Amazon Linux 2023 Security Advisory: ALAS2023-2026-1881
Advisory Released Date: 2026-06-22
Advisory Updated Date: 2026-08-05
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
In the Linux kernel, the following vulnerability has been resolved:
io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)
In the Linux kernel, the following vulnerability has been resolved:
ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: ipcomp: Free destination pages on acomp errors (CVE-2026-52932)
In the Linux kernel, the following vulnerability has been resolved:
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937)
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix uninit-value in fuse_dentry_revalidate() (CVE-2026-53311)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)
In the Linux kernel, the following vulnerability has been resolved:
serial: zs: Convert to use a platform device (CVE-2026-63876)
In the Linux kernel, the following vulnerability has been resolved:
serial: dz: Convert to use a platform device (CVE-2026-63877)
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
In the Linux kernel, the following vulnerability has been resolved:
drm/gem: fix race between change_handle and handle_delete (CVE-2026-63885)
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (CVE-2026-63896)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: restore combined single-frag length gate
The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.
Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.
Restore this combined-length page gate for both IPv4 and IPv6. (CVE-2026-63912)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: route MIGRATE notifications to caller's netns (CVE-2026-63914)
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_changelink(). (CVE-2026-63917)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
After patch 1/2 in this series, vti6_update() unlinks and relinks
the tunnel through t->net. vti6_siocdevprivate() still uses
dev_net(dev) for the collision lookup. For a tunnel moved through
IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.
SIOCCHGTUNNEL on a migrated tunnel then runs:
net = dev_net(dev) /* migrated netns */
t = vti6_locate(net, &p1, false) /* misses target in t->net */
...
t = netdev_priv(dev)
vti6_update(t, &p1, false) /* mutates t->net's hash */
A caller in the migrated netns picks params that match a tunnel
in the creation netns. The lookup in dev_net(dev) finds nothing.
vti6_update() prepends the migrated tunnel at the head of the
creation netns hash bucket for those params. Later lookups in
the creation netns resolve to the migrated device. xfrm receive
delivers the matched packets through a device the caller controls.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Switch the SIOCCHGTUNNEL path on a non fallback device to use
t->net for the lookup. The lookup now matches the netns
vti6_update() operates on.
Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before
the lookup. The check at the top of the case is against
dev_net(dev)->user_ns, which after migration is the attacker's
netns. A caller there can pick params absent from self->net,
the lookup returns NULL, t becomes self, and vti6_update()
inserts the device into the creation netns hash. The new check
requires CAP_NET_ADMIN in the creation netns user_ns too.
SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep
dev_net(dev), which equals init_net there. (CVE-2026-63921)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.
Let's recompute nh pointer to make sure any change won't mess things up. (CVE-2026-63924)
In the Linux kernel, the following vulnerability has been resolved:
macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
When bpf_msg_push_data() inserts data in the middle of a scatterlist
entry, it splits the original entry into a left fragment and a right
fragment.
The right fragment offset is page-local, but the code advances it with
`start`, which is the message-global insertion point. For inserts into a
non-first SG entry, this over-advances the offset and leaves the split
layout inconsistent.
Advance the right fragment offset by the fragment-local delta,
`start - offset`, which matches the length removed from the front of the
original entry. (CVE-2026-63926)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (CVE-2026-63937)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Check PSC request indices against the actual size of the buffer (CVE-2026-63938)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Compute the correct max length of the in-GHCB scratch area (CVE-2026-63939)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Ignore Port I/O requests of length '0'
Explicitly ignore Port I/O requests of length '0' (or count '0'), so that
setting up the software scratch area (and other code) doesn't have to
worry about underflowing the length, and to allow for WARNing on trying
to configure the scratch area with len==0. (CVE-2026-63940)
In the Linux kernel, the following vulnerability has been resolved:
mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one (CVE-2026-63950)
In the Linux kernel, the following vulnerability has been resolved:
memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in fib6_select_path() (CVE-2026-63968)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible infinite loop in rt6_fill_node() (CVE-2026-63969)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix race between sctp_wait_for_connect and peeloff
sctp_wait_for_connect() drops and re-acquires the socket lock while
waiting for the association to reach ESTABLISHED state. During this
window, another thread can peeloff the association to a new socket via
getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After
re-acquiring the old socket lock, sctp_wait_for_connect() returns
success without noticing the migration -- the caller then accesses
the association under the wrong lock in sctp_datamsg_from_user().
Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf()
already has, returning an error if the association was migrated while
we slept. (CVE-2026-63971)
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: Use spin_lock_bh for hn_lock (CVE-2026-63980)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: eeprom: add more safeties to EEPROM Netlink fallback (CVE-2026-63985)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (CVE-2026-63986)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CVE-2026-63987)
In the Linux kernel, the following vulnerability has been resolved:
bridge: Fix sleep in atomic context in sysfs path (CVE-2026-63988)
In the Linux kernel, the following vulnerability has been resolved:
bridge: Fix sleep in atomic context in netlink path (CVE-2026-63989)
In the Linux kernel, the following vulnerability has been resolved:
bonding: refuse to enslave CAN devices (CVE-2026-63990)
In the Linux kernel, the following vulnerability has been resolved:
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
In the Linux kernel, the following vulnerability has been resolved:
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis: validate start_cmd_payload_size from module (CVE-2026-63995)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis: require exact CDB reply length (CVE-2026-63996)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: avoid leaking a netdev ref on module flash errors (CVE-2026-63997)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: call ethnl_ops_complete() on module flash errors (CVE-2026-63998)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (CVE-2026-63999)
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (CVE-2026-64003)
In the Linux kernel, the following vulnerability has been resolved:
net/smc: Do not re-initialize smc hashtables (CVE-2026-64005)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix dst corruption in same register operation
For lshift and rshift, the shift operations are performed in a loop over
32-bit words. The loop calculates the shifted value and write it to dst,
and then immediately reads from src to calculate the carry for the next
iteration. Because src and dst could point to the same memory location,
the carry is incorrectly calculated using the newly modified dst value
instead of the original src value.
Adding a temporary local variable to cache the original value before
writing to dst and using it for the carry calculation solves the
problem. In addition, partial overlap is rejected from control plane for
all kind of operations including byteorder. This was tested with the
following bytecode:
table test_table ip flags 0 use 1 handle 1
ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1
ip test_table test_chain 2
[ immediate reg 1 0x44332211 0x88776655 ]
[ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]
[ cmp eq reg 1 0x66443322 0x00887766 ]
[ counter pkts 0 bytes 0 ]
ip test_table test_chain 4 3
[ immediate reg 1 0x44332211 0x88776655 ]
[ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]
[ cmp eq reg 1 0x55443322 0x00887766 ]
[ counter pkts 21794 bytes 1917798 ] (CVE-2026-64006)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.
Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head. After
that point the cached th is stale:
caller (ipv[46]_synproxy_hook)
th = skb_header_pointer(skb, ..., &_tcph)
synproxy_tstamp_adjust(skb, protoff, th, ...)
skb_ensure_writable(skb, optend)
pskb_expand_head() /* kfree(old skb->head) */
...
inet_proto_csum_replace4(&th->check, ...)
/* writes into freed head, or
into the caller's stack copy
leaving the on-wire checksum
stale */
The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place. The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.
Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header. (CVE-2026-64007)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Check for underflow in xfrm_state_mtu (CVE-2026-64009)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-64012)
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for. (CVE-2026-64015)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
Blamed commit moved the TIME_WAIT-derived ISN from the skb control
block to a per-CPU variable, assuming the value would always be consumed
by tcp_conn_request() for the same packet that wrote it. That assumption
is violated by multiple drop paths between the producer
(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
(tcp_conn_request()):
- min_ttl / min_hopcount check
- xfrm policy check
- tcp_inbound_hash() MD5/AO mismatch
- tcp_filter() eBPF/SO_ATTACH_FILTER drop
- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
- tcp_v{4,6}_cookie_check() returning NULL
When a packet is dropped on any of these paths, tcp_tw_isn is left set.
The next SYN processed on the same CPU then consumes the non zero value in
tcp_conn_request(), receiving a potentially predictable ISN.
This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
variable.
Note that tcp_v{4,6}_fill_cb() do not set it.
Very litle impact on overall code size/complexity:
$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)
Function old new delta
tcp_v6_rcv 3038 3042 +4
tcp_v4_rcv 3035 3039 +4
tcp_conn_request 2938 2923 -15
Total: Before=24436060, After=24436053, chg -0.00% (CVE-2026-64024)
In the Linux kernel, the following vulnerability has been resolved:
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and
defers to psock->saved_data_ready when a TLS RX context is present,
avoiding a conflict with the TLS strparser's ownership of the receive
queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types
with ktls").
sk_psock_verdict_data_ready() has no equivalent guard. When a socket
is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is
configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready
as rx_ctx->saved_data_ready. On data arrival:
tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready
-> saved_data_ready() = sk_psock_verdict_data_ready()
-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()
without calling tcp_eat_skb(), so copied_seq is not advanced.
tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls
tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and
returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned
(potentially freed) skb. tls_decrypt_sg() subsequently walks that
frag_list: use-after-free.
Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context
is present, call psock->saved_data_ready (sock_def_readable) to wake
recv() waiters and return immediately, leaving the receive queue
untouched. TLS retains sole ownership of the queue and decrypts the
record normally through tls_sw_recvmsg(). (CVE-2026-64025)
In the Linux kernel, the following vulnerability has been resolved:
net: shaper: rework the VALID marking (again) (CVE-2026-64027)
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix managed cache race for unaligned extents (CVE-2026-64031)
In the Linux kernel, the following vulnerability has been resolved:
bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
In the Linux kernel, the following vulnerability has been resolved:
igc: set tx buffer type for SMD frames (CVE-2026-64035)
In the Linux kernel, the following vulnerability has been resolved:
cgroup/rstat: validate cpu before css_rstat_cpu() access
css_rstat_updated() is exposed as a BPF kfunc and accepts a
caller-provided cpu argument. The function uses cpu for per-cpu rstat
lookups without checking whether it refers to a valid possible CPU.
A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an
invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==
0x7fffffff triggers:
UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
index 2147483647 is out of range for type 'long unsigned int [64]'
Call Trace:
css_rstat_updated
bpf_iter_run_prog
cgroup_iter_seq_show
bpf_seq_read
Add cpu validation to the BPF-facing css_rstat_updated() kfunc and
move the common implementation to __css_rstat_updated() for in-kernel
callers. (CVE-2026-64036)
In the Linux kernel, the following vulnerability has been resolved:
ovpn: respect peer refcount in CMD_NEW_PEER error path (CVE-2026-64044)
In the Linux kernel, the following vulnerability has been resolved:
ovpn: tcp - use cached peer pointer in ovpn_tcp_close() (CVE-2026-64045)
In the Linux kernel, the following vulnerability has been resolved:
net: tls: prevent chain-after-chain in plain text SG (CVE-2026-64046)
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
When an sk_msg scatterlist ring wraps (sg.end < sg.start),
tls_push_record() chains the tail portion of the ring to the head
using sg_chain(). An extra entry in the sg array is reserved for
this:
struct sk_msg_sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];
The current code uses MAX_SKB_FRAGS + 1 as the ring size:
sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
MAX_SKB_FRAGS - msg_pl->sg.start + 1,
msg_pl->sg.data);
This places the chain pointer at
sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =
&data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =
data[start + (MAX_SKB_FRAGS - start + 1) - 1] =
data[MAX_SKB_FRAGS]
instead of the true last entry. This is likely due to a "race" of
the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")
Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested
by Sabrina). (CVE-2026-64047)
In the Linux kernel, the following vulnerability has been resolved:
block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (CVE-2026-64052)
In the Linux kernel, the following vulnerability has been resolved:
block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
In the Linux kernel, the following vulnerability has been resolved:
net: shaper: reject duplicate leaves in GROUP request (CVE-2026-64054)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio->private handling in netfs_perform_write() (CVE-2026-64059)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix leak of request in netfs_write_begin() error handling
Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read(). (CVE-2026-64060)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix early put of sink folio in netfs_read_gaps() (CVE-2026-64061)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix potential deadlock in write-through mode (CVE-2026-64062)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix streaming write being overwritten (CVE-2026-64063)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (CVE-2026-64064)
In the Linux kernel, the following vulnerability has been resolved:
netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call (CVE-2026-64065)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_read_to_pagecache() to pause on subreq failure (CVE-2026-64066)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix cancellation of a DIO and single read subrequests (CVE-2026-64069)
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix use-after-free in nvme_free_host_mem() (CVE-2026-64071)
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix bio leak on mapping failure (CVE-2026-64072)
In the Linux kernel, the following vulnerability has been resolved:
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (CVE-2026-64073)
In the Linux kernel, the following vulnerability has been resolved:
fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap (CVE-2026-64074)
In the Linux kernel, the following vulnerability has been resolved:
fprobe: Fix unregister_fprobe() to wait for RCU grace period (CVE-2026-64075)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: eb_tables: close module init race (CVE-2026-64076)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: add and use xtables_unregister_table_exit
Previous change added xtables_unregister_table_pre_exit to detach the
table from the packetpath and to unlink it from the active table list.
In case of rmmod, userspace that is doing set/getsockopt for this table
will not be able to re-instantiate the table:
1. The larval table has been removed already
2. existing instantiated table is no longer on the xt pernet table list.
This adds the second stage helper:
unlink the table from the dying list, free the hook ops (if any) and do
the audit notification. It replaces xt_unregister_table(). (CVE-2026-64078)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Snapshot notifier callbacks under lock (CVE-2026-64080)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Validate framework notification message layout (CVE-2026-64081)
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)
In the Linux kernel, the following vulnerability has been resolved:
virt: sev-guest: Explicitly leak pages in unknown state (CVE-2026-64104)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Free private_irqs when init fails after allocation (CVE-2026-64105)
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports. The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.
Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device. This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range. (CVE-2026-64106)
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix busy dentry used after unmounting (CVE-2026-64108)
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)
In the Linux kernel, the following vulnerability has been resolved:
igc: fix potential skb leak in igc_fpe_xmit_smd_frame() (CVE-2026-64110)
In the Linux kernel, the following vulnerability has been resolved:
lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
In the Linux kernel, the following vulnerability has been resolved:
rbd: eliminate a race in lock_dwork draining on unmap (CVE-2026-64112)
In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: fix use-after-free in VEPA multicast source pruning
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's
own address (VEPA multicast workaround) by freeing the skb and
continuing to the next descriptor:
dev_kfree_skb_irq(skb);
continue;
The skb pointer is declared outside the while loop and persists across
iterations. Because the continue skips the "skb = NULL" reset at the
bottom of the loop, the next iteration enters the "else if (skb)" path
and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
The sibling driver iavf already handles this correctly by nulling the
pointer before continuing. Apply the same pattern here.
I do not have ixgbevf hardware; the bug was found by static analysis
(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
corroboration with the highest score in the scan). The UAF was confirmed
under KASAN by loading a test module that reproduces the exact code
pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000
Read of size 8 at addr 000000006163ae78 by task insmod/30
freed 208-byte region [000000006163adc0, 000000006163ae90)
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
driver does not include the VEPA source pruning path, so a full
end-to-end reproduction with emulated hardware was not possible. (CVE-2026-64113)
In the Linux kernel, the following vulnerability has been resolved:
ipv4: raw: reject IP_HDRINCL packets with ihl < 5
raw_send_hdrinc() validates that the caller-supplied IPv4 header
fits within the message length:
iphlen = iph->ihl * 4;
err = -EINVAL;
if (iphlen > length)
goto error_free;
if (iphlen >= sizeof(*iph)) {
/* fix up saddr, tot_len, id, csum, transport_header */
}
It does not, however, reject ihl < 5. For such a packet the
"if (iphlen >= sizeof(*iph))" branch is skipped, leaving the
crafted iphdr untouched, but the packet is still handed to
__ip_local_out() and onward. Downstream consumers that read
iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in
particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
and passes the (signed-int-negative, then cast to size_t)
result to memcpy(), producing an OOB access of length close to
SIZE_MAX and a host kernel panic.
An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
"Internet Header Length is the length of the internet header in
32 bit words ... Note that the minimum value for a correct header
is 5."). The kernel should not be willing to inject such a
packet into its own output path.
Reject "iphlen < sizeof(*iph)" alongside the existing
"iphlen > length" check. This matches the principle that locally
constructed packets that re-enter the IP stack must pass the same
basic sanity tests that a foreign packet would be subjected to.
Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around
the fixup branch becomes redundant; left in place to keep the
patch minimal and backport-friendly. A follow-up can unwrap it.
Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket
message is big enough to hold an IP header") ensures the message
buffer is large enough to hold an iphdr, but does not constrain
the self-reported iph->ihl.
Reachability: the malformed packet source is any caller with
CAP_NET_RAW, including an unprivileged process in a user+net
namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH
crash also requires a matching xfrm AH policy on the outgoing
route; a container granted CAP_NET_ADMIN can install that state
and policy in its netns. Loopback bypasses xfrm_output, so the
trigger uses a real netdev.
Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
memcpy_orig at the crash site. Same shape reproduces inside a
rootless Docker container with --cap-add NET_ADMIN on a stock
distro kernel. (CVE-2026-64114)
In the Linux kernel, the following vulnerability has been resolved:
vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (CVE-2026-64116)
In the Linux kernel, the following vulnerability has been resolved:
net: ethtool: fix NULL pointer dereference in phy_reply_size (CVE-2026-64120)
In the Linux kernel, the following vulnerability has been resolved:
net: ifb: report ethtool stats over num_tx_queues (CVE-2026-64121)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover (CVE-2026-64122)
In the Linux kernel, the following vulnerability has been resolved:
net: devmem: reject dma-buf bind with non-page-aligned size or SG length (CVE-2026-64124)
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free (CVE-2026-64130)
In the Linux kernel, the following vulnerability has been resolved:
mm/memory: fix spurious warning when unmapping device-private/exclusive pages (CVE-2026-64131)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
In the Linux kernel, the following vulnerability has been resolved:
dma-mapping: move dma_map_resource() sanity check into debug code (CVE-2026-64149)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: release local_lock before re-enabling softirqs (CVE-2026-64150)
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN (CVE-2026-64153)
In the Linux kernel, the following vulnerability has been resolved:
netfs, afs: Fix write skipping in dir/link writepages (CVE-2026-64156)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix partial invalidation of streaming-write folio (CVE-2026-64157)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix write streaming disablement if fd open O_RDWR (CVE-2026-64158)
In the Linux kernel, the following vulnerability has been resolved:
test_kprobes: clear kprobes between test runs (CVE-2026-64163)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (CVE-2026-64164)
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (CVE-2026-64166)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) (CVE-2026-64172)
In the Linux kernel, the following vulnerability has been resolved:
mm/memory_hotplug: fix memory block reference leak on remove (CVE-2026-64180)
In the Linux kernel, the following vulnerability has been resolved:
mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() (CVE-2026-64181)
In the Linux kernel, the following vulnerability has been resolved:
drivers/base/memory: fix memory block reference leak in poison accounting (CVE-2026-64182)
In the Linux kernel, the following vulnerability has been resolved:
efi: Allocate runtime workqueue before ACPI init (CVE-2026-64183)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (CVE-2026-64184)
In the Linux kernel, the following vulnerability has been resolved:
sysfs: don't remove existing directory on update failure
When sysfs_update_group() is called for a named group and create_files()
fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on
the group directory. In the update path, kn was obtained via
kernfs_find_and_get() and refers to a directory that already existed
before this call. Removing it silently destroys a sysfs group that the
caller did not create.
Only remove the directory if we created it ourselves. On update failure
the directory remains as it is left empty by remove_files() inside
create_files(), but can be repopulated by a retry. (CVE-2026-64185)
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (CVE-2026-64186)
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team_xmit during mode change (CVE-2026-64190)
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix overrun check in netfs_extract_user_iter() (CVE-2026-64217)
In the Linux kernel, the following vulnerability has been resolved:
device property: set fwnode->secondary to NULL in fwnode_init() (CVE-2026-64220)
In the Linux kernel, the following vulnerability has been resolved:
net: ethtool: phy: avoid NULL deref when PHY driver is unbound (CVE-2026-64228)
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Disable broadcast TLB flush when PCID is disabled (CVE-2026-64229)
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (CVE-2026-64239)
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix freeing of PMD-sized vmemmap pages (CVE-2026-64302)
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (CVE-2026-64518)
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix infinite loop in layout state revocation (CVE-2026-64519)
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (CVE-2026-64522)
In the Linux kernel, the following vulnerability has been resolved:
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (CVE-2026-64525)
In the Linux kernel, the following vulnerability has been resolved:
ethtool: tsconfig: fix missing ethnl_ops_complete() (CVE-2026-64526)
Affected Packages:
kernel6.18
Issue Correction:
Run dnf update kernel6.18 --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1881 --releasever 2023.12.20260622 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
perf6.18-debuginfo-6.18.35-68.127.amzn2023.aarch64
bpftool6.18-6.18.35-68.127.amzn2023.aarch64
kernel6.18-tools-debuginfo-6.18.35-68.127.amzn2023.aarch64
kernel6.18-tools-devel-6.18.35-68.127.amzn2023.aarch64
bpftool6.18-debuginfo-6.18.35-68.127.amzn2023.aarch64
python3-perf6.18-debuginfo-6.18.35-68.127.amzn2023.aarch64
kernel6.18-modules-extra-common-6.18.35-68.127.amzn2023.aarch64
microvm-kernel6.18-6.18.35-68.127.amzn2023.aarch64
kernel-livepatch-6.18.35-68.127-1.0-0.amzn2023.aarch64
python3-perf6.18-6.18.35-68.127.amzn2023.aarch64
kernel6.18-tools-6.18.35-68.127.amzn2023.aarch64
kernel6.18-modules-extra-6.18.35-68.127.amzn2023.aarch64
perf6.18-6.18.35-68.127.amzn2023.aarch64
kernel6.18-headers-6.18.35-68.127.amzn2023.aarch64
kernel6.18-6.18.35-68.127.amzn2023.aarch64
kernel6.18-debuginfo-6.18.35-68.127.amzn2023.aarch64
kernel6.18-debuginfo-common-aarch64-6.18.35-68.127.amzn2023.aarch64
kernel6.18-devel-6.18.35-68.127.amzn2023.aarch64
src:
kernel6.18-6.18.35-68.127.amzn2023.src
x86_64:
kernel6.18-tools-6.18.35-68.127.amzn2023.x86_64
kernel6.18-tools-debuginfo-6.18.35-68.127.amzn2023.x86_64
microvm-kernel6.18-6.18.35-68.127.amzn2023.x86_64
bpftool6.18-debuginfo-6.18.35-68.127.amzn2023.x86_64
kernel6.18-headers-6.18.35-68.127.amzn2023.x86_64
kernel-livepatch-6.18.35-68.127-1.0-0.amzn2023.x86_64
perf6.18-debuginfo-6.18.35-68.127.amzn2023.x86_64
python3-perf6.18-debuginfo-6.18.35-68.127.amzn2023.x86_64
kernel6.18-modules-extra-6.18.35-68.127.amzn2023.x86_64
bpftool6.18-6.18.35-68.127.amzn2023.x86_64
kernel6.18-modules-extra-common-6.18.35-68.127.amzn2023.x86_64
kernel6.18-debuginfo-6.18.35-68.127.amzn2023.x86_64
kernel6.18-tools-devel-6.18.35-68.127.amzn2023.x86_64
perf6.18-6.18.35-68.127.amzn2023.x86_64
python3-perf6.18-6.18.35-68.127.amzn2023.x86_64
kernel6.18-6.18.35-68.127.amzn2023.x86_64
kernel6.18-debuginfo-common-x86_64-6.18.35-68.127.amzn2023.x86_64
kernel6.18-devel-6.18.35-68.127.amzn2023.x86_64
2026-08-05: CVE-2026-64519 was added to this advisory.
2026-08-05: CVE-2026-64302 was added to this advisory.
2026-08-05: CVE-2026-64526 was added to this advisory.
2026-08-05: CVE-2026-64525 was added to this advisory.
2026-08-05: CVE-2026-64518 was added to this advisory.
2026-08-05: CVE-2026-64522 was added to this advisory.
2026-08-01: CVE-2026-64228 was added to this advisory.
2026-08-01: CVE-2026-64229 was added to this advisory.
2026-08-01: CVE-2026-64239 was added to this advisory.
2026-08-01: CVE-2026-64220 was added to this advisory.
2026-07-29: CVE-2026-64024 was added to this advisory.
2026-07-29: CVE-2026-63921 was added to this advisory.
2026-07-29: CVE-2026-64066 was added to this advisory.
2026-07-29: CVE-2026-64065 was added to this advisory.
2026-07-29: CVE-2026-64046 was added to this advisory.
2026-07-29: CVE-2026-63937 was added to this advisory.
2026-07-29: CVE-2026-64015 was added to this advisory.
2026-07-29: CVE-2026-64158 was added to this advisory.
2026-07-29: CVE-2026-64180 was added to this advisory.
2026-07-29: CVE-2026-64115 was added to this advisory.
2026-07-29: CVE-2026-64121 was added to this advisory.
2026-07-29: CVE-2026-64032 was added to this advisory.
2026-07-29: CVE-2026-64012 was added to this advisory.
2026-07-29: CVE-2026-64131 was added to this advisory.
2026-07-29: CVE-2026-64059 was added to this advisory.
2026-07-29: CVE-2026-64111 was added to this advisory.
2026-07-29: CVE-2026-64072 was added to this advisory.
2026-07-29: CVE-2026-53365 was added to this advisory.
2026-07-29: CVE-2026-63889 was added to this advisory.
2026-07-29: CVE-2026-64062 was added to this advisory.
2026-07-29: CVE-2026-64166 was added to this advisory.
2026-07-29: CVE-2026-63986 was added to this advisory.
2026-07-29: CVE-2026-64081 was added to this advisory.
2026-07-29: CVE-2026-63924 was added to this advisory.
2026-07-29: CVE-2026-64069 was added to this advisory.
2026-07-29: CVE-2026-63940 was added to this advisory.
2026-07-29: CVE-2026-64098 was added to this advisory.
2026-07-29: CVE-2026-64063 was added to this advisory.
2026-07-29: CVE-2026-63884 was added to this advisory.
2026-07-29: CVE-2026-64061 was added to this advisory.
2026-07-29: CVE-2026-63996 was added to this advisory.
2026-07-29: CVE-2026-64104 was added to this advisory.
2026-07-29: CVE-2026-63962 was added to this advisory.
2026-07-29: CVE-2026-64113 was added to this advisory.
2026-07-29: CVE-2026-64053 was added to this advisory.
2026-07-29: CVE-2026-63995 was added to this advisory.
2026-07-29: CVE-2026-63925 was added to this advisory.
2026-07-29: CVE-2026-64047 was added to this advisory.
2026-07-29: CVE-2026-64114 was added to this advisory.
2026-07-29: CVE-2026-63990 was added to this advisory.
2026-07-29: CVE-2026-64182 was added to this advisory.
2026-07-29: CVE-2026-64077 was added to this advisory.
2026-07-29: CVE-2026-64153 was added to this advisory.
2026-07-29: CVE-2026-64156 was added to this advisory.
2026-07-29: CVE-2026-64186 was added to this advisory.
2026-07-29: CVE-2026-63913 was added to this advisory.
2026-07-29: CVE-2026-64006 was added to this advisory.
2026-07-29: CVE-2026-64075 was added to this advisory.
2026-07-29: CVE-2026-64150 was added to this advisory.
2026-07-29: CVE-2026-64105 was added to this advisory.
2026-07-29: CVE-2026-63950 was added to this advisory.
2026-07-29: CVE-2026-63917 was added to this advisory.
2026-07-29: CVE-2026-64184 was added to this advisory.
2026-07-29: CVE-2026-64164 was added to this advisory.
2026-07-29: CVE-2026-64116 was added to this advisory.
2026-07-29: CVE-2026-64054 was added to this advisory.
2026-07-29: CVE-2026-63984 was added to this advisory.
2026-07-29: CVE-2026-64185 was added to this advisory.
2026-07-29: CVE-2026-63939 was added to this advisory.
2026-07-29: CVE-2026-63971 was added to this advisory.
2026-07-29: CVE-2026-63994 was added to this advisory.
2026-07-29: CVE-2026-64217 was added to this advisory.
2026-07-29: CVE-2026-63985 was added to this advisory.
2026-07-29: CVE-2026-63920 was added to this advisory.
2026-07-29: CVE-2026-64076 was added to this advisory.
2026-07-29: CVE-2026-64071 was added to this advisory.
2026-07-29: CVE-2026-63969 was added to this advisory.
2026-07-29: CVE-2026-63922 was added to this advisory.
2026-07-29: CVE-2026-64132 was added to this advisory.
2026-07-29: CVE-2026-63997 was added to this advisory.
2026-07-29: CVE-2026-64130 was added to this advisory.
2026-07-29: CVE-2026-64136 was added to this advisory.
2026-07-29: CVE-2026-64181 was added to this advisory.
2026-07-29: CVE-2026-63926 was added to this advisory.
2026-07-29: CVE-2026-63896 was added to this advisory.
2026-07-29: CVE-2026-64027 was added to this advisory.
2026-07-29: CVE-2026-63989 was added to this advisory.
2026-07-29: CVE-2026-64074 was added to this advisory.
2026-07-29: CVE-2026-64052 was added to this advisory.
2026-07-29: CVE-2026-64108 was added to this advisory.
2026-07-29: CVE-2026-63987 was added to this advisory.
2026-07-29: CVE-2026-64036 was added to this advisory.
2026-07-29: CVE-2026-64106 was added to this advisory.
2026-07-29: CVE-2026-64149 was added to this advisory.
2026-07-29: CVE-2026-63992 was added to this advisory.
2026-07-29: CVE-2026-64044 was added to this advisory.
2026-07-29: CVE-2026-63980 was added to this advisory.
2026-07-29: CVE-2026-64157 was added to this advisory.
2026-07-29: CVE-2026-63912 was added to this advisory.
2026-07-29: CVE-2026-64110 was added to this advisory.
2026-07-29: CVE-2026-64112 was added to this advisory.
2026-07-29: CVE-2026-64025 was added to this advisory.
2026-07-29: CVE-2026-64190 was added to this advisory.
2026-07-29: CVE-2026-63999 was added to this advisory.
2026-07-29: CVE-2026-63876 was added to this advisory.
2026-07-29: CVE-2026-63875 was added to this advisory.
2026-07-29: CVE-2026-64172 was added to this advisory.
2026-07-29: CVE-2026-64045 was added to this advisory.
2026-07-29: CVE-2026-64120 was added to this advisory.
2026-07-29: CVE-2026-64003 was added to this advisory.
2026-07-29: CVE-2026-64009 was added to this advisory.
2026-07-29: CVE-2026-64183 was added to this advisory.
2026-07-29: CVE-2026-64163 was added to this advisory.
2026-07-29: CVE-2026-64122 was added to this advisory.
2026-07-29: CVE-2026-63914 was added to this advisory.
2026-07-29: CVE-2026-63968 was added to this advisory.
2026-07-29: CVE-2026-64124 was added to this advisory.
2026-07-29: CVE-2026-64007 was added to this advisory.
2026-07-29: CVE-2026-63885 was added to this advisory.
2026-07-29: CVE-2026-64035 was added to this advisory.
2026-07-29: CVE-2026-64080 was added to this advisory.
2026-07-29: CVE-2026-64060 was added to this advisory.
2026-07-29: CVE-2026-64005 was added to this advisory.
2026-07-29: CVE-2026-63919 was added to this advisory.
2026-07-29: CVE-2026-64078 was added to this advisory.
2026-07-29: CVE-2026-63938 was added to this advisory.
2026-07-29: CVE-2026-64031 was added to this advisory.
2026-07-29: CVE-2026-63988 was added to this advisory.
2026-07-29: CVE-2026-64073 was added to this advisory.
2026-07-29: CVE-2026-63877 was added to this advisory.
2026-07-29: CVE-2026-64064 was added to this advisory.
2026-07-29: CVE-2026-63998 was added to this advisory.
2026-07-29: CVE-2026-63993 was added to this advisory.
2026-07-29: CVE-2026-64109 was added to this advisory.
2026-07-29: CVE-2026-63952 was added to this advisory.
2026-07-14: CVE-2026-53360 was added to this advisory.
2026-07-06: CVE-2026-53277 was added to this advisory.
2026-07-06: CVE-2026-53311 was added to this advisory.
2026-07-01: CVE-2026-52923 was added to this advisory.
2026-07-01: CVE-2026-52912 was added to this advisory.
2026-07-01: CVE-2026-52932 was added to this advisory.
2026-07-01: CVE-2026-46316 was added to this advisory.
2026-07-01: CVE-2026-52937 was added to this advisory.
2026-07-01: CVE-2025-71289 was added to this advisory.
2026-07-01: CVE-2026-52915 was added to this advisory.
2026-07-01: CVE-2026-52921 was added to this advisory.
2026-07-01: CVE-2026-46321 was added to this advisory.
2026-07-01: CVE-2026-46315 was added to this advisory.
2026-07-01: CVE-2026-46317 was added to this advisory.
2026-07-01: CVE-2026-46244 was added to this advisory.
2026-07-01: CVE-2026-46322 was added to this advisory.
2026-07-01: CVE-2026-52943 was added to this advisory.