Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-64379: In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid CVE-2026-46236: In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions CVE-2026-46234: In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order CVE-2026-46227: In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL CVE-2026-46214: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix accept queue count leak on transport mismatch CVE-2026-46209: In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() CVE-2026-46207: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix empty payload in tap skb for non-linear buffers CVE-2026-46164: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path CVE-2026-46159: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak CVE-2026-43350: In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits CVE-2026-43109: In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock CVE-2026-43088: In the Linux kernel, the following vulnerability has been resolved: net: af_key: zero aligned sockaddr tail in PF_KEY exports CVE-2026-31787: In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting CVE-2026-31786: In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c CVE-2026-31716: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec->used in journal-replay file record check CVE-2026-31709: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl CVE-2026-31708: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path CVE-2026-31700: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() CVE-2026-31694: In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache CVE-2026-31575: In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix hugetlb fault mutex hash calculation CVE-2026-31456: In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix race between concurrent split and refault CVE-2026-23171: In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.90-120.164 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.90-120.164.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.90-120.164.amzn2023 |
Vulnerabilities 22
-
High 8.8
smb: client: validate the whole DACL before rewriting it in cifsacl
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incomin…
-
High 8.1
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branc…
-
High 7.8
bonding: fix use-after-free due to enslave fail after slave array update
In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the n…
-
High 7.8CVE-2026-31694 Public exploit
fuse: reject oversized dirents in page cache
In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cac…
-
High 7.8
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspac…
-
High 7.8
fs/ntfs3: validate rec->used in journal-replay file record check
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec->used in journal-replay file record check check_file_record() validates rec->total against the record size but never validates rec->used. The do_action() journal-replay…
-
High 7.8
Buffer overflow in drivers/xen/sys-hypervisor.c
In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …
-
High 7.8
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned…
-
High 7.8
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…
-
High 7.6
smb: client: require a full NFS mode SID before reading mode bits
In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bi…
-
High 7.1
smb: client: mask server-provided mode to 07777 in modefromsid
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without …
-
High 7.0
btrfs: fix double free in create_space_info_sub_group() error path
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> …
-
Unscored —
mm/pagewalk: fix race between concurrent split and refault
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walk_pud_range() can race with a concurrent thread refaulting the PUD leaf entry causing it to try w…
-
Unscored —
mm/userfaultfd: fix hugetlb fault mutex hash calculation
In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix hugetlb fault mutex hash calculation In mfill_atomic_hugetlb(), linear_page_index() is used to calculate the page index for hugetlb_fault_mutex_hash(). However, linear_pag…
-
Unscored —CVE-2026-31787 Public exploit
xen/privcmd: fix double free via VMA splitting
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…
-
Unscored —
net: af_key: zero aligned sockaddr tail in PF_KEY exports
In the Linux kernel, the following vulnerability has been resolved: net: af_key: zero aligned sockaddr tail in PF_KEY exports PF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr payload space, so IPv6 addresses occupy 32 bytes on the wire.…
-
Unscored —
x86: shadow stacks: proper error handling for mmap lock
In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also sho…
-
Unscored —
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_ioctl_space_info() has a TOCTOU race between two passes over the block group RAID type lists. The first…
-
Unscored —
vsock/virtio: fix empty payload in tap skb for non-linear buffers
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix empty payload in tap skb for non-linear buffers For non-linear skbs, virtio_transport_build_skb() goes through virtio_transport_copy_nonlinear_skb() to copy the original pay…
-
Unscored —
vsock/virtio: fix accept queue count leak on transport mismatch
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix accept queue count leak on transport mismatch virtio_transport_recv_listen() calls sk_acceptq_added() before vsock_assign_transport(). If vsock_assign_transport() fails or s…
-
Unscored —
vsock: fix buffer size clamping order
In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larg…
-
Unscored —
media: rc: xbox_remote: heed DMA restrictions
In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The buffer for IO must not be part of the device structure because that violates the DMA coherency rules.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23171.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31456.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31575.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31694.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31700.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31708.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31709.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31716.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31786.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31787.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43088.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43109.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43350.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46164.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46207.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46209.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46214.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46227.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46234.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46236.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64379.html