Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-99258: In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() CVE-2026-99256: In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking CVE-2026-99255: In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations CVE-2026-99254: In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work CVE-2026-99251: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() CVE-2026-99250: In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup CVE-2026-99249: In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable CVE-2026-99247: In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled CVE-2026-99246: In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock CVE-2026-99245: In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction CVE-2026-99244: In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper CVE-2026-99236: In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions CVE-2026-99231: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head CVE-2026-99229: In the Linux kernel, the following vulnerability has been resolved: io_uring/wait: don't spin on a stuck overflow list CVE-2026-99228: In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work CVE-2026-99227: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap CVE-2026-99226: In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup CVE-2026-99225: In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches CVE-2026-99223: In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses CVE-2026-99222: In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal CVE-2026-99221: In the Linux kernel, the following vulnerability has been resolved: keys/trusted_keys: return immediately after TPM unseal failure CVE-2026-99220: In the Linux kernel, the following vulnerability has been resolved: asymmetric_keys: reject trust keys without IDs CVE-2026-99219: In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in print_rec() CVE-2026-99218: In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads CVE-2026-99216: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths CVE-2026-99213: In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established CVE-2026-99211: In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering CVE-2026-99206: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates CVE-2026-99203: In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure CVE-2026-99201: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer CVE-2026-99191: In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() CVE-2026-99187: In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind CVE-2026-99181: In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe CVE-2026-99178: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context CVE-2026-99176: In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry CVE-2026-99175: In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown CVE-2026-99174: In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period CVE-2026-99173: In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too CVE-2026-99171: In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period CVE-2026-99169: In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED CVE-2026-99167: In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() CVE-2026-99165: In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect w
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.115-140.210 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.115-140.210.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.115-140.210.amzn2023 |
Vulnerabilities 70
-
Critical 9.8
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…
-
High 8.4
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmb…
-
High 8.2
xfs: fix capability check in xfs
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas …
-
High 8.1
tipc: protect node reset trace dump with node lock
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link …
-
High 7.8CVE-2026-89754 Public exploit
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of …
-
High 7.8
net: bridge: mcast: don't truncate the port group walk on teardown
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, b…
-
High 7.8
tracing: Keep the predicate limit separate from program capacity
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as th…
-
High 7.8
scsi: st: Fix use-after-free race between st_remove() and st_open()
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_…
-
High 7.8
net/sched: fix use-after-free in __tcf_action_put()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these o…
-
High 7.8
eventfs: Free the eventfs_inode after an rcu grace period too
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in r…
-
High 7.8
pipe: preserve existing fasync readers on writer setup failure
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO …
-
High 7.8
vsock: treat TCP_CLOSING as once-established
In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHE…
-
High 7.8
io_uring/waitid: prevent cancel reference wrap
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT…
-
High 7.8
io_uring/waitid: own the request before clearing ->head
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head io_waitid_remove_wq() only takes the wait queue lock if ->head is set. io_waitid_wait() clears ->head first thing, before it tries to b…
-
High 7.8
tracing: Reject incomplete event filter expressions
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to …
-
High 7.4
ipv4: udp: Create exceptions before socket matching
In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exceptio…
-
High 7.1
net/sched: cls_flower: validate mask pointer after nla_next()
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointe…
-
High 7.1
vsock/virtio: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound t…
-
High 7.1
tracing: Check operator stack capacity before pushing
In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writin…
-
High 7.0
smb: client: fix heap overflow in cifs_do_set_acl()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then c…
-
High 7.0
dm-crypt: fix a tiny race condition in crypt_dec_pending
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrup…
-
High 7.0
coredump: hold RCU while releasing parked threads
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It…
-
Unscored —
KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path. If users…
-
Unscored —
workqueue: Fix unbound pool lifetime for pending pwqs
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_try…
-
Unscored —
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of bein…
-
Unscored —
drm/i915/dmc: Harden DMC firmware payload parsing
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size…
-
Unscored —
ipv4: avoid divide by zero in fib_rebalance
In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_ro…
-
Unscored —
page_pool: keep frag_offset aligned for odd-sized requests
In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rounds the requested fragment size with size = ALIGN(size, dma_get_cache_alignment()); dma_get_cache_a…
-
Unscored —
sctp: validate chunk length in the inqueue parser
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp_inq_pop() currently accepts shorter declared lengths. A zero-length chunk lea…
-
Unscored —
io_uring/cancel: don't spin on local work the task can't run
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task can't run io_uring_cancel_generic() refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task i…
-
Unscored —
dm-integrity: fix infinite loop on discard with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks …
-
Unscored —
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_o…
-
Unscored —
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support t…
-
Unscored —
drm/exec: don't immediately add prelocked obj to array of locked objs
In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm_exec object grabs a reference to the contended object, unlocks all other objects an…
-
Unscored —
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index inf…
-
Unscored —
ring-buffer: Fix false warning in ring_buffer_map_get_reader()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in …
-
Unscored —
ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_setup_ids_meta_page() then…
-
Unscored —
ring-buffer: Do not show buffer_meta for CPUs without a buffer
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU …
-
Unscored —
sctp: revalidate output stream after association connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wai…
-
Unscored —
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM b…
-
Unscored —
ntfs3: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. nt…
-
Unscored —
ext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That read…
-
Unscored —
fsnotify: prevent mark additions during connector teardown
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the fo…
-
Unscored —
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, …
-
Unscored —
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags…
-
Unscored —
autofs: ignore notification errors from a replaced pipe
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the reque…
-
Unscored —
perf: Fix perf_pmu_migrate_context() leaving events behind
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. per…
-
Unscored —
calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload = ntohs(ip6_hdr->payload_…
-
Unscored —
netlink: avoid hashing the network namespace pointer
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics …
-
Unscored —
scsi: target: iscsi: Fix race in discovery auth updates
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_updat…
-
Unscored —
netlink: reset skb headers before unicast and multicast filtering
In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may…
-
Unscored —
ftrace: Initialize modname and offset in print_rec()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in print_rec() print_rec() leaves 'modname' and 'offset' uninitialized and kallsyms_lookup() only sets them on success. When the lookup fails like when a…
-
Unscored —
asymmetric_keys: reject trust keys without IDs
In the Linux kernel, the following vulnerability has been resolved: asymmetric_keys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally dereferences that slot when a…
-
Unscored —
keys/trusted_keys: return immediately after TPM unseal failure
In the Linux kernel, the following vulnerability has been resolved: keys/trusted_keys: return immediately after TPM unseal failure trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation fails. If pcrlock() succeeds, its return value overwrit…
-
Unscored —
keys: Protect the read method check against type removal
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctl_read_key() checks key->type->read without holding key->sem. A reference keeps the key alive, but does not pin the module contai…
-
Unscored —
keys: make keyring indexes independent of kernel addresses
In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTL_READ returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, d…
-
Unscored —
keys: Check the authorization payload in process keyring searches
In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the request…
-
Unscored —
keys: Avoid the owner account dereference in named keyring lookup
In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. find_keyring_b…
-
Unscored —
io_uring/io-wq: don't lose the signal that ends work
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. io_wq_exit_workers() signals every worker, to g…
-
Unscored —
io_uring/wait: don't spin on a stuck overflow list
In the Linux kernel, the following vulnerability has been resolved: io_uring/wait: don't spin on a stuck overflow list As long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule() returns right away, before it gets to look at signals or arms the time…
-
Unscored —
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processe…
-
Unscored —
KEYS: Fix key_reject_and_link() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with a concurrent keyring_re…
-
Unscored —
tracing: Do not initialize tracefs work if tracing is disabled
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is…
-
Unscored —
pid_namespace: make zap_pid_ns_processes() freezable
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the…
-
Unscored —
printk: Postpone kthread startup
In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during …
-
Unscored —
Drivers: hv: Avoid infinite retry loop in init_vp_index()
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocat…
-
Unscored —
io_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats that until the list is emp…
-
Unscored —
io_uring/io-wq: don't hide a link from cancellations
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks everywhere a request can be,…
-
Unscored —
dm cache: fix issue with background work locking
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee th…
-
Unscored —
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when runnin…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-89754.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-98863.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99077.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99105.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99110.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99112.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99117.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99118.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99121.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99127.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99130.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99131.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99135.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99136.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99138.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99139.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99142.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99143.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99153.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99155.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99156.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99158.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99165.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-99167.html