Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-46329: In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts CVE-2026-46328: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers CVE-2026-46327: In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md CVE-2026-46266: In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP CVE-2026-46259: In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() CVE-2026-46256: In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages CVE-2026-46253: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() CVE-2026-46251: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption CVE-2026-45983: In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup CVE-2026-45982: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() CVE-2026-45974: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found CVE-2026-45973: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR hang in LAG error state unload CVE-2026-45971: In the Linux kernel, the following vulnerability has been resolved: bpf: Limit bpf program signature size CVE-2026-45970: In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down CVE-2026-45968: In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available CVE-2026-45964: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path CVE-2026-45957: In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to softirq CVE-2026-45955: In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout CVE-2026-45953: In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix IO hang with degraded array with llbitmap CVE-2026-45951: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free of BTF object CVE-2026-45949: In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition CVE-2026-45948: In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_ext_shift_extents() CVE-2026-45944: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry CVE-2026-45943: In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters CVE-2026-45942: In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports CVE-2026-45935: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot CVE-2026-45934: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation CVE-2026-45933: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve id of register in sync_linked_regs() CVE-2026-45932: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tcx/netkit detach permissions when prog fd isn't given CVE-2026-45927: In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash CVE-2026-45925: In the Linux kernel, the following vulnerability has been resolved: thermal/of: Fix reference leak in thermal_of_cm_lookup() CVE-2026-45922: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler CVE-2026-45920: In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown CVE-2026-45919: In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CVE-2026-45918: In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - don't deref NULL sk_socket member after tcp_close() CVE-2026-45917: In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down CVE-2026-45915: In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir CVE-2026-45913: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: always update mdb_n_entries for vlan contexts CVE-2026-45912: In the Linux kernel, the following vulnerability has been resolved: ext4: don't cache extent during splitting extent CVE-2026-45907: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlocks between devlink and netdev instance locks CVE-2026-45905: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path CVE-2026-45903: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix m
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.18 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | bpftool6.18-debuginfo | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.18.15-14.217 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.18 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-aarch64 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-x86_64 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-devel | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-headers | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-debuginfo | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-devel | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-static | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra-common | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-debuginfo | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-devel | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | perf6.18 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | perf6.18-debuginfo | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18 | 1:6.18.15-14.217.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18-debuginfo | 1:6.18.15-14.217.amzn2023 |
Vulnerabilities 82
-
Critical 9.8
RDMA/iwcm: Fix workqueue list corruption by removing work_list
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_wo…
-
Critical 9.1
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…
-
High 8.4
btrfs: fix block_group_tree dirty_list corruption
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_co…
-
High 8.2
fs/ntfs3: Initialize new folios before use
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longest_match_std(), invoked from ntfs_compress_write(). When new folios are allocated without being marked …
-
High 7.8
RDMA/umad: Reject negative data_len in ib_umad_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…
-
High 7.8
iommu/vt-d: Flush cache for PASID table before using it
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache fl…
-
High 7.8
iommu/vt-d: Clear Present bit before tearing down PASID entry
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implement…
-
High 7.8
bpf: Preserve id of register in sync_linked_regs()
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve id of register in sync_linked_regs() sync_linked_regs() copies the id of known_reg to reg when propagating bounds of known_reg to reg using the off of known_reg, but when known_…
-
High 7.8
fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without…
-
High 7.8
ext4: fix e4b bitmap inconsistency reports
In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like…
-
High 7.8
bpf: Fix a potential use-after-free of BTF object
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free of BTF object Refcounting in the check_pseudo_btf_id() function is incorrect: the __check_pseudo_btf_id() function might get called with a zero refcounted …
-
High 7.8
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_…
-
High 7.8
pstore/ram: fix buffer overflow in persistent_ram_save_old()
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_…
-
High 7.8
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…
-
High 7.8
dm: fix unlocked test for dm_suspended_md
In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding a…
-
High 7.5
btrfs: fix reservation leak in some error paths when inserting inline extent
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the …
-
High 7.5
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an …
-
High 7.5
smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available
In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might …
-
High 7.5
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capability flag and a gso packe…
-
High 7.5
netfilter: nf_conncount: increase the connection clean up limit to 64
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are…
-
High 7.5
iommu/vt-d: Clear Present bit before tearing down context entry
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This…
-
High 7.3
bpf: Fix tcx/netkit detach permissions when prog fd isn't given
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tcx/netkit detach permissions when prog fd isn't given This commit fixes a security issue where BPF_PROG_DETACH on tcx or netkit devices could be executed by any user when no program…
-
High 7.3
apparmor: fix rlimit for posix cpu timers
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and condit…
-
High 7.1
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using th…
-
High 7.1
md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOUT without resurrecting t…
-
Unscored —
smack: /smack/doi: accept previously used values
In the Linux kernel, the following vulnerability has been resolved: smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has ever been written there in the past disables networking for non-ambient labels. E.g. # cat /smack/doi 3…
-
Unscored —
net: gro: fix outer network offset
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs…
-
Unscored —
net: add proper RCU protection to /proc/net/ptype
In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate …
-
Unscored —
io_uring/rw: free potentially allocated iovec on cache put failure
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cach…
-
Unscored —
regmap: maple: free entry on mas_store_gfp() failure
In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gf…
-
Unscored —
io_uring/zcrx: fix page array leak
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix page array leak d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed a page leakage but didn't free the page array, release it as well.
-
Unscored —CVE-2026-23333 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow The dma_map_sg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices lik…
-
Unscored —
smb: client: make use of smbdirect_socket.recv_io.credits.available
In the Linux kernel, the following vulnerability has been resolved: smb: client: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might a…
-
Unscored —CVE-2026-31688 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —CVE-2026-43122 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() The update_cpu_qos_request() function attempts to initialize the 'freq' variable by dereferencing 'cpudata' bef…
-
Unscored —
net: remove WARN_ON_ONCE when accessing forward path array
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE when accessing forward path array Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARN_ON_ONCE if userspace manages to build a s…
-
Unscored —
efi: Fix reservation of unaccepted memory table
In the Linux kernel, the following vulnerability has been resolved: efi: Fix reservation of unaccepted memory table The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the si…
-
Unscored —
ata: libata-scsi: avoid Non-NCQ command starvation
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: avoid Non-NCQ command starvation When a non-NCQ command is issued while NCQ commands are being executed, ata_scsi_qc_issue() indicates to the SCSI layer that the command iss…
-
Unscored —
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and c…
-
Unscored —
fs/ntfs3: prevent infinite loops caused by the next valid being the same
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing valid within the range [valid : pos), if valid cannot be retrieved correctly, for example, if the retr…
-
Unscored —
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(…
-
Unscored —
scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for r…
-
Unscored —
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The ex…
-
Unscored —
arm64/gcs: Fix error handling in arch_set_shadow_stack_status()
In the Linux kernel, the following vulnerability has been resolved: arm64/gcs: Fix error handling in arch_set_shadow_stack_status() alloc_gcs() returns an error-encoded pointer on failure, which comes from do_mmap(), not NULL. The current NULL check fails to …
-
Unscored —
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap() doesn't invoke percpu_ref_put() to free the per-CPU r…
-
Unscored —
bpf: Fix bpf_xdp_store_bytes proto for read-only arg
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, t…
-
Unscored —
af_unix: Fix memleak of newsk in unix_stream_connect().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix memleak of newsk in unix_stream_connect(). When prepare_peercred() fails in unix_stream_connect(), unix_release_sock() is not called for newsk, and the memory is leaked. Let's mo…
-
Unscored —
md/raid1: fix memory leak in raid1_run()
In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix memory leak in raid1_run() raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not…
-
Unscored —
mptcp: do not account for OoO in mptcp_rcvbuf_grow()
In the Linux kernel, the following vulnerability has been resolved: mptcp: do not account for OoO in mptcp_rcvbuf_grow() MPTCP-level OoOs are physiological when multiple subflows are active concurrently and will not cause retransmissions nor are caused by dro…
-
Unscored —
xen-netback: reject zero-queue configuration from guest
In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only val…
-
Unscored —
quota: fix livelock between quotactl and freeze_super
In the Linux kernel, the following vulnerability has been resolved: quota: fix livelock between quotactl and freeze_super When a filesystem is frozen, quotactl_block() enters a retry loop waiting for the filesystem to thaw. It acquires s_umount, checks the fr…
-
Unscored —
ext4: drop extent cache when splitting extent fails
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale ext…
-
Unscored —
bpf: Fix memory access flags in helper prototypes
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memory access flags in helper prototypes After commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking"), the verifier started relying on the access type flags in h…
-
Unscored —
xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling …
-
Unscored —
net/mlx5e: Fix deadlocks between devlink and netdev instance locks
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlocks between devlink and netdev instance locks In the mentioned "Fixes" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_…
-
Unscored —
ext4: don't cache extent during splitting extent
In the Linux kernel, the following vulnerability has been resolved: ext4: don't cache extent during splitting extent Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases…
-
Unscored —
net: bridge: mcast: always update mdb_n_entries for vlan contexts
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: always update mdb_n_entries for vlan contexts syzbot triggered a warning[1] about the number of mdb entries in a context. It turned out that there are multiple ways to tri…
-
Unscored —
fat: avoid parent link count underflow in rmdir
In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionall…
-
Unscored —
ipvs: do not keep dest_dst if dev is going down
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not keep dest_dst if dev is going down There is race between the netdev notifier ip_vs_dst_event() and the code that caches dst with dev that is going down. As the FIB can be notifie…
-
Unscored —
ovpn: tcp - don't deref NULL sk_socket member after tcp_close()
In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - don't deref NULL sk_socket member after tcp_close() When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted …
-
Unscored —
sched/rt: Skip currently executing CPU in rto_next_cpu()
In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CP…
-
Unscored —
ext4: fix dirtyclusters double decrement on fs shutdown
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: …
-
Unscored —
RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function allocates memory for the device path using kobject_get_…
-
Unscored —
thermal/of: Fix reference leak in thermal_of_cm_lookup()
In the Linux kernel, the following vulnerability has been resolved: thermal/of: Fix reference leak in thermal_of_cm_lookup() In thermal_of_cm_lookup(), tr_np is obtained via of_parse_phandle(), but never released. Use the __free(device_node) cleanup attribute…
-
Unscored —
bpf: Require frozen map for calculating map hash
In the Linux kernel, the following vulnerability has been resolved: bpf: Require frozen map for calculating map hash Currently, bpf_map_get_info_by_fd calculates and caches the hash of the map regardless of the map's frozen state. This leads to a TOCTOU bug w…
-
Unscored —
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation I have been observing a number of systems aborting at insert_dev_extents() in btrfs_create_pending_block_groups(). The …
-
Unscored —
erofs: fix inline data read failure for ztailpacking pclusters
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, z_erofs_decom…
-
Unscored —
ext4: fix memory leak in ext4_ext_shift_extents()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_ext_shift_extents() In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained vi…
-
Unscored —
hwrng: core - use RCU and work_struct to fix race condition
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads hwrng_fill outside the r…
-
Unscored —
md/raid5: fix IO hang with degraded array with llbitmap
In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix IO hang with degraded array with llbitmap When llbitmap bit state is still unwritten, any new write should force rcw, as bitmap_ops->blocks_synced() is checked in handle_stripe_…
-
Unscored —
rcu: Fix rcu_read_unlock() deadloop due to softirq
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to softirq Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") removes the recursion-protection code from __rcu_read_u…
-
Unscored —
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added a kref_get(&gss_auth->kref) call to balance the gss_put_auth() …
-
Unscored —
cpuidle: Skip governor when only one idle state is available
In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where …
-
Unscored —
bpf: Limit bpf program signature size
In the Linux kernel, the following vulnerability has been resolved: bpf: Limit bpf program signature size Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE Allowing larger sizes opens the door for abuse by passing excessive size v…
-
Unscored —
RDMA/mlx5: Fix UMR hang in LAG error state unload
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR hang in LAG error state unload During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unl…
-
Unscored —
btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found If btrfs_search_slot_for_read() returns 1, it means we did not find any key greater than or equals to the key we as…
-
Unscored —
ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() Cover a missed execution path with a new check.
-
Unscored —
nfsd: never defer requests during idmap lookup
In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyon…
-
Unscored —
NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages LOCALIO is an NFS loopback mount optimization that avoids using the network for READ, WRITE and COMMIT if the NFS cli…
-
Unscored —
erofs: handle end of filesystem properly for file-backed mounts
In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71268.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71269.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71304.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71311.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23243.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23254.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23255.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23259.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23260.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23263.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23333.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23390.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31535.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31539.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31688.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43122.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43401.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45847.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45851.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45855.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45856.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45858.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45859.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45860.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45862.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45870.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45872.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45873.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-45876.html