# ALAS2023-2026-1423: Security update for 22 packages ALAS2023-2026-1423, released February 5, 2026, fixes 56 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1423 - Platform: Linux - Released: Feb 5, 2026 - Priority: Urgent (Closes CVE-2025-68206, rated Critical) - CVEs: 56, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1423.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel-livepatch-6.12.64-87.122](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.64-87.122.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-libbpf](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-devel.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-libbpf-static](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-static.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.64-87.122.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-68206](https://patchblox.com/security/data/cve/CVE-2025-68206.md) | Urgent | netfilter: nft_ct: add seqadj extension for natted connections | 9.1 | 0.0071 | | | [CVE-2025-71072](https://patchblox.com/security/data/cve/CVE-2025-71072.md) | Urgent | shmem: fix recovery on rename failures | 9.8 | 0.0036 | | | [CVE-2025-68814](https://patchblox.com/security/data/cve/CVE-2025-68814.md) | Urgent | io_uring: fix filename leak in __io_openat_prep() | 9.8 | 0.0022 | | | [CVE-2025-68822](https://patchblox.com/security/data/cve/CVE-2025-68822.md) | Urgent | Input: alps - fix use-after-free bugs caused by dev3_register_work | 9.8 | 0.0018 | | | [CVE-2025-71098](https://patchblox.com/security/data/cve/CVE-2025-71098.md) | Urgent | ip6_gre: make ip6gre_header() robust | 9.8 | 0.0014 | | | [CVE-2025-68782](https://patchblox.com/security/data/cve/CVE-2025-68782.md) | High | scsi: target: Reset t_task_cdb pointer in error case | 8.6 | 0.0069 | | | [CVE-2025-68794](https://patchblox.com/security/data/cve/CVE-2025-68794.md) | High | iomap: adjust read range correctly for non-block-aligned positions | 9.8 | 0.0069 | | | [CVE-2025-68775](https://patchblox.com/security/data/cve/CVE-2025-68775.md) | High | net/handshake: duplicate handshake cancellations leak socket | 9.8 | 0.0055 | | | [CVE-2025-71120](https://patchblox.com/security/data/cve/CVE-2025-71120.md) | High | SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf | 7.5 | 0.0053 | | | [CVE-2025-71116](https://patchblox.com/security/data/cve/CVE-2025-71116.md) | High | libceph: make decode_pool() more resilient against corrupted osdmaps | 8.1 | 0.0046 | | | [CVE-2025-68803](https://patchblox.com/security/data/cve/CVE-2025-68803.md) | High | NFSD: NFSv4 file creation neglects setting ACL | 8.0 | 0.0045 | | | [CVE-2025-71085](https://patchblox.com/security/data/cve/CVE-2025-71085.md) | High | kernel-tools: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: i... | 7.8 | 0.0031 | | | [CVE-2025-71093](https://patchblox.com/security/data/cve/CVE-2025-71093.md) | High | e1000: fix OOB in e1000_tbi_should_accept() | 7.1 | 0.0029 | | | [CVE-2025-71132](https://patchblox.com/security/data/cve/CVE-2025-71132.md) | High | smc91x: fix broken irq-context in PREEMPT_RT | 8.8 | 0.0022 | | | [CVE-2025-71122](https://patchblox.com/security/data/cve/CVE-2025-71122.md) | High | iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED | 7.8 | 0.0022 | | | [CVE-2025-71067](https://patchblox.com/security/data/cve/CVE-2025-71067.md) | High | ntfs: set dummy blocksize to read boot_block when mounting | 7.1 | 0.0020 | | | [CVE-2025-40170](https://patchblox.com/security/data/cve/CVE-2025-40170.md) | High | net: use dst_dev_rcu() in sk_setup_caps() | 8.1 | 0.0019 | | | [CVE-2025-68795](https://patchblox.com/security/data/cve/CVE-2025-68795.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on s... | 7.8 | 0.0017 | | | [CVE-2025-71123](https://patchblox.com/security/data/cve/CVE-2025-71123.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount... | 7.8 | 0.0017 | | | [CVE-2025-71089](https://patchblox.com/security/data/cve/CVE-2025-71089.md) | High | iommu: disable SVA when CONFIG_X86 is set | 7.8 | 0.0016 | | | [CVE-2025-68785](https://patchblox.com/security/data/cve/CVE-2025-68785.md) | High | net: openvswitch: fix middle attribute validation in push_nsh() action | 7.1 | 0.0016 | | | [CVE-2025-71075](https://patchblox.com/security/data/cve/CVE-2025-71075.md) | High | scsi: aic94xx: fix use-after-free in device removal path | 7.8 | 0.0015 | | | [CVE-2025-71130](https://patchblox.com/security/data/cve/CVE-2025-71130.md) | High | drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer | 7.1 | 0.0015 | | | [CVE-2025-71113](https://patchblox.com/security/data/cve/CVE-2025-71113.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated... | 7.8 | 0.0015 | | | [CVE-2025-68810](https://patchblox.com/security/data/cve/CVE-2025-68810.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an... | 7.8 | 0.0015 | | | [CVE-2025-71091](https://patchblox.com/security/data/cve/CVE-2025-71091.md) | High | team: fix check for port enabled in team_queue_override_port_prio_changed() | 7.8 | 0.0015 | | | [CVE-2025-71143](https://patchblox.com/security/data/cve/CVE-2025-71143.md) | High | clk: samsung: exynos-clkout: Assign .num before accessing .hws | 7.8 | 0.0014 | | | [CVE-2025-71147](https://patchblox.com/security/data/cve/CVE-2025-71147.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd... | 8.8 | 0.0014 | | | [CVE-2025-71157](https://patchblox.com/security/data/cve/CVE-2025-71157.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: always drop device refcount in ib_del... | 7.8 | 0.0014 | | | [CVE-2025-71096](https://patchblox.com/security/data/cve/CVE-2025-71096.md) | High | RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly | 7.1 | 0.0014 | | | [CVE-2025-71131](https://patchblox.com/security/data/cve/CVE-2025-71131.md) | Routine | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_a... | 5.5 | 0.0031 | | | [CVE-2025-71080](https://patchblox.com/security/data/cve/CVE-2025-71080.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PR... | 5.5 | 0.0030 | | | [CVE-2025-71146](https://patchblox.com/security/data/cve/CVE-2025-71146.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix leaked ct in error... | 5.5 | 0.0029 | | | [CVE-2025-68788](https://patchblox.com/security/data/cve/CVE-2025-68788.md) | Routine | fsnotify: do not generate ACCESS/MODIFY events on child for special files | 5.5 | 0.0028 | | | [CVE-2025-71126](https://patchblox.com/security/data/cve/CVE-2025-71126.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinject... | 5.5 | 0.0027 | | | [CVE-2025-68816](https://patchblox.com/security/data/cve/CVE-2025-68816.md) | Routine | net/mlx5: fw_tracer, Validate format string parameters | 6.6 | 0.0024 | | | [CVE-2025-68820](https://patchblox.com/security/data/cve/CVE-2025-68820.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_... | 5.5 | 0.0024 | | | [CVE-2025-68357](https://patchblox.com/security/data/cve/CVE-2025-68357.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iomap: allocate s_dio_done_wq for async reads as... | 5.5 | 0.0023 | | | [CVE-2025-68798](https://patchblox.com/security/data/cve/CVE-2025-68798.md) | Routine | perf/x86/amd: Check event before enable to avoid GPF | 5.8 | 0.0021 | | | [CVE-2025-68780](https://patchblox.com/security/data/cve/CVE-2025-68780.md) | Routine | sched/deadline: only set free_cpus for online runqueues | 5.5 | 0.0021 | | | [CVE-2025-68813](https://patchblox.com/security/data/cve/CVE-2025-68813.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error pat... | 5.5 | 0.0021 | | | [CVE-2025-68821](https://patchblox.com/security/data/cve/CVE-2025-68821.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26... | 5.5 | 0.0021 | | | [CVE-2025-68778](https://patchblox.com/security/data/cve/CVE-2025-68778.md) | Routine | btrfs: don't log conflicting inode if it's a dir moved in the current transaction | 6.1 | 0.0020 | | | [CVE-2025-68784](https://patchblox.com/security/data/cve/CVE-2025-68784.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk... | 5.5 | 0.0020 | | | [CVE-2025-71135](https://patchblox.com/security/data/cve/CVE-2025-71135.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences... | 5.5 | 0.0018 | | | [CVE-2025-71118](https://patchblox.com/security/data/cve/CVE-2025-71118.md) | Routine | ACPICA: Avoid walking the Namespace if start_node is NULL | 5.5 | 0.0017 | | | [CVE-2025-71125](https://patchblox.com/security/data/cve/CVE-2025-71125.md) | Routine | tracing: Do not register unsupported perf events | 5.5 | 0.0016 | | | [CVE-2025-71077](https://patchblox.com/security/data/cve/CVE-2025-71077.md) | Routine | tpm: Cap the number of PCR banks | 6.1 | 0.0015 | | | [CVE-2025-71119](https://patchblox.com/security/data/cve/CVE-2025-71119.md) | Routine | powerpc/kexec: Enable SMT before waking offline CPUs | 5.5 | 0.0015 | | | [CVE-2025-71097](https://patchblox.com/security/data/cve/CVE-2025-71097.md) | Routine | ipv4: Fix reference count leak when using error routes with nexthop objects | 6.5 | 0.0014 | | | [CVE-2025-71083](https://patchblox.com/security/data/cve/CVE-2025-71083.md) | Routine | drm/ttm: Avoid NULL pointer deref for evicted BOs | 5.5 | 0.0014 | | | [CVE-2025-71084](https://patchblox.com/security/data/cve/CVE-2025-71084.md) | Routine | RDMA/cm: Fix leaking the multicast GID table reference | 5.5 | 0.0014 | | | [CVE-2025-71151](https://patchblox.com/security/data/cve/CVE-2025-71151.md) | Routine | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: d... | 5.5 | 0.0014 | | | [CVE-2025-71148](https://patchblox.com/security/data/cve/CVE-2025-71148.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit fail... | 5.5 | 0.0013 | | | [CVE-2025-71104](https://patchblox.com/security/data/cve/CVE-2025-71104.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged ina... | 5.5 | 0.0011 | | | [CVE-2025-71149](https://patchblox.com/security/data/cve/CVE-2025-71149.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: correctly handle io_poll_add() re... | 5.5 | n/a | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.