ALAS2023-2026-3448

Amazon Linux 2023 Security Advisory: ALAS2023-2026-3448
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity: Important
Issue Overview:

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (CVE-2026-89754)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (CVE-2026-98863)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: udp: Create exceptions before socket matching (CVE-2026-99077)

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103)

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ (CVE-2026-99105)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flower: validate mask pointer after nla_next() (CVE-2026-99112)

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: don't truncate the port group walk on teardown (CVE-2026-99117)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing (CVE-2026-99118)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121)

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: validate packet source for connected sockets (CVE-2026-99123)

In the Linux kernel, the following vulnerability has been resolved:

page_pool: keep frag_offset aligned for odd-sized requests (CVE-2026-99127)

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate chunk length in the inqueue parser (CVE-2026-99128)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cancel: don't spin on local work the task can't run (CVE-2026-99130)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix capability check in xfs (CVE-2026-99131)

In the Linux kernel, the following vulnerability has been resolved:

dm-integrity: fix infinite loop on discard with large tag size (CVE-2026-99135)

In the Linux kernel, the following vulnerability has been resolved:

dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (CVE-2026-99138)

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (CVE-2026-99139)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check operator stack capacity before pushing (CVE-2026-99142)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Keep the predicate limit separate from program capacity (CVE-2026-99143)

In the Linux kernel, the following vulnerability has been resolved:

drm/exec: don't immediately add prelocked obj to array of locked objs (CVE-2026-99147)

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CVE-2026-99153)

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (CVE-2026-99155)

In the Linux kernel, the following vulnerability has been resolved:

scsi: st: Fix use-after-free race between st_remove() and st_open() (CVE-2026-99156)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix false warning in ring_buffer_map_get_reader() (CVE-2026-99158)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() (CVE-2026-99159)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not show buffer_meta for CPUs without a buffer (CVE-2026-99160)

In the Linux kernel, the following vulnerability has been resolved:

sctp: revalidate output stream after association connect wait (CVE-2026-99165)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167)

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: free the sbi after a grace period (CVE-2026-99171)

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfs_inode after an rcu grace period too (CVE-2026-99173)

In the Linux kernel, the following vulnerability has been resolved:

ext4: free the sbi after a grace period (CVE-2026-99174)

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: prevent mark additions during connector teardown (CVE-2026-99175)

In the Linux kernel, the following vulnerability has been resolved:

KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (CVE-2026-99176)

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (CVE-2026-99178)

In the Linux kernel, the following vulnerability has been resolved:

autofs: ignore notification errors from a replaced pipe (CVE-2026-99181)

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix perf_pmu_migrate_context() leaving events behind (CVE-2026-99187)

In the Linux kernel, the following vulnerability has been resolved:

calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() (CVE-2026-99191)

In the Linux kernel, the following vulnerability has been resolved:

netlink: avoid hashing the network namespace pointer (CVE-2026-99201)

In the Linux kernel, the following vulnerability has been resolved:

pipe: preserve existing fasync readers on writer setup failure (CVE-2026-99203)

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206)

In the Linux kernel, the following vulnerability has been resolved:

netlink: reset skb headers before unicast and multicast filtering (CVE-2026-99211)

In the Linux kernel, the following vulnerability has been resolved:

vsock: treat TCP_CLOSING as once-established (CVE-2026-99213)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths (CVE-2026-99216)

In the Linux kernel, the following vulnerability has been resolved:

coredump: hold RCU while releasing parked threads (CVE-2026-99218)

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Initialize modname and offset in print_rec() (CVE-2026-99219)

In the Linux kernel, the following vulnerability has been resolved:

asymmetric_keys: reject trust keys without IDs (CVE-2026-99220)

In the Linux kernel, the following vulnerability has been resolved:

keys/trusted_keys: return immediately after TPM unseal failure (CVE-2026-99221)

In the Linux kernel, the following vulnerability has been resolved:

keys: Protect the read method check against type removal (CVE-2026-99222)

In the Linux kernel, the following vulnerability has been resolved:

keys: make keyring indexes independent of kernel addresses (CVE-2026-99223)

In the Linux kernel, the following vulnerability has been resolved:

keys: Check the authorization payload in process keyring searches (CVE-2026-99225)

In the Linux kernel, the following vulnerability has been resolved:

keys: Avoid the owner account dereference in named keyring lookup (CVE-2026-99226)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: prevent cancel reference wrap (CVE-2026-99227)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: don't lose the signal that ends work (CVE-2026-99228)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/wait: don't spin on a stuck overflow list (CVE-2026-99229)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/waitid: own the request before clearing ->head (CVE-2026-99231)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Reject incomplete event filter expressions (CVE-2026-99236)

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper (CVE-2026-99244)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: Fix key_reject_and_link() race with keyring restriction (CVE-2026-99245)

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock (CVE-2026-99246)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Do not initialize tracefs work if tracing is disabled (CVE-2026-99247)

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: make zap_pid_ns_processes() freezable (CVE-2026-99249)

In the Linux kernel, the following vulnerability has been resolved:

printk: Postpone kthread startup (CVE-2026-99250)

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Avoid infinite retry loop in init_vp_index() (CVE-2026-99251)

In the Linux kernel, the following vulnerability has been resolved:

io_uring: don't flood a cancelling task with task_work (CVE-2026-99254)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/io-wq: don't hide a link from cancellations (CVE-2026-99255)

In the Linux kernel, the following vulnerability has been resolved:

dm cache: fix issue with background work locking (CVE-2026-99256)

In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (CVE-2026-99258)


Affected Packages:

kernel6.12


Issue Correction:
Run dnf update kernel6.12 --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3448 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:
aarch64:
    kernel6.12-tools-debuginfo-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-tools-devel-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-modules-extra-common-6.12.115-140.210.amzn2023.aarch64
    perf6.12-debuginfo-6.12.115-140.210.amzn2023.aarch64
    bpftool6.12-debuginfo-6.12.115-140.210.amzn2023.aarch64
    perf6.12-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-tools-6.12.115-140.210.amzn2023.aarch64
    python3-perf6.12-debuginfo-6.12.115-140.210.amzn2023.aarch64
    python3-perf6.12-6.12.115-140.210.amzn2023.aarch64
    bpftool6.12-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-headers-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-modules-extra-6.12.115-140.210.amzn2023.aarch64
    kernel-livepatch-6.12.115-140.210-1.0-0.amzn2023.aarch64
    kernel6.12-debuginfo-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-debuginfo-common-aarch64-6.12.115-140.210.amzn2023.aarch64
    kernel6.12-devel-6.12.115-140.210.amzn2023.aarch64

src:
    kernel6.12-6.12.115-140.210.amzn2023.src

x86_64:
    bpftool6.12-debuginfo-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-modules-extra-6.12.115-140.210.amzn2023.x86_64
    perf6.12-6.12.115-140.210.amzn2023.x86_64
    kernel-livepatch-6.12.115-140.210-1.0-0.amzn2023.x86_64
    bpftool6.12-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-modules-extra-common-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-tools-debuginfo-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-debuginfo-6.12.115-140.210.amzn2023.x86_64
    python3-perf6.12-debuginfo-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-tools-6.12.115-140.210.amzn2023.x86_64
    perf6.12-debuginfo-6.12.115-140.210.amzn2023.x86_64
    python3-perf6.12-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-tools-devel-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-headers-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-debuginfo-common-x86_64-6.12.115-140.210.amzn2023.x86_64
    kernel6.12-devel-6.12.115-140.210.amzn2023.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-89754, CVE-2026-98863, CVE-2026-99077, CVE-2026-99103, CVE-2026-99105, CVE-2026-99110, CVE-2026-99112, CVE-2026-99117, CVE-2026-99118, CVE-2026-99121, CVE-2026-99123, CVE-2026-99127, CVE-2026-99128, CVE-2026-99130, CVE-2026-99131, CVE-2026-99135, CVE-2026-99136, CVE-2026-99138, CVE-2026-99139, CVE-2026-99142, CVE-2026-99143, CVE-2026-99147, CVE-2026-99153, CVE-2026-99155, CVE-2026-99156, CVE-2026-99158, CVE-2026-99159, CVE-2026-99160, CVE-2026-99165, CVE-2026-99167, CVE-2026-99169, CVE-2026-99171, CVE-2026-99173, CVE-2026-99174, CVE-2026-99175, CVE-2026-99176, CVE-2026-99178, CVE-2026-99181, CVE-2026-99187, CVE-2026-99191, CVE-2026-99201, CVE-2026-99203, CVE-2026-99206, CVE-2026-99211, CVE-2026-99213, CVE-2026-99216, CVE-2026-99218, CVE-2026-99219, CVE-2026-99220, CVE-2026-99221, CVE-2026-99222, CVE-2026-99223, CVE-2026-99225, CVE-2026-99226, CVE-2026-99227, CVE-2026-99228, CVE-2026-99229, CVE-2026-99231, CVE-2026-99236, CVE-2026-99244, CVE-2026-99245, CVE-2026-99246, CVE-2026-99247, CVE-2026-99249, CVE-2026-99250, CVE-2026-99251, CVE-2026-99254, CVE-2026-99255, CVE-2026-99256, CVE-2026-99258

Mitre: CVE-2026-89754, CVE-2026-98863, CVE-2026-99077, CVE-2026-99103, CVE-2026-99105, CVE-2026-99110, CVE-2026-99112, CVE-2026-99117, CVE-2026-99118, CVE-2026-99121, CVE-2026-99123, CVE-2026-99127, CVE-2026-99128, CVE-2026-99130, CVE-2026-99131, CVE-2026-99135, CVE-2026-99136, CVE-2026-99138, CVE-2026-99139, CVE-2026-99142, CVE-2026-99143, CVE-2026-99147, CVE-2026-99153, CVE-2026-99155, CVE-2026-99156, CVE-2026-99158, CVE-2026-99159, CVE-2026-99160, CVE-2026-99165, CVE-2026-99167, CVE-2026-99169, CVE-2026-99171, CVE-2026-99173, CVE-2026-99174, CVE-2026-99175, CVE-2026-99176, CVE-2026-99178, CVE-2026-99181, CVE-2026-99187, CVE-2026-99191, CVE-2026-99201, CVE-2026-99203, CVE-2026-99206, CVE-2026-99211, CVE-2026-99213, CVE-2026-99216, CVE-2026-99218, CVE-2026-99219, CVE-2026-99220, CVE-2026-99221, CVE-2026-99222, CVE-2026-99223, CVE-2026-99225, CVE-2026-99226, CVE-2026-99227, CVE-2026-99228, CVE-2026-99229, CVE-2026-99231, CVE-2026-99236, CVE-2026-99244, CVE-2026-99245, CVE-2026-99246, CVE-2026-99247, CVE-2026-99249, CVE-2026-99250, CVE-2026-99251, CVE-2026-99254, CVE-2026-99255, CVE-2026-99256, CVE-2026-99258