Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-46028: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests CVE-2026-43078: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl CVE-2026-43077: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption CVE-2026-43043: In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg - fix NULL pointer dereference in scatterwalk CVE-2026-43033: In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption CVE-2026-31677: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget CVE-2026-31431: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place To mitigate this issue, we recommend that customers disable loading of the algif_aead module by running the following commands as an administrator user: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead Some Amazon Linux 2 systems on the ARM64 architecture may fail the above rmmod command as they have the algif_aead module built-in. In this case, the following command and a reboot will mitigate the issue: sudo grubby --update-kernel ALL --args "initcall_blacklist=algif_aead_init"
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.18 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | bpftool6.18-debuginfo | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.18.20-41.237 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.18 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-aarch64 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-x86_64 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-devel | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-headers | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra-common | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-debuginfo | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-devel | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | perf6.18 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | perf6.18-debuginfo | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18 | 1:6.18.20-41.237.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18-debuginfo | 1:6.18.20-41.237.amzn2023 |
Vulnerabilities 7
-
High 7.8
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…
KEV May 1, 2026 -
High 7.8
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits…
-
High 7.8
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more pa…
-
Unscored —
crypto: af_alg - limit RX SG extraction by receive buffer budget
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer budget. af_alg_get_rsgl() currentl…
-
Unscored —
crypto: af-alg - fix NULL pointer dereference in scatterwalk
In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg - fix NULL pointer dereference in scatterwalk The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendms…
-
Unscored —
crypto: algif_aead - Fix minimum RX size check for decryption
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the re…
-
Unscored —
crypto: algif_aead - snapshot IV for async AEAD requests
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31431.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31677.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43033.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43043.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43077.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46028.html