ALAS2023-2026-3390

Amazon Linux 2023 Security Advisory: ALAS2023-2026-3390
Advisory Released Date: 2026-11-09
Advisory Updated Date: 2026-11-09
Severity: Important
Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use (CVE-2026-74752)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject MEM_ALLOC BTF accesses past object bounds (CVE-2026-93148)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (CVE-2026-97563)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve inner map identity in callback frames (CVE-2026-98033)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use array_map_meta_equal for percpu array inner map replacement (CVE-2026-98376)

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (CVE-2026-98715)

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix private hash use-after-free on resize (CVE-2026-98788)


Affected Packages:

kernel6.18


Issue Correction:
Run dnf update kernel6.18 --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3390 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:
aarch64:
    kernel-livepatch-6.18.56-126.188-1.0-0.amzn2023.aarch64
    python3-perf6.18-6.18.56-126.188.amzn2023.aarch64
    perf6.18-debuginfo-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-tools-devel-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-modules-extra-6.18.56-126.188.amzn2023.aarch64
    perf6.18-6.18.56-126.188.amzn2023.aarch64
    microvm-kernel6.18-6.18.56-126.188.amzn2023.aarch64
    bpftool6.18-debuginfo-6.18.56-126.188.amzn2023.aarch64
    python3-perf6.18-debuginfo-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-tools-debuginfo-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-tools-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-modules-extra-common-6.18.56-126.188.amzn2023.aarch64
    bpftool6.18-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-headers-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-debuginfo-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-debuginfo-common-aarch64-6.18.56-126.188.amzn2023.aarch64
    kernel6.18-devel-6.18.56-126.188.amzn2023.aarch64

src:
    kernel6.18-6.18.56-126.188.amzn2023.src

x86_64:
    kernel6.18-tools-6.18.56-126.188.amzn2023.x86_64
    bpftool6.18-debuginfo-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-modules-extra-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-tools-debuginfo-6.18.56-126.188.amzn2023.x86_64
    python3-perf6.18-debuginfo-6.18.56-126.188.amzn2023.x86_64
    microvm-kernel6.18-6.18.56-126.188.amzn2023.x86_64
    kernel-livepatch-6.18.56-126.188-1.0-0.amzn2023.x86_64
    perf6.18-debuginfo-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-modules-extra-common-6.18.56-126.188.amzn2023.x86_64
    bpftool6.18-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-tools-devel-6.18.56-126.188.amzn2023.x86_64
    perf6.18-6.18.56-126.188.amzn2023.x86_64
    python3-perf6.18-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-headers-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-debuginfo-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-debuginfo-common-x86_64-6.18.56-126.188.amzn2023.x86_64
    kernel6.18-devel-6.18.56-126.188.amzn2023.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-74752, CVE-2026-93148, CVE-2026-97563, CVE-2026-98033, CVE-2026-98318, CVE-2026-98376, CVE-2026-98715, CVE-2026-98788

Mitre: CVE-2026-74752, CVE-2026-93148, CVE-2026-97563, CVE-2026-98033, CVE-2026-98318, CVE-2026-98376, CVE-2026-98715, CVE-2026-98788