Amazon Linux 2 Security Advisory: ALAS2KERNEL-5.10-2026-126
Advisory Released Date: 2026-07-20
Advisory Updated Date: 2026-07-29
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (CVE-2026-31451)
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (CVE-2026-31755)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix locking in regulator_resolve_supply() error path (CVE-2026-46252)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331)
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)
In the Linux kernel, the following vulnerability has been resolved:
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix NULL pointer dereference (CVE-2026-53177)
In the Linux kernel, the following vulnerability has been resolved:
l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
In the Linux kernel, the following vulnerability has been resolved:
virtiofs: fix UAF on submount umount
iput() called from fuse_release_end() can Oops if the super block has
already been destroyed. Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.
This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.
Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time. (CVE-2026-53381)
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
A KASAN null-ptr-deref was observed in vcs_notifier():
BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}
The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).
Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.
store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.
Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does. (CVE-2026-53403)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
In the Linux kernel, the following vulnerability has been resolved:
pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
In the Linux kernel, the following vulnerability has been resolved:
bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)
In the Linux kernel, the following vulnerability has been resolved:
keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
In the Linux kernel, the following vulnerability has been resolved:
KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
In the Linux kernel, the following vulnerability has been resolved:
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated(). (CVE-2026-64191)
Affected Packages:
kernel
Note:
This advisory is applicable to Amazon Linux 2 - Kernel-5.10 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update kernel or yum update --advisory ALAS2KERNEL-5.10-2026-126 to update your system.
System reboot is required in order to complete this update.
aarch64:
kernel-5.10.260-259.1053.amzn2.aarch64
kernel-headers-5.10.260-259.1053.amzn2.aarch64
kernel-debuginfo-common-aarch64-5.10.260-259.1053.amzn2.aarch64
perf-5.10.260-259.1053.amzn2.aarch64
perf-debuginfo-5.10.260-259.1053.amzn2.aarch64
python-perf-5.10.260-259.1053.amzn2.aarch64
python-perf-debuginfo-5.10.260-259.1053.amzn2.aarch64
kernel-tools-5.10.260-259.1053.amzn2.aarch64
kernel-tools-devel-5.10.260-259.1053.amzn2.aarch64
kernel-tools-debuginfo-5.10.260-259.1053.amzn2.aarch64
bpftool-5.10.260-259.1053.amzn2.aarch64
bpftool-debuginfo-5.10.260-259.1053.amzn2.aarch64
kernel-devel-5.10.260-259.1053.amzn2.aarch64
kernel-debuginfo-5.10.260-259.1053.amzn2.aarch64
kernel-livepatch-5.10.260-259.1053-1.0-0.amzn2.aarch64
i686:
kernel-headers-5.10.260-259.1053.amzn2.i686
src:
kernel-5.10.260-259.1053.amzn2.src
x86_64:
kernel-5.10.260-259.1053.amzn2.x86_64
kernel-headers-5.10.260-259.1053.amzn2.x86_64
kernel-debuginfo-common-x86_64-5.10.260-259.1053.amzn2.x86_64
perf-5.10.260-259.1053.amzn2.x86_64
perf-debuginfo-5.10.260-259.1053.amzn2.x86_64
python-perf-5.10.260-259.1053.amzn2.x86_64
python-perf-debuginfo-5.10.260-259.1053.amzn2.x86_64
kernel-tools-5.10.260-259.1053.amzn2.x86_64
kernel-tools-devel-5.10.260-259.1053.amzn2.x86_64
kernel-tools-debuginfo-5.10.260-259.1053.amzn2.x86_64
bpftool-5.10.260-259.1053.amzn2.x86_64
bpftool-debuginfo-5.10.260-259.1053.amzn2.x86_64
kernel-devel-5.10.260-259.1053.amzn2.x86_64
kernel-debuginfo-5.10.260-259.1053.amzn2.x86_64
kernel-livepatch-5.10.260-259.1053-1.0-0.amzn2.x86_64