Skip to content
OpenAdvisories
High ALAS2023-2026-3390 8 CVEs

Important: kernel6.18 security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98788: In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize CVE-2026-98715: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN CVE-2026-98376: In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement CVE-2026-98318: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups CVE-2026-98033: In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames CVE-2026-97563: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() CVE-2026-93148: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEM_ALLOC BTF accesses past object bounds CVE-2026-74752: In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use

Fixed packages 19

ReleasePackageFixed in
Amazon Linux · 2023 bpftool6.18 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 bpftool6.18-debuginfo 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.18.56-126.188 1:1.0-0.amzn2023
Amazon Linux · 2023 kernel6.18 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-debuginfo 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-debuginfo-common-aarch64 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-debuginfo-common-x86_64 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-devel 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-headers 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-modules-extra 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-modules-extra-common 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-tools 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-tools-debuginfo 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 kernel6.18-tools-devel 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 microvm-kernel6.18 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 perf6.18 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 perf6.18-debuginfo 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 python3-perf6.18 1:6.18.56-126.188.amzn2023
Amazon Linux · 2023 python3-perf6.18-debuginfo 1:6.18.56-126.188.amzn2023

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-74752

    sctp: validate cookie AUTH state before use

    In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-93148

    bpf: Reject MEM_ALLOC BTF accesses past object bounds

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEM_ALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98318

    smb: client: validate absolute native symlink targets before NT fixups

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-98376

    bpf: Use array_map_meta_equal for percpu array inner map replacement

    In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-97563

    smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98033

    bpf: Preserve inner map identity in callback frames

    In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98715

    KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU perf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98788

    futex: Fix private hash use-after-free on resize

    In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passed since the current hash…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-74752.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-93148.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-97563.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98033.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98318.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98376.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98715.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98788.html