Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43336: In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permuted_state before it leaves scope CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags "Dirty Frag" and other issues in Amazon Linux kernels: https://aws.amazon.com/security/security-bulletins/2026-027-aws/ CVE-2026-31787: In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting CVE-2026-31786: In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c CVE-2026-31689: In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fix error path ordering in edac_mc_alloc() CVE-2026-31671: In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() CVE-2026-31669: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established CVE-2026-31668: In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel CVE-2026-31667: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core CVE-2026-31665: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy CVE-2026-31664: In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() CVE-2026-31662: In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG CVE-2026-31656: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat CVE-2026-31634: In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix reference count leak in rxrpc_server_keyring() CVE-2026-31628: In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 CVE-2026-31533: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.170-210.320 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.170-210.320.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.170-210.320.amzn2023 |
Vulnerabilities 16
-
Critical 9.8
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto re…
-
Critical 9.8
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These …
-
Critical 9.8
mptcp: fix slab-use-after-free in __inet_lookup_established
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…
-
High 8.8
xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…
-
High 7.8
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / refcount underflow is possible when the heartbeat worker and intel_engine_park_heartbeat() race to releas…
-
High 7.8
netfilter: nft_ct: fix use-after-free in timeout object destroy
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an …
-
High 7.8
Input: uinput - fix circular locking dependency with ff-core
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for e…
-
High 7.8
Buffer overflow in drivers/xen/sys-hypervisor.c
In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …
-
High 7.5
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member h…
-
High 7.5
lib/crypto: chacha: Zeroize permuted_state before it leaves scope
In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permuted_state before it leaves scope Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state'…
-
Unscored —
x86/CPU: Fix FPDSS on Zen1
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. F…
-
Unscored —
rxrpc: fix reference count leak in rxrpc_server_keyring()
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix reference count leak in rxrpc_server_keyring() This patch fixes a reference count leak in rxrpc_server_keyring() by checking if rx->securities is already set.
-
Unscored —
xfrm: clear trailing padding in build_polexpire()
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogou…
-
Unscored —
xfrm_user: fix info leak in build_report()
In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the paddin…
-
Unscored —
EDAC/mc: Fix error path ordering in edac_mc_alloc()
In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fix error path ordering in edac_mc_alloc() When the mci->pvt_info allocation in edac_mc_alloc() fails, the error path will call put_device() which will end up calling the device's re…
-
Unscored —CVE-2026-31787 Public exploit
xen/privcmd: fix double free via VMA splitting
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31533.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31628.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31634.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31656.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31662.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31664.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31665.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31667.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31668.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31669.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31671.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31786.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31787.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43284.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43336.html