Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-74580: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74556: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer CVE-2026-72051: In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink CVE-2026-68480: In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection CVE-2026-68338: In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister CVE-2026-68335: In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries CVE-2026-68299: In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets CVE-2026-68160: In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() CVE-2026-68155: In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors CVE-2026-68138: In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put CVE-2026-68131: In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path CVE-2026-64581: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() CVE-2026-64564: In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing CVE-2026-64017: In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.182-227.379 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.182-227.379.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.182-227.379.amzn2023 |
Vulnerabilities 14
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
Critical 9.8
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build…
-
Critical 9.8
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, whi…
-
High 8.8
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once t…
-
High 8.8CVE-2026-74580 Public exploit
vhost: reset the vring metadata cache on vring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…
-
High 7.8
blk-mq: pop cached request if it is usable
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_f…
-
High 7.8
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cach…
-
High 7.8CVE-2026-68138 Public exploit
net/sched: serialize qdisc_rtab_list against concurrent get/put
In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int …
-
High 7.8
rds: drop incoming messages that cross network namespace boundaries
In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network …
-
High 7.8
net/packet: avoid fanout hook re-registration after unregister
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous runni…
-
High 7.5
rbd: Reset positive result codes to zero in object map update path
In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. Whil…
-
High 7.5
libceph: Reject monmaps advertising zero monitors
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…
-
High 7.5
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the d…
-
Unscored —
x86/bugs: Make Safe-RET robust against interrupt injection
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64017.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64564.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64581.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68131.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68138.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68155.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68299.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68335.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68338.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-68480.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-72051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-74556.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-74580.html