Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-64253: In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() CVE-2026-64250: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() CVE-2026-64248: In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu() CVE-2026-64247: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks CVE-2026-64245: In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() CVE-2026-64244: In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration CVE-2026-63833: In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users] CVE-2026-63830: In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms CVE-2026-63829: In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-63828: In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg CVE-2026-63826: In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() CVE-2026-63824: In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() CVE-2026-63823: In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths CVE-2026-63810: In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace CVE-2026-63809: In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer CVE-2026-63808: In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() CVE-2026-63807: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level CVE-2026-63806: In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() CVE-2026-63802: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() CVE-2026-63801: In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done CVE-2026-63800: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() CVE-2026-53403: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() relies on this and treats a failed fb_match_mode() as "This should not happen". fb_set_var() keeps it true by adding the mode to the list on every change, and do_register_framebuffer() does the same at registration. store_modes() replaces the modelist from userspace. fb_new_modelist() validates the new modes but does not check that info->var still has a match. It relies on fbcon_new_modelist() to re-point consoles, but that only handles consoles mapped to the framebuffer. With fbcon unbound there are none, so info->var is left describing a mode that is no longer in the list. A later console takeover runs var_to_display(), where fb_match_mode() returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode. Keep the current mode in the list in fb_new_modelist(), the same way fb_set_var() does. CVE-2026-53400: In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free. Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration. CVE-2026-53398: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup CVE-2026-53397: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure CVE-2026-53394: In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race CVE-2026-53393: In th
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.18 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | bpftool6.18-debuginfo | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.18.38-73.137 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.18 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-aarch64 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-x86_64 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-devel | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-headers | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra-common | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-debuginfo | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-devel | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | microvm-kernel6.18 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | perf6.18 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | perf6.18-debuginfo | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18 | 1:6.18.38-73.137.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18-debuginfo | 1:6.18.38-73.137.amzn2023 |
Vulnerabilities 37
-
Critical 9.8
NFSD: Fix SECINFO_NO_NAME decode error cleanup
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfser…
-
Critical 9.8
pNFS: Fix use-after-free in pnfs_update_layout()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_pu…
-
Critical 9.8
exfat: fix potential use-after-free in exfat_find_dir_entry()
In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through T…
-
Critical 9.4
net: skmsg: preserve sg.copy across SG transforms
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the …
-
High 8.8CVE-2026-53359 Public exploit
KVM: x86: Fix shadow paging use-after-free due to unexpected role
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch betw…
-
High 8.8
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, un…
-
High 8.8
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained wi…
-
High 8.8
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …
-
High 8.4CVE-2026-63828 Public exploit
apparmor: mediate the implicit connect of TCP fast open sendmsg
In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_…
-
High 8.4
KVM: x86: hyper-v: Bound the bank index when querying sparse banks
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a spars…
-
High 7.8
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() ma…
-
High 7.8
virtiofs: fix UAF on submount umount
In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go …
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
net/tcp-ao: fix use-after-free of key in del_async path
In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assumin…
-
High 7.8
i2c: core: fix adapter registration race
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter …
-
High 7.8
blk-cgroup: fix UAF in __blkcg_rstat_flush()
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…
-
High 7.8
bpf: use kvfree() for replaced sysctl write buffer
In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzal…
-
High 7.8
keys: Pin request_key_auth payload in instantiate paths
In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…
-
High 7.8
KEYS: fix overflow in keyctl_pkey_params_get_2()
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bu…
-
High 7.5
sctp: disable BH before calling udp_tunnel_xmit_skb()
In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit…
-
High 7.5
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then imme…
-
High 7.5
NFSv4/flexfiles: reject zero filehandle version count
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzal…
-
High 7.5
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Co…
-
High 7.5
nfsd: fix posix_acl leak on SETACL decode failure
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFA…
-
High 7.1CVE-2026-53361 Public exploit
af_unix: Set gc_in_progress to true in unix_gc().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thre…
-
High 7.1
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_una…
-
High 7.1
ntfs3: reject direct userspace writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode fr…
-
Unscored —
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read o…
-
Unscored —
nfsd: reset write verifier on deferred writeback errors
In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server…
-
Unscored —
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() r…
-
Unscored —
block: Avoid mounting the bdev pseudo-filesystem in userspace
In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that user…
-
Unscored —
fbdev: fix use-after-free in store_modes()
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fb_destroy_modelist(). Two fiel…
-
Unscored —
drivers/base/memory: set mem->altmap after successful device registration
In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory_block() fails at xa_store() (under memory pressure for example), device_unregister() is called, which…
-
Unscored —
fbdev: modedb: fix a possible UAF in fb_find_mode()
In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigned from mode_option_buf: if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode…
-
Unscored —
MIPS: smp: report dying CPU to RCU in stop_this_cpu()
In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu() smp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function marks the CPU offline for the scheduler via set_cpu_online(fals…
-
Unscored —
LoongArch: Report dying CPU to RCU in stop_this_cpu()
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all second…
-
Unscored —
kernel/fork: clear PF_BLOCK_TS in copy_process()
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NUL…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53070.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53359.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53361.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53381.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53385.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53388.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53389.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53391.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53392.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53393.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53394.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53397.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53398.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53400.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53403.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63800.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63801.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63802.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63806.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63807.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63808.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63810.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63823.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63824.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63826.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63828.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63829.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63830.html