ALAS2023-2026-3224

Amazon Linux–vended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in unsigned zones. This applies where the resolver is still using the trust anchor shipped in the package; resolvers that already picked up the new root key via RFC 5011 are unaffected.

On 11 October 2026 at 14:00 UTC the DNS root zone began signing with KSK-2024 (key tag 38696), replacing KSK-2017 (key tag 20326). The packaged trust anchor files contained only KSK-2017, so an affected resolver cannot validate the root DNSKEY RRset and returns SERVFAIL.

The updated packages include an updated root signing key.

aarch64:
    systemd-boot-unsigned-debuginfo-252.23-15.amzn2023.aarch64
    systemd-libs-debuginfo-252.23-15.amzn2023.aarch64
    systemd-journal-remote-debuginfo-252.23-15.amzn2023.aarch64
    systemd-standalone-sysusers-debuginfo-252.23-15.amzn2023.aarch64
    systemd-udev-debuginfo-252.23-15.amzn2023.aarch64
    systemd-pam-debuginfo-252.23-15.amzn2023.aarch64
    systemd-libs-252.23-15.amzn2023.aarch64
    systemd-networkd-252.23-15.amzn2023.aarch64
    systemd-container-debuginfo-252.23-15.amzn2023.aarch64
    systemd-debuginfo-252.23-15.amzn2023.aarch64
    systemd-tests-debuginfo-252.23-15.amzn2023.aarch64
    systemd-networkd-debuginfo-252.23-15.amzn2023.aarch64
    systemd-journal-remote-252.23-15.amzn2023.aarch64
    systemd-container-252.23-15.amzn2023.aarch64
    systemd-tests-252.23-15.amzn2023.aarch64
    systemd-standalone-tmpfiles-252.23-15.amzn2023.aarch64
    systemd-devel-252.23-15.amzn2023.aarch64
    systemd-boot-unsigned-252.23-15.amzn2023.aarch64
    systemd-udev-252.23-15.amzn2023.aarch64
    systemd-pam-252.23-15.amzn2023.aarch64
    systemd-resolved-252.23-15.amzn2023.aarch64
    systemd-standalone-tmpfiles-debuginfo-252.23-15.amzn2023.aarch64
    systemd-resolved-debuginfo-252.23-15.amzn2023.aarch64
    systemd-standalone-sysusers-252.23-15.amzn2023.aarch64
    systemd-debugsource-252.23-15.amzn2023.aarch64
    systemd-252.23-15.amzn2023.aarch64

noarch:
    systemd-rpm-macros-252.23-15.amzn2023.noarch
    systemd-oomd-defaults-252.23-15.amzn2023.noarch

src:
    systemd-252.23-15.amzn2023.src

x86_64:
    systemd-libs-debuginfo-252.23-15.amzn2023.x86_64
    systemd-standalone-tmpfiles-debuginfo-252.23-15.amzn2023.x86_64
    systemd-networkd-252.23-15.amzn2023.x86_64
    systemd-pam-debuginfo-252.23-15.amzn2023.x86_64
    systemd-container-debuginfo-252.23-15.amzn2023.x86_64
    systemd-debugsource-252.23-15.amzn2023.x86_64
    systemd-boot-unsigned-debuginfo-252.23-15.amzn2023.x86_64
    systemd-networkd-debuginfo-252.23-15.amzn2023.x86_64
    systemd-pam-252.23-15.amzn2023.x86_64
    systemd-debuginfo-252.23-15.amzn2023.x86_64
    systemd-standalone-sysusers-252.23-15.amzn2023.x86_64
    systemd-journal-remote-252.23-15.amzn2023.x86_64
    systemd-resolved-debuginfo-252.23-15.amzn2023.x86_64
    systemd-standalone-sysusers-debuginfo-252.23-15.amzn2023.x86_64
    systemd-tests-debuginfo-252.23-15.amzn2023.x86_64
    systemd-standalone-tmpfiles-252.23-15.amzn2023.x86_64
    systemd-container-252.23-15.amzn2023.x86_64
    systemd-libs-252.23-15.amzn2023.x86_64
    systemd-tests-252.23-15.amzn2023.x86_64
    systemd-boot-unsigned-252.23-15.amzn2023.x86_64
    systemd-journal-remote-debuginfo-252.23-15.amzn2023.x86_64
    systemd-resolved-252.23-15.amzn2023.x86_64
    systemd-udev-debuginfo-252.23-15.amzn2023.x86_64
    systemd-udev-252.23-15.amzn2023.x86_64
    systemd-devel-252.23-15.amzn2023.x86_64
    systemd-252.23-15.amzn2023.x86_64