Skip to content
OpenAdvisories
High ALAS2023-2026-3455 6 CVEs

Important: kernel security update (Amazon Linux 2023)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-98993: In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() CVE-2026-98863: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails CVE-2026-98056: In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan CVE-2026-89912: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save CVE-2026-72434: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped CVE-2026-43456: In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave()

Fixed packages 19

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-debuginfo 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-aarch64 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-x86_64 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-devel 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-headers 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.1.190-237.442 1:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-tools 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 kernel-tools-devel 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 microvm-kernel 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 perf 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 perf-debuginfo 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 python3-perf 1:6.1.190-237.442.amzn2023
Amazon Linux · 2023 python3-perf-debuginfo 1:6.1.190-237.442.amzn2023

Vulnerabilities 6

  • High 7.8
    CVE-2026-43456

    bonding: fix type confusion in bond_setup_by_slave()

    In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-72434

    netfilter: ipset: make sure gc is properly stopped

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, cancel_delayed_work_sync() was called while gc calls queue_delayed_work() unconditionally which …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98993

    namespace: don't inherit MNT_UMOUNT in clone_mnt()

    In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-98056

    nvme: remove stale namespaces by NSID range during scan

    In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme_scan_ns_list() drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvme_fin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-89912

    KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite->collection but leaves the ITE on the device's ITT list, and vgic_its_save_ite() dereferences it …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98863

    KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path. If users…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-72434.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98993.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98863.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43456.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-98056.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-89912.html