Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-63833: In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users] CVE-2026-63830: In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms CVE-2026-63824: In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() CVE-2026-63823: In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths CVE-2026-63809: In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer CVE-2026-63808: In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() CVE-2026-63807: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level CVE-2026-63801: In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done CVE-2026-63800: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() CVE-2026-53403: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() relies on this and treats a failed fb_match_mode() as "This should not happen". fb_set_var() keeps it true by adding the mode to the list on every change, and do_register_framebuffer() does the same at registration. store_modes() replaces the modelist from userspace. fb_new_modelist() validates the new modes but does not check that info->var still has a match. It relies on fbcon_new_modelist() to re-point consoles, but that only handles consoles mapped to the framebuffer. With fbcon unbound there are none, so info->var is left describing a mode that is no longer in the list. A later console takeover runs var_to_display(), where fb_match_mode() returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode. Keep the current mode in the list in fb_new_modelist(), the same way fb_set_var() does. CVE-2026-53398: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup CVE-2026-53397: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure CVE-2026-53391: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr CVE-2026-53388: In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues. Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio(). CVE-2026-53385: In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). CVE-2026-53381: In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time. CVE-2026-53361: In th
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.177-224.371 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.177-224.371.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.177-224.371.amzn2023 |
Vulnerabilities 26
-
Critical 9.8
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is pars…
-
Critical 9.8
NFSD: Fix SECINFO_NO_NAME decode error cleanup
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfser…
-
Critical 9.8
pNFS: Fix use-after-free in pnfs_update_layout()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_pu…
-
Critical 9.8
exfat: fix potential use-after-free in exfat_find_dir_entry()
In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through T…
-
Critical 9.4
net: skmsg: preserve sg.copy across SG transforms
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the …
-
Critical 9.1
sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…
-
High 8.8
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, un…
-
High 8.8
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained wi…
-
High 8.1
ipv6: use RCU in ip6_output()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().
-
High 7.8
xfrm: Wait for RCU readers during policy netns exit
In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait …
-
High 7.8CVE-2026-46331 Public exploit
net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…
-
High 7.8
ip6_vti: set netns_immutable on the fallback device.
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6…
-
High 7.8
sched/psi: fix race between file release and pressure write
In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_fi…
-
High 7.8
virtiofs: fix UAF on submount umount
In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go …
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
bpf: use kvfree() for replaced sysctl write buffer
In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzal…
-
High 7.8
keys: Pin request_key_auth payload in instantiate paths
In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for he…
-
High 7.8
KEYS: fix overflow in keyctl_pkey_params_get_2()
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bu…
-
High 7.5
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then imme…
-
High 7.5
nfsd: fix posix_acl leak on SETACL decode failure
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFA…
-
High 7.1CVE-2026-53361 Public exploit
af_unix: Set gc_in_progress to true in unix_gc().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thre…
-
High 7.1
ntfs3: reject direct userspace writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode fr…
-
Unscored —
af_unix: Reject SIOCATMARK on non-stream sockets
In the Linux kernel, the following vulnerability has been resolved: af_unix: Reject SIOCATMARK on non-stream sockets SIOCATMARK reports whether the receive queue is at the urgent mark for MSG_OOB. In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.…
-
Unscored —
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is int…
-
Unscored —
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read o…
-
Unscored —
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() r…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40158.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43091.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46331.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-52909.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-52928.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-52991.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53167.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53224.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53246.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53361.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53381.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53385.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53388.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53391.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53397.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53398.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-53403.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63800.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63801.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63807.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63808.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63823.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63824.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63830.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-63833.html