Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23140: In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size CVE-2026-23136: In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() CVE-2026-23047: In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just clear it CVE-2026-22994: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() CVE-2026-22992: In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() CVE-2026-22991: In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation CVE-2026-22990: In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() CVE-2026-22989: In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem CVE-2026-22984: In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() CVE-2026-22980: In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace CVE-2026-22979: In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets CVE-2026-22978: In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point CVE-2026-22977: In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue CVE-2026-22976: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset CVE-2025-71184: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction CVE-2025-71183: In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs CVE-2025-71182: In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered CVE-2025-71160: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible CVE-2025-71144: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() CVE-2025-71134: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing CVE-2025-71088: In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection CVE-2025-68792: In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size CVE-2025-40149: In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.66-88.122 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.66-88.122.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.66-88.122.amzn2023 |
Vulnerabilities 23
-
Critical 9.8
libceph: prevent potential out-of-bounds reads in handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…
-
Critical 9.1
btrfs: always detect conflicting inodes when logging inode refs
In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes …
-
High 7.8
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's u…
-
High 7.8
tpm2-sessions: Fix out of range indexing in name_size
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at wors…
-
High 7.8
nfsd: provide locking for v4_end_grace
In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We c…
-
High 7.5
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …
-
High 7.5
libceph: make free_choose_arg_map() resilient to partial allocation
In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decode…
-
High 7.5
libceph: return the handler error from mon_handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_do…
-
High 7.5
libceph: reset sparse-read state in osd_fault()
In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of …
-
Unscored —
mptcp: fallback earlier on simult connection
In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection Syzkaller reports a simult-connect race leading to inconsistent fallback status: WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_…
-
Unscored —
mm/page_alloc: change all pageblocks migrate type on coalescing
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differ…
-
Unscored —
mptcp: ensure context reset on disconnect()
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TCP_CLOSE status or has fallback to TCP at mptcp_disconnect() time, mptcp_do_fastcl…
-
Unscored —
netfilter: nf_tables: avoid chain re-validation if possible
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nft_chain_validate(): watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re…
-
Unscored —
can: j1939: make j1939_session_activate() fail if device is no longer registered
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after c…
-
Unscored —
btrfs: fix NULL dereference on root when tracing inode eviction
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evi…
-
Unscored —
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects …
-
Unscored —
net: sock: fix hardened usercopy panic in sock_recv_errqueue
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[…
-
Unscored —
wifi: avoid kernel-infoleak from struct iw_point
In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 leng…
-
Unscored —
net: fix memory leak in skb_segment_list for GRO packets
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, t…
-
Unscored —
nfsd: check that server is running in unlock_filesystem
In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens c…
-
Unscored —
bpf: Fix reference count leak in bpf_prog_test_run_xdp()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that …
-
Unscored —
libceph: make calc_target() set t->paused, not just clear it
In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just clear it Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it…
-
Unscored —
bpf, test_run: Subtract size of xdp_frame from allowed metadata size
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_r…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40149.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68792.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71088.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71134.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71144.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71182.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71184.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22976.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22978.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22979.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22980.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22984.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22989.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22990.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22991.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22992.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-22994.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23047.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23136.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23140.html