Skip to content
OpenAdvisories
High ALAS2023-2026-3183 6 CVEs

Important: kernel security update (Amazon Linux 2023)

Published Oct 12, 2026 · Updated Oct 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98775: In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure CVE-2026-98538: In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes CVE-2026-98096: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding CVE-2026-93125: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max CVE-2026-89652: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). CVE-2026-89637: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

Fixed packages 18

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-debuginfo 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-aarch64 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-x86_64 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-devel 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-headers 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.1.188-233.393 1:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-tools 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 kernel-tools-devel 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 perf 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 perf-debuginfo 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 python3-perf 1:6.1.188-233.393.amzn2023
Amazon Linux · 2023 python3-perf-debuginfo 1:6.1.188-233.393.amzn2023

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-89637

    smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89652

    ceph: bound copied dentry name length in NFS export get_name

    In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-93125

    bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.4
    CVE-2026-98096

    ipv6: sr: restore network header before routing and forwarding

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. Whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98538

    writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

    In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes cleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes per call and is called again until the dying wb…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98775

    nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

    In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure When ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() has succeeded, the error path calls fput(enclave_fil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-89637.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-89652.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93125.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98096.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98538.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98775.html