Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-52945: In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" CVE-2026-23273: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path CVE-2026-23238: In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0. CVE-2026-23230: In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields. CVE-2026-23229: In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. CVE-2026-23228: In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect(). CVE-2026-23222: In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size. CVE-2026-23221: In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. CVE-2026-23169: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() CVE-2025-71238: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_lo
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.164-196.303 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.164-196.303.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.164-196.303.amzn2023 |
Vulnerabilities 21
-
High 8.8
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() Callers of wdev_chandef() must hold the wiphy mutex. But the worker cfg80211_propagate_cac_done_wk() never takes the lock. Whi…
-
High 8.8
smb: client: split cached_fid bitfields to avoid shared-byte RMW races
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different co…
-
High 7.8
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…
-
High 7.8
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp…
-
High 7.8
crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, n…
-
High 7.8
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @…
-
High 7.5
scsi: qla2xxx: Validate sp before freeing associated memory
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate sp before freeing associated memory System crash with the following signature [154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete [154564.169363] qla2x…
-
High 7.5
Revert "wireguard: device: enable threaded NAPI"
In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had th…
-
Medium 5.5
clk: mediatek: fix of_iomap memory leak
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: fix of_iomap memory leak Smatch reports: drivers/clk/mediatek/clk-mtk.c:583 mtk_clk_simple_probe() warn: 'base' from of_iomap() not released on lines: 496. This problem was als…
-
Unscored —
ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, th…
-
Unscored —
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() From the memory-barriers.txt document regarding memory barrier ordering guarantees: (*) These guarantees do not apply to bitfie…
-
Unscored —
mptcp: ensure context reset on disconnect()
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TCP_CLOSE status or has fallback to TCP at mptcp_disconnect() time, mptcp_do_fastcl…
-
Unscored —
scsi: qla2xxx: Free sp in error path to fix system crash
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/unload test in a loop, [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ====…
-
Unscored —
PCI: endpoint: Avoid creating sub-groups asynchronously
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed…
-
Unscored —
scsi: qla2xxx: Delay module unload while fabric scan in progress
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 00000000…
-
Unscored —
nilfs2: Fix potential block overflow that cause system hang
In the Linux kernel, the following vulnerability has been resolved: nilfs2: Fix potential block overflow that cause system hang When a user executes the FITRIM command, an underflow can occur when calculating nblocks if end_block is too small. Since nblocks i…
-
Unscored —
scsi: qla2xxx: Fix bsg_done() causing double free
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: superv…
-
Unscored —
bus: fsl-mc: fix use-after-free in driver_override_show()
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store(…
-
Unscored —
smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decr…
-
Unscored —
crypto: virtio - Add spinlock protection with virtqueue notification
In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes…
-
Unscored —
romfs: check sb_set_blocksize() return value
In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block devic…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-53424.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38643.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39763.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40251.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68358.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71144.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71232.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71233.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71235.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71236.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71237.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71238.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23169.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23221.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23222.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23228.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23229.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23230.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23238.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23273.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-52945.html