Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99082: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache CVE-2026-99053: In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name CVE-2026-98857: In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth CVE-2026-98846: In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait CVE-2026-98805: In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes CVE-2026-98715: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN CVE-2026-98466: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 CVE-2026-98454: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads CVE-2026-98033: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames CVE-2026-97563: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() CVE-2026-90036: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping CVE-2026-89659: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke CVE-2026-89633: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() CVE-2026-74752: In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use CVE-2026-74356: In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost_get_avail_idx for a non empty ring
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.190-237.431 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | microvm-kernel | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.190-237.431.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.190-237.431.amzn2023 |
Vulnerabilities 15
-
Critical 9.8
sctp: validate cookie AUTH state before use
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…
-
Critical 9.8CVE-2026-89633 Public exploit
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against bu…
-
Critical 9.8
NFSD: Prevent client use-after-free during delegation revoke
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The client survives its state…
-
Critical 9.8
NFSD: Prevent client use-after-free during blocked-lock reaping
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_cl…
-
High 8.8
KVM: x86: Use active memslots for the per-vCPU MMIO cache
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fil…
-
High 8.2
KVM: arm64: Transfer the hyp stack pages out of the host stage-2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private…
-
High 8.1
smb: client: fix create context out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A …
-
High 7.8
tipc: hold a reference to nodes found by link name
In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_S…
-
High 7.4
vhost: fix vhost_get_avail_idx for a non empty ring
In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost_get_avail_idx for a non empty ring vhost_get_avail_idx is supposed to report whether it has updated vq->avail_idx. Instead, it returns whether all entries have been consumed,…
-
Unscored —
smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, b…
-
Unscored —
bpf: Preserve inner map identity in callback frames
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_…
-
Unscored —
KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU perf…
-
Unscored —
tipc: prevent GCM nonce reuse on peer key changes
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a k…
-
Unscored —
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog a…
-
Unscored —
ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-74356.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-74752.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-89633.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-89659.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-90036.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-97563.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98033.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98454.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98466.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98715.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98805.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98857.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99053.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99082.html