the Linux kernel, the following vulnerability has been resolved: bonding: limit BOND_MODE_8023AD to Ethernet devices CVE-2026-23097: In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios CVE-2026-23095: In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. CVE-2026-23086: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size CVE-2026-23085: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses CVE-2026-23083: In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. CVE-2026-23074: In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc CVE-2026-23071: In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine CVE-2026-23069: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() CVE-2026-23060: In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec CVE-2026-23054: In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table CVE-2026-23038: In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() CVE-2026-23025: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n CVE-2026-23011: In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust CVE-2026-23010: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). CVE-2026-23005: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 CVE-2026-23003: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() CVE-2026-23001: In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() CVE-2026-22999: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class(
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.163-186.299 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.163-186.299.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.163-186.299.amzn2023 |
Vulnerabilities 52
-
High 8.8
smb: client: fix potential UAF in smb2_close_cached_fid()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock …
-
High 8.8
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Simi…
-
High 8.2
fs/ntfs3: Initialize allocated memory before use
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3) Memory is …
-
High 7.8
sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …
-
High 7.8
team: Move team device type change at the end of team_port_add
In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In…
-
High 7.8
iommu: disable SVA when CONFIG_X86 is set
In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…
-
High 7.8
net/sched: sch_qfq: do not free existing class in qfq_change_class()
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we …
-
High 7.8CVE-2026-23001 Public exploit
macvlan: fix possible UAF in macvlan_forward_source()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…
-
High 7.8CVE-2026-23010 Public exploit
ipv6: Fix use-after-free in inet6_addr_del().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before…
-
High 7.8
net/sched: Enforce that teql can only be used as root qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…
-
High 7.8
ipvlan: Make the addrs_lock be per port
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.…
-
High 7.8
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits th…
-
High 7.8CVE-2026-23111 Public exploit
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…
-
High 7.8
KVM: Don't clobber irqfd routing type when deassigning irqfd
In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del…
-
High 7.8
macvlan: fix error recovery in macvlan_common_newlink()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link …
-
High 7.5
btrfs: fix reservation leak in some error paths when inserting inline extent
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the …
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
High 7.5
gue: Fix skb memleak with inner IP protocol 0.
In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype f…
-
High 7.1
iomap: Fix possible overflow condition in iomap_write_delalloc_scan
In the Linux kernel, the following vulnerability has been resolved: iomap: Fix possible overflow condition in iomap_write_delalloc_scan folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-b…
-
Medium 5.5
blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields…
-
Unscored —
bpf: Reject narrower access to pointer ctx fields
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk be…
-
Unscored —
bpf: Do not let BPF test infra emit invalid GSO types to stack
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not let BPF test infra emit invalid GSO types to stack Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_feat…
-
Unscored —
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction withou…
-
Unscored —CVE-2026-23005 Public exploit
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled fea…
-
Unscored —
ipv4: ip_gre: make ipgre_header() robust
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1…
-
Unscored —
mm/page_alloc: prevent pcp corruption with SMP=n
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .o…
-
Unscored —
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without…
-
Unscored —
net: hv_netvsc: reject RSS hash key programming without RX indirection table
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_fil…
-
Unscored —
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_aut…
-
Unscored —
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_c…
-
Unscored —
regmap: Fix race condition in hwspinlock irqsave routine
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates…
-
Unscored —
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit…
-
Unscored —
irqchip/gic-v3-its: Avoid truncating memory addresses
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit…
-
Unscored —
vsock/virtio: cap TX credit to local buffer size
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE va…
-
Unscored —
migrate: correct lock ordering for hugetlb file folios
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…
-
Unscored —
bonding: limit BOND_MODE_8023AD to Ethernet devices
In the Linux kernel, the following vulnerability has been resolved: bonding: limit BOND_MODE_8023AD to Ethernet devices BOND_MODE_8023AD makes sense for ARPHRD_ETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr…
-
Unscored —
arm64/fpsimd: signal: Fix restoration of SVE context
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the…
-
Unscored —
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring…
-
Unscored —
scsi: core: Wake up the error handler when final completions race against each other
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes whe…
-
Unscored —
bonding: provide a net pointer to __skb_flow_dissect()
In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), ei…
-
Unscored —
ipv6: annotate data-race in ndisc_router_discovery()
In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_…
-
Unscored —
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ===============================…
-
Unscored —
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_cr…
-
Unscored —
arm64: Set __nocfi on swsusp_arch_resume()
In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_…
-
Unscored —
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectorie…
-
Unscored —
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are…
-
Unscored —
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
-
Unscored —
efivarfs: fix error propagation in efivar_entry_get()
In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitial…
-
Unscored —
flex_proportions: make fprop_new_period() hardirq safe
In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: <timer fires…
-
Unscored —
smb/client: fix memory leak in smb2_open_file()
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mn…
-
Unscored —
bonding: annotate data-races around slave->last_rx
In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot r…
-
Unscored —
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53421.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-54285.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38591.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38718.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40328.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68340.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68365.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68725.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71089.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71268.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22999.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23001.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23005.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23010.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23011.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23025.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23038.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23054.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23060.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23069.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23074.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23085.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23086.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23095.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23097.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23099.html