Amazon Linux 2023 Security Advisory: ALAS2023-2026-1543
Advisory Released Date: 2026-04-07
Advisory Updated Date: 2026-05-13
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path (CVE-2024-14027)
In the Linux kernel, the following vulnerability has been resolved:
audit: add fchmodat2() to change attributes class (CVE-2025-71239)
In the Linux kernel, the following vulnerability has been resolved:
fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (CVE-2025-71265)
In the Linux kernel, the following vulnerability has been resolved:
fs: ntfs3: check return value of indx_find to avoid infinite loop (CVE-2025-71266)
In the Linux kernel, the following vulnerability has been resolved:
fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (CVE-2025-71267)
In the Linux kernel, the following vulnerability has been resolved:
fs/buffer: add alert in try_to_free_buffers() for folios without buffers (CVE-2025-71295)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not strictly require dirty metadata threshold for metadata writepages (CVE-2026-23157)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CVE-2026-23231)
In the Linux kernel, the following vulnerability has been resolved:
espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix memory allocation in nvme_pr_read_keys() (CVE-2026-23244)
In the Linux kernel, the following vulnerability has been resolved:
xfs: check for deleted cursors when revalidating two btrees (CVE-2026-23249)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CVE-2026-23270)
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (CVE-2026-23271)
In the Linux kernel, the following vulnerability has been resolved:
macvlan: observe an RCU grace period in macvlan_common_newlink() error path (CVE-2026-23273)
In the Linux kernel, the following vulnerability has been resolved:
drbd: fix null-pointer dereference on local read error (CVE-2026-23285)
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix recursive locking in __configfs_open_file() (CVE-2026-23292)
In the Linux kernel, the following vulnerability has been resolved:
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293)
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix refcount leak for tagset_refcnt (CVE-2026-23296)
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). (CVE-2026-23297)
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304)
In the Linux kernel, the following vulnerability has been resolved:
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded (CVE-2026-23310)
In the Linux kernel, the following vulnerability has been resolved:
i40e: Fix preempt count leak in napi poll tracepoint (CVE-2026-23313)
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: fix ARM64 alignment fault in multipath hash seed (CVE-2026-23316)
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (CVE-2026-23317)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (CVE-2026-23319)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (CVE-2026-23335)
In the Linux kernel, the following vulnerability has been resolved:
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (CVE-2026-23340)
In the Linux kernel, the following vulnerability has been resolved:
xdp: produce a warning when calculated tailroom is negative (CVE-2026-23343)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351)
In the Linux kernel, the following vulnerability has been resolved:
x86/efi: defer freeing of boot services memory (CVE-2026-23352)
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint() (CVE-2026-23354)
In the Linux kernel, the following vulnerability has been resolved:
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() (CVE-2026-23356)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack-out-of-bounds write in devmap (CVE-2026-23359)
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset (CVE-2026-23360)
In the Linux kernel, the following vulnerability has been resolved:
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (CVE-2026-23361)
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix locking for bcm_op runtime updates (CVE-2026-23362)
In the Linux kernel, the following vulnerability has been resolved:
i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (CVE-2026-23369)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: fix divide by zero in the offload path (CVE-2026-23379)
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix WARN_ON in tracing_buffers_mmap_close (CVE-2026-23380)
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381)
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (CVE-2026-23383)
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check metadata block offset is within range (CVE-2026-23388)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Fix circular locking dependency in rds_tcp_tune (CVE-2026-23419)
In the Linux kernel, the following vulnerability has been resolved:
cifs: some missing initializations on replay (CVE-2026-31693)
In the Linux kernel, the following vulnerability has been resolved:
fbcon: check return value of con2fb_acquire_newinfo() (CVE-2026-43123)
In the Linux kernel, the following vulnerability has been resolved:
pstore: ram_core: fix incorrect success return when vmap() fails (CVE-2026-43124)
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
In the Linux kernel, the following vulnerability has been resolved:
ima: verify the previous kernel's IMA buffer lies in addressable RAM (CVE-2026-43129)
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (CVE-2026-43130)
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: correctly handle dm_bufio_client_create() failure (CVE-2026-43132)
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (CVE-2026-43139)
In the Linux kernel, the following vulnerability has been resolved:
mfd: core: Add locking around 'mfd_of_node_list' (CVE-2026-43143)
In the Linux kernel, the following vulnerability has been resolved:
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (CVE-2026-43147)
In the Linux kernel, the following vulnerability has been resolved:
perf/arm-cmn: Reject unsupported hardware configurations (CVE-2026-43150)
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-pl: handle probe errors (CVE-2026-43152)
In the Linux kernel, the following vulnerability has been resolved:
xfs: remove xfs_attr_leaf_hasname (CVE-2026-43153)
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (CVE-2026-43161)
In the Linux kernel, the following vulnerability has been resolved:
md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: always flush state and policy upon NETDEV_UNREGISTER event (CVE-2026-43167)
In the Linux kernel, the following vulnerability has been resolved:
drm/buddy: Prevent BUG_ON by validating rounded allocation (CVE-2026-43169)
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't dump the entire memory region (CVE-2026-43171)
In the Linux kernel, the following vulnerability has been resolved:
procfs: fix possible double mmput() in do_procmap_query() (CVE-2026-43178)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186)
In the Linux kernel, the following vulnerability has been resolved:
xfs: delete attr leaf freemap entries when empty (CVE-2026-43187)
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: Fix error handling on steps after finding a match (CVE-2026-43189)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
In the Linux kernel, the following vulnerability has been resolved:
net: consume xmit errors of GSO frames (CVE-2026-43194)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (CVE-2026-43199)
In the Linux kernel, the following vulnerability has been resolved:
APEI/GHES: ARM processor Error: don't go past allocated memory (CVE-2026-43201)
In the Linux kernel, the following vulnerability has been resolved:
tracing: ring-buffer: Fix to check event length before using (CVE-2026-43210)
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix pci_slot_trylock() error handling (CVE-2026-43211)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (CVE-2026-43214)
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix locking usage for tcon fields (CVE-2026-43215)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: No shortcut out of RDS_CONN_ERROR (CVE-2026-43226)
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Clear reconnect pending bit (CVE-2026-43230)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (CVE-2026-43238)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: prevent races in ->query_interfaces() (CVE-2026-43239)
In the Linux kernel, the following vulnerability has been resolved:
x86/kexec: add a sanity check on previous kernel's ima kexec buffer (CVE-2026-43240)
In the Linux kernel, the following vulnerability has been resolved:
kcm: fix zero-frag skb in frag_list on partial sendmsg error (CVE-2026-43244)
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: move wait_on_sem() out of spinlock (CVE-2026-43253)
In the Linux kernel, the following vulnerability has been resolved:
alpha: fix user-space corruption during memory compaction (CVE-2026-43258)
In the Linux kernel, the following vulnerability has been resolved:
arm64: Add support for TSV110 Spectre-BHB mitigation (CVE-2026-43261)
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (CVE-2026-43265)
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't go past the ARM processor CPER record buffer (CVE-2026-43266)
In the Linux kernel, the following vulnerability has been resolved:
ceph: supply snapshot context in ceph_zero_partial_object() (CVE-2026-43273)
In the Linux kernel, the following vulnerability has been resolved:
APEI/GHES: ensure that won't go past CPER allocated record (CVE-2026-43277)
In the Linux kernel, the following vulnerability has been resolved:
dm: clear cloned request bio pointer when last clone bio completes (CVE-2026-43278)
In the Linux kernel, the following vulnerability has been resolved:
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (CVE-2026-43281)
In the Linux kernel, the following vulnerability has been resolved:
drm: Account property blob allocations to memcg (CVE-2026-43287)
In the Linux kernel, the following vulnerability has been resolved:
ext4: move ext4_percpu_param_init() before ext4_mb_init() (CVE-2026-43288)
In the Linux kernel, the following vulnerability has been resolved:
kexec: derive purgatory entry from symbol (CVE-2026-43289)
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (CVE-2026-43292)
In the Linux kernel, the following vulnerability has been resolved:
libceph: define and enforce CEPH_MAX_KEY_LEN (CVE-2026-43304)
In the Linux kernel, the following vulnerability has been resolved:
bpf: crypto: Use the correct destructor kfunc type (CVE-2026-43306)
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (CVE-2026-43313)
In the Linux kernel, the following vulnerability has been resolved:
dm: remove fake timeout to avoid leak request (CVE-2026-43314)
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (CVE-2026-43315)
Affected Packages:
kernel6.12
Issue Correction:
Run dnf update kernel6.12 --releasever 2023.11.20260406 or dnf update --advisory ALAS2023-2026-1543 --releasever 2023.11.20260406 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
kernel6.12-libbpf-devel-6.12.77-99.140.amzn2023.aarch64
bpftool6.12-6.12.77-99.140.amzn2023.aarch64
kernel-livepatch-6.12.77-99.140-1.0-0.amzn2023.aarch64
perf6.12-6.12.77-99.140.amzn2023.aarch64
kernel6.12-tools-devel-6.12.77-99.140.amzn2023.aarch64
kernel6.12-tools-debuginfo-6.12.77-99.140.amzn2023.aarch64
python3-perf6.12-debuginfo-6.12.77-99.140.amzn2023.aarch64
kernel6.12-modules-extra-common-6.12.77-99.140.amzn2023.aarch64
python3-perf6.12-6.12.77-99.140.amzn2023.aarch64
kernel6.12-libbpf-6.12.77-99.140.amzn2023.aarch64
kernel6.12-libbpf-static-6.12.77-99.140.amzn2023.aarch64
kernel6.12-modules-extra-6.12.77-99.140.amzn2023.aarch64
kernel6.12-libbpf-debuginfo-6.12.77-99.140.amzn2023.aarch64
kernel6.12-headers-6.12.77-99.140.amzn2023.aarch64
perf6.12-debuginfo-6.12.77-99.140.amzn2023.aarch64
bpftool6.12-debuginfo-6.12.77-99.140.amzn2023.aarch64
kernel6.12-debuginfo-6.12.77-99.140.amzn2023.aarch64
kernel6.12-tools-6.12.77-99.140.amzn2023.aarch64
kernel6.12-6.12.77-99.140.amzn2023.aarch64
kernel6.12-debuginfo-common-aarch64-6.12.77-99.140.amzn2023.aarch64
kernel6.12-devel-6.12.77-99.140.amzn2023.aarch64
src:
kernel6.12-6.12.77-99.140.amzn2023.src
x86_64:
bpftool6.12-debuginfo-6.12.77-99.140.amzn2023.x86_64
kernel-livepatch-6.12.77-99.140-1.0-0.amzn2023.x86_64
kernel6.12-tools-6.12.77-99.140.amzn2023.x86_64
python3-perf6.12-6.12.77-99.140.amzn2023.x86_64
kernel6.12-libbpf-debuginfo-6.12.77-99.140.amzn2023.x86_64
kernel6.12-libbpf-devel-6.12.77-99.140.amzn2023.x86_64
kernel6.12-tools-devel-6.12.77-99.140.amzn2023.x86_64
perf6.12-debuginfo-6.12.77-99.140.amzn2023.x86_64
perf6.12-6.12.77-99.140.amzn2023.x86_64
kernel6.12-libbpf-6.12.77-99.140.amzn2023.x86_64
python3-perf6.12-debuginfo-6.12.77-99.140.amzn2023.x86_64
kernel6.12-modules-extra-common-6.12.77-99.140.amzn2023.x86_64
bpftool6.12-6.12.77-99.140.amzn2023.x86_64
kernel6.12-libbpf-static-6.12.77-99.140.amzn2023.x86_64
kernel6.12-headers-6.12.77-99.140.amzn2023.x86_64
kernel6.12-tools-debuginfo-6.12.77-99.140.amzn2023.x86_64
kernel6.12-modules-extra-6.12.77-99.140.amzn2023.x86_64
kernel6.12-debuginfo-6.12.77-99.140.amzn2023.x86_64
kernel6.12-6.12.77-99.140.amzn2023.x86_64
kernel6.12-debuginfo-common-x86_64-6.12.77-99.140.amzn2023.x86_64
kernel6.12-devel-6.12.77-99.140.amzn2023.x86_64
2026-05-13: CVE-2026-43123 was added to this advisory.
2026-05-13: CVE-2026-43150 was added to this advisory.
2026-05-13: CVE-2026-43230 was added to this advisory.
2026-05-13: CVE-2026-43289 was added to this advisory.
2026-05-13: CVE-2026-43163 was added to this advisory.
2026-05-13: CVE-2026-43261 was added to this advisory.
2026-05-13: CVE-2026-43304 was added to this advisory.
2026-05-13: CVE-2025-71295 was added to this advisory.
2026-05-13: CVE-2026-43313 was added to this advisory.
2026-05-13: CVE-2026-43194 was added to this advisory.
2026-05-13: CVE-2026-43167 was added to this advisory.
2026-05-13: CVE-2026-43139 was added to this advisory.
2026-05-13: CVE-2026-43153 was added to this advisory.
2026-05-13: CVE-2026-43233 was added to this advisory.
2026-05-13: CVE-2026-43171 was added to this advisory.
2026-05-13: CVE-2026-43265 was added to this advisory.
2026-05-13: CVE-2026-43287 was added to this advisory.
2026-05-13: CVE-2026-43244 was added to this advisory.
2026-05-13: CVE-2026-43201 was added to this advisory.
2026-05-13: CVE-2026-43258 was added to this advisory.
2026-05-13: CVE-2026-43215 was added to this advisory.
2026-05-13: CVE-2026-43288 was added to this advisory.
2026-05-13: CVE-2026-43161 was added to this advisory.
2026-05-13: CVE-2026-43292 was added to this advisory.
2026-05-13: CVE-2026-43189 was added to this advisory.
2026-05-13: CVE-2026-43306 was added to this advisory.
2026-05-13: CVE-2026-43210 was added to this advisory.
2026-05-13: CVE-2026-43266 was added to this advisory.
2026-05-13: CVE-2026-43315 was added to this advisory.
2026-05-13: CVE-2026-43190 was added to this advisory.
2026-05-13: CVE-2026-43226 was added to this advisory.
2026-05-13: CVE-2026-43240 was added to this advisory.
2026-05-13: CVE-2026-43277 was added to this advisory.
2026-05-13: CVE-2026-43314 was added to this advisory.
2026-05-13: CVE-2026-43199 was added to this advisory.