Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-46328: In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers CVE-2026-46259: In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() CVE-2026-46253: In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() CVE-2026-46251: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption CVE-2026-45983: In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup CVE-2026-45982: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() CVE-2026-45974: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found CVE-2026-45970: In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down CVE-2026-45968: In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available CVE-2026-45964: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path CVE-2026-45948: In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_ext_shift_extents() CVE-2026-45935: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot CVE-2026-45919: In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CVE-2026-45915: In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir CVE-2026-45912: In the Linux kernel, the following vulnerability has been resolved: ext4: don't cache extent during splitting extent CVE-2026-45905: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path CVE-2026-45890: In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest CVE-2026-45886: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg CVE-2026-45873: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets CVE-2026-45872: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() CVE-2026-45870: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths CVE-2026-45864: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same CVE-2026-45862: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it CVE-2026-45860: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 CVE-2026-45856: In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send CVE-2026-45847: In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE when accessing forward path array CVE-2026-43315: In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding CVE-2026-43314: In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request CVE-2026-43313: In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() CVE-2026-43304: In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN CVE-2026-43289: In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol CVE-2026-43287: In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg CVE-2026-43278: In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes CVE-2026-43277: In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record CVE-2026-43273: In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() CVE-2026-43266: In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer CVE-2026-43261: In the Linux kernel, the following vulnerability has been resolved: arm64: Add support for TSV110 Spectre-BHB mitigation CVE-2026-43240: In the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer CVE-2026-43238: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() CVE-2026-43233: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() CVE-2026-43230: In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit CVE-2026-43226: In the Linux kerne
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.166-197.305 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.166-197.305.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.166-197.305.amzn2023 |
Vulnerabilities 70
-
Critical 9.8
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts …
-
Critical 9.8
libceph: define and enforce CEPH_MAX_KEY_LEN
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The…
-
High 8.8
xfs: fix freemap adjustments when adding xattrs to leaf blocks
In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…
-
High 8.8
xfs: delete attr leaf freemap entries when empty
In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freem…
-
High 8.6
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source addres…
-
High 8.4
btrfs: fix block_group_tree dirty_list corruption
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_co…
-
High 8.2
netfilter: xt_tcpmss: check remaining length before reading optlen
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…
-
High 8.2
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …
-
High 7.9
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…
-
High 7.8CVE-2026-23231 Public exploit
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hook…
-
High 7.8
RDMA/umad: Reject negative data_len in ib_umad_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…
-
High 7.8
RDMA/umem: Fix double dma_buf_unpin in failure path
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …
-
High 7.8
perf/arm-cmn: Reject unsupported hardware configurations
In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which w…
-
High 7.8
PCI: Fix pci_slot_trylock() error handling
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_s…
-
High 7.8
KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest mem…
-
High 7.8
dm: clear cloned request bio pointer when last clone bio completes
In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets…
-
High 7.8
iommu/vt-d: Flush cache for PASID table before using it
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache fl…
-
High 7.8
fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without…
-
High 7.8
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_…
-
High 7.8
pstore/ram: fix buffer overflow in persistent_ram_save_old()
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_…
-
High 7.8
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…
-
High 7.5
net: consume xmit errors of GSO frames
In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and th…
-
High 7.5
net/rds: No shortcut out of RDS_CONN_ERROR
In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a state "rds_conn_path::cp_state" and transitions from one state to another and are conditional upon an expected state: "rds_c…
-
High 7.5
net/rds: Clear reconnect pending bit
In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit When canceling the reconnect worker, care must be taken to reset the reconnect-pending bit. If the reconnect worker has not yet been scheduled before it i…
-
High 7.5
netfilter: nf_conncount: increase the connection clean up limit to 64
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are…
-
High 7.3
apparmor: fix rlimit for posix cpu timers
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and condit…
-
High 7.1
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using th…
-
Unscored —
fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A ma…
-
Unscored —
fs: ntfs3: check return value of indx_find to avoid infinite loop
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed dent…
-
Unscored —
fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS im…
-
Unscored —
fs/buffer: add alert in try_to_free_buffers() for folios without buffers
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a fo…
-
Unscored —
smack: /smack/doi: accept previously used values
In the Linux kernel, the following vulnerability has been resolved: smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has ever been written there in the past disables networking for non-ambient labels. E.g. # cat /smack/doi 3…
-
Unscored —
drm/display/dp_mst: Add protection against 0 vcpi
In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a slight chance we may end up with the wrong payload mask due to overflow if the delayed_destroy_work ends…
-
Unscored —
fbcon: check return value of con2fb_acquire_newinfo()
In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Ad…
-
Unscored —
pstore: ram_core: fix incorrect success return when vmap() fails
In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the fu…
-
Unscored —
iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") relies on…
-
Unscored —
dm-verity: correctly handle dm_bufio_client_create() failure
In the Linux kernel, the following vulnerability has been resolved: dm-verity: correctly handle dm_bufio_client_create() failure If either of the calls to dm_bufio_client_create() in verity_fec_ctr() fails, then dm_bufio_client_destroy() is later called with …
-
Unscored —
mfd: core: Add locking around 'mfd_of_node_list'
In the Linux kernel, the following vulnerability has been resolved: mfd: core: Add locking around 'mfd_of_node_list' Manipulating a list in the kernel isn't safe without some sort of mutual exclusion. Add a mutex any time we access / modify 'mfd_of_node_list'…
-
Unscored —
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), whic…
-
Unscored —
HID: hid-pl: handle probe errors
In the Linux kernel, the following vulnerability has been resolved: HID: hid-pl: handle probe errors Errors in init must be reported back or we'll follow a NULL pointer the first time FF is used.
-
Unscored —
md/bitmap: fix GPF in write_page caused by resize race
In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…
-
Unscored —
EFI/CPER: don't dump the entire memory region
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cper_print_fw_err() doesn't check if the error record length is big enough to handle offset. On a bad firmware, if the ofset…
-
Unscored —
net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range s…
-
Unscored —
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
In the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that…
-
Unscored —
arm64: Add support for TSV110 Spectre-BHB mitigation
In the Linux kernel, the following vulnerability has been resolved: arm64: Add support for TSV110 Spectre-BHB mitigation The TSV110 processor is vulnerable to the Spectre-BHB (Branch History Buffer) attack, which can be exploited to leak information through b…
-
Unscored —
EFI/CPER: don't go past the ARM processor CPER record buffer
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the section_length is too small, but it doesn't detect if it is too big. Currently, …
-
Unscored —
ceph: supply snapshot context in ceph_zero_partial_object()
In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data in…
-
Unscored —
APEI/GHES: ensure that won't go past CPER allocated record
In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, …
-
Unscored —
drm: Account property blob allocations to memcg
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data all…
-
Unscored —
kexec: derive purgatory entry from symbol
In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable…
-
Unscored —
ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE device and then reassigned an ISA dev…
-
Unscored —
dm: remove fake timeout to avoid leak request
In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blk_mq_complete_request"), drivers are responsible for calling blk_should_fake_…
-
Unscored —
KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing as it is trivially easy to trigger from …
-
Unscored —
net: remove WARN_ON_ONCE when accessing forward path array
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE when accessing forward path array Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARN_ON_ONCE if userspace manages to build a s…
-
Unscored —
fs/ntfs3: prevent infinite loops caused by the next valid being the same
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing valid within the range [valid : pos), if valid cannot be retrieved correctly, for example, if the retr…
-
Unscored —
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(…
-
Unscored —
scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for r…
-
Unscored —
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The ex…
-
Unscored —
bpf: Fix bpf_xdp_store_bytes proto for read-only arg
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, t…
-
Unscored —
xen-netback: reject zero-queue configuration from guest
In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only val…
-
Unscored —
xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling …
-
Unscored —
ext4: don't cache extent during splitting extent
In the Linux kernel, the following vulnerability has been resolved: ext4: don't cache extent during splitting extent Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases…
-
Unscored —
fat: avoid parent link count underflow in rmdir
In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionall…
-
Unscored —
sched/rt: Skip currently executing CPU in rto_next_cpu()
In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CP…
-
Unscored —
ext4: fix memory leak in ext4_ext_shift_extents()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_ext_shift_extents() In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained vi…
-
Unscored —
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added a kref_get(&gss_auth->kref) call to balance the gss_put_auth() …
-
Unscored —
cpuidle: Skip governor when only one idle state is available
In the Linux kernel, the following vulnerability has been resolved: cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where …
-
Unscored —
btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found If btrfs_search_slot_for_read() returns 1, it means we did not find any key greater than or equals to the key we as…
-
Unscored —
ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() Cover a missed execution path with a new check.
-
Unscored —
nfsd: never defer requests during idmap lookup
In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyon…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71265.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71266.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71267.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71304.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71305.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23231.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23243.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43130.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43132.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43133.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43139.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43143.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43150.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43152.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43158.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43163.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43171.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43186.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43187.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43190.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43211.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43214.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43226.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43230.html