Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-31688: In the Linux kernel, the following vulnerability has been resolved: driver core: enforce device_lock for driver_match_device() CVE-2026-23260: In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure CVE-2026-23254: In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset CVE-2026-23230: In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields. CVE-2026-23224: In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222] do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222] do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio - erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw : bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). - file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference count, the last one decreasing the reference count to zero will free rq. CVE-2026-23223: In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t. CVE-2026-23219: In the Linux kernel, the following vulnerability has been resolved: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single CVE-2026-23216: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() CVE-2026-23215: In the Linux kernel, the following vulnerability has been resolved: x86/vmware: Fix hypercall clobbers CVE-2026-23214: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only CVE-2026-23212: In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx CVE-2026-23209: In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() CVE-2026-23205: In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() CVE-2026-23204: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() CVE-2026-23202: In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer CVE-2026-23201: In the Linux kernel, the following vulnerability has been resolved: ceph: fix oops due to invalid pointer for kfree() in parse_longname() CVE-2026-23200: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF CVE-2026-23199: In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23198: In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd CVE-2026-23193: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() CVE-2026-23189: In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in ceph_mds_auth_match() CVE-2026-23177: In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race CVE-2026-23173: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, delete flows only for existing peers CVE-2026-23169: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() CVE-2026-23168: In the Linux kernel, the follo
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.73-95.123 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.73-95.123.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.73-95.123.amzn2023 |
Vulnerabilities 32
-
High 8.8
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Simi…
-
High 8.8
smb: client: split cached_fid bitfields to avoid shared-byte RMW races
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different co…
-
High 7.8CVE-2026-23111 Public exploit
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…
-
High 7.8
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp…
-
High 7.8
KVM: Don't clobber irqfd routing type when deassigning irqfd
In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del…
-
High 7.8
macvlan: fix error recovery in macvlan_common_newlink()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link …
-
High 7.8
erofs: fix UAF issue for file-backed mounts w/ directio option
In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0…
-
High 7.5
btrfs: fix reservation leak in some error paths when inserting inline extent
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the …
-
High 7.3
mm/shmem, swap: fix race of truncate and swap entry split
In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix race of truncate and swap entry split The helper for shmem swap freeing is not handling the order of swap entries correctly. It uses xa_cmpxchg_irq to erase the swap entry…
-
High 7.1
net/sched: cls_u32: use skb_header_pointer_careful()
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a rep…
-
Unscored —
md: suspend array while updating raid_disks via sysfs
In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze…
-
Unscored —
net: fix segmentation of forwarding fraglist GRO
In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issu…
-
Unscored —
efivarfs: fix error propagation in efivar_entry_get()
In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitial…
-
Unscored —
perf: sched: Fix perf crash with new is_user_task() helper
In the Linux kernel, the following vulnerability has been resolved: perf: sched: Fix perf crash with new is_user_task() helper In order to do a user space stacktrace the current task needs to be a user task that has executed in user space. It use to be possib…
-
Unscored —
flex_proportions: make fprop_new_period() hardirq safe
In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: <timer fires…
-
Unscored —
net/mlx5e: TC, delete flows only for existing peers
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, delete flows only for existing peers When deleting TC steering flows, iterate only over actual devcom peers instead of assuming all possible ports exist. This avoids touching n…
-
Unscored —
mm, shmem: prevent infinite loop on truncate race
In the Linux kernel, the following vulnerability has been resolved: mm, shmem: prevent infinite loop on truncate race When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment.…
-
Unscored —
ceph: fix NULL pointer dereference in ceph_mds_auth_match()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in ceph_mds_auth_match() The CephFS kernel client has regression starting from 6.18-rc1. We have issue in ceph_mds_auth_match() if fs_name == NULL: const ch…
-
Unscored —
procfs: avoid fetching build ID while holding VMA lock
In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VMA lock Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under questio…
-
Unscored —
ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6 route. [0] Commit f72514b3c569 ("ipv6: clear RA flags w…
-
Unscored —
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix oops due to invalid pointer for kfree() in parse_longname() This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.…
-
Unscored —
spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer The curr_xfer field is read by the IRQ handler without holding the lock to check if a transfer is in progress. When clear…
-
Unscored —
smb/client: fix memory leak in smb2_open_file()
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mn…
-
Unscored —
bonding: annotate data-races around slave->last_rx
In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot r…
-
Unscored —
btrfs: reject new transactions if the fs is fully read-only
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only [BUG] There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnin…
-
Unscored —
x86/vmware: Fix hypercall clobbers
In the Linux kernel, the following vulnerability has been resolved: x86/vmware: Fix hypercall clobbers Fedora QA reported the following panic: BUG: unable to handle page fault for address: 0000000040003e54 #PF: supervisor write access in kernel mode #PF: erro…
-
Unscored —
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as co…
-
Unscored —
mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
In the Linux kernel, the following vulnerability has been resolved: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning may be noticed: [ 3959.023862] ------------[ cut…
-
Unscored —
xfs: fix UAF in xchk_btree_check_block_owner
In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by s…
-
Unscored —
net: gro: fix outer network offset
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs…
-
Unscored —
regmap: maple: free entry on mas_store_gfp() failure
In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gf…
-
Unscored —CVE-2026-31688 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71225.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71268.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23154.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23156.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23168.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23169.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23173.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23177.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23189.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23193.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23199.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23200.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23201.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23202.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23204.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23205.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23209.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23212.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23214.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23216.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23219.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23223.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23224.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23230.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23254.html