# ALAS2023-2026-1491: Security update for 22 packages ALAS2023-2026-1491, released March 16, 2026, fixes 21 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1491 - Platform: Linux - Released: Mar 16, 2026 - Priority: Urgent (Closes CVE-2025-40251, rated Critical) - CVEs: 21, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1491.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-livepatch-6.1.164-196.303](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.164-196.303.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.164-196.303.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-40251](https://patchblox.com/security/data/cve/CVE-2025-40251.md) | Urgent | devlink: rate: Unset parent pointer in devl_rate_nodes_destroy | 9.8 | 0.0017 | | | [CVE-2025-71236](https://patchblox.com/security/data/cve/CVE-2025-71236.md) | High | scsi: qla2xxx: Validate sp before freeing associated memory | 7.8 | 0.0038 | | | [CVE-2026-52945](https://patchblox.com/security/data/cve/CVE-2026-52945.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI"... | 7.5 | 0.0032 | | | [CVE-2026-23230](https://patchblox.com/security/data/cve/CVE-2026-23230.md) | High | smb: client: split cached_fid bitfields to avoid shared-byte RMW races | 8.4 | 0.0028 | | | [CVE-2025-71238](https://patchblox.com/security/data/cve/CVE-2025-71238.md) | High | scsi: qla2xxx: Fix bsg_done() causing double free | 7.8 | 0.0022 | | | [CVE-2026-23221](https://patchblox.com/security/data/cve/CVE-2026-23221.md) | High | bus: fsl-mc: fix use-after-free in driver_override_show() | 7.8 | 0.0014 | | | [CVE-2025-71233](https://patchblox.com/security/data/cve/CVE-2025-71233.md) | High | PCI: endpoint: Avoid creating sub-groups asynchronously | 8.4 | 0.0014 | | | [CVE-2026-23273](https://patchblox.com/security/data/cve/CVE-2026-23273.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_... | 7.8 | 0.0014 | | | [CVE-2026-23238](https://patchblox.com/security/data/cve/CVE-2026-23238.md) | Routine | romfs: check sb_set_blocksize() return value | 5.5 | 0.0022 | | | [CVE-2025-38643](https://patchblox.com/security/data/cve/CVE-2025-38643.md) | Routine | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | 5.5 | 0.0019 | | | [CVE-2025-71232](https://patchblox.com/security/data/cve/CVE-2025-71232.md) | Routine | scsi: qla2xxx: Free sp in error path to fix system crash | 5.5 | 0.0018 | | | [CVE-2025-68358](https://patchblox.com/security/data/cve/CVE-2025-68358.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_sp... | 5.5 | 0.0018 | | | [CVE-2025-39763](https://patchblox.com/security/data/cve/CVE-2025-39763.md) | Routine | ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered | 5.5 | 0.0016 | | | [CVE-2026-23222](https://patchblox.com/security/data/cve/CVE-2026-23222.md) | Routine | crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly | 5.5 | 0.0015 | | | [CVE-2023-53424](https://patchblox.com/security/data/cve/CVE-2023-53424.md) | Routine | clk: mediatek: fix of_iomap memory leak | 5.5 | 0.0015 | | | [CVE-2026-23169](https://patchblox.com/security/data/cve/CVE-2026-23169.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit(... | 5.6 | 0.0014 | | | [CVE-2025-71235](https://patchblox.com/security/data/cve/CVE-2025-71235.md) | Routine | scsi: qla2xxx: Delay module unload while fabric scan in progress | 5.5 | 0.0014 | | | [CVE-2026-23229](https://patchblox.com/security/data/cve/CVE-2026-23229.md) | Routine | crypto: virtio - Add spinlock protection with virtqueue notification | 5.5 | 0.0014 | | | [CVE-2026-23228](https://patchblox.com/security/data/cve/CVE-2026-23228.md) | Routine | smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() | 6.5 | 0.0014 | | | [CVE-2025-71237](https://patchblox.com/security/data/cve/CVE-2025-71237.md) | Routine | nilfs2: Fix potential block overflow that cause system hang | 5.5 | 0.0014 | | | [CVE-2025-71144](https://patchblox.com/security/data/cve/CVE-2025-71144.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() Aft... | 5.5 | 0.0014 | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.