# ALAS2023-2026-1494: Security update for 22 packages ALAS2023-2026-1494, released March 16, 2026, fixes 67 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1494 - Platform: Linux - Released: Mar 16, 2026 - Priority: Urgent (Closes CVE-2025-68814, rated Critical) - CVEs: 67, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1494.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-livepatch-6.1.161-183.298](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.161-183.298.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.161-183.298.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-68814](https://patchblox.com/security/data/cve/CVE-2025-68814.md) | Urgent | io_uring: fix filename leak in __io_openat_prep() | 9.8 | 0.0022 | | | [CVE-2025-68366](https://patchblox.com/security/data/cve/CVE-2025-68366.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect Th... | 8.8 | 0.0020 | | | [CVE-2025-71098](https://patchblox.com/security/data/cve/CVE-2025-71098.md) | Urgent | ip6_gre: make ip6gre_header() robust | 9.8 | 0.0014 | | | [CVE-2025-68349](https://patchblox.com/security/data/cve/CVE-2025-68349.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_m... | 7.5 | 0.0071 | | | [CVE-2025-68782](https://patchblox.com/security/data/cve/CVE-2025-68782.md) | High | scsi: target: Reset t_task_cdb pointer in error case | 8.6 | 0.0069 | | | [CVE-2025-68261](https://patchblox.com/security/data/cve/CVE-2025-68261.md) | High | ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() | 7.5 | 0.0055 | | | [CVE-2025-68337](https://patchblox.com/security/data/cve/CVE-2025-68337.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_ac... | 7.5 | 0.0055 | | | [CVE-2025-71120](https://patchblox.com/security/data/cve/CVE-2025-71120.md) | High | SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf | 7.5 | 0.0053 | | | [CVE-2025-71116](https://patchblox.com/security/data/cve/CVE-2025-71116.md) | High | libceph: make decode_pool() more resilient against corrupted osdmaps | 8.1 | 0.0046 | | | [CVE-2025-68803](https://patchblox.com/security/data/cve/CVE-2025-68803.md) | High | NFSD: NFSv4 file creation neglects setting ACL | 8.0 | 0.0045 | | | [CVE-2026-22984](https://patchblox.com/security/data/cve/CVE-2026-22984.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in... | 8.8 | 0.0041 | | | [CVE-2026-22990](https://patchblox.com/security/data/cve/CVE-2026-22990.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_app... | 8.8 | 0.0040 | | | [CVE-2025-71085](https://patchblox.com/security/data/cve/CVE-2025-71085.md) | High | kernel-tools: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: i... | 7.8 | 0.0031 | | | [CVE-2025-71093](https://patchblox.com/security/data/cve/CVE-2025-71093.md) | High | e1000: fix OOB in e1000_tbi_should_accept() | 7.1 | 0.0029 | | | [CVE-2025-38129](https://patchblox.com/security/data/cve/CVE-2025-38129.md) | High | page_pool: Fix use-after-free in page_pool_recycle_in_ring | 7.8 | 0.0020 | | | [CVE-2025-68371](https://patchblox.com/security/data/cve/CVE-2025-68371.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed af... | 7.0 | 0.0020 | | | [CVE-2025-68325](https://patchblox.com/security/data/cve/CVE-2025-68325.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reductio... | n/a | 0.0020 | | | [CVE-2026-22977](https://patchblox.com/security/data/cve/CVE-2026-22977.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_r... | 9.8 | 0.0019 | | | [CVE-2025-68727](https://patchblox.com/security/data/cve/CVE-2025-68727.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname(... | n/a | 0.0019 | | | [CVE-2025-68728](https://patchblox.com/security/data/cve/CVE-2025-68728.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in... | n/a | 0.0019 | | | [CVE-2025-40149](https://patchblox.com/security/data/cve/CVE-2025-40149.md) | High | tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). | 8.8 | 0.0017 | | | [CVE-2025-68795](https://patchblox.com/security/data/cve/CVE-2025-68795.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on s... | 7.8 | 0.0017 | | | [CVE-2025-71123](https://patchblox.com/security/data/cve/CVE-2025-71123.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount... | 7.8 | 0.0017 | | | [CVE-2025-68764](https://patchblox.com/security/data/cve/CVE-2025-68764.md) | High | NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags | 7.8 | 0.0017 | | | [CVE-2025-68785](https://patchblox.com/security/data/cve/CVE-2025-68785.md) | High | net: openvswitch: fix middle attribute validation in push_nsh() action | 7.1 | 0.0016 | | | [CVE-2025-40215](https://patchblox.com/security/data/cve/CVE-2025-40215.md) | High | xfrm: delete x->tunnel as we delete x | 7.8 | 0.0015 | | | [CVE-2025-71130](https://patchblox.com/security/data/cve/CVE-2025-71130.md) | High | drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer | 7.1 | 0.0015 | | | [CVE-2025-71113](https://patchblox.com/security/data/cve/CVE-2025-71113.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated... | 7.8 | 0.0015 | | | [CVE-2026-22980](https://patchblox.com/security/data/cve/CVE-2026-22980.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing... | 7.8 | 0.0015 | | | [CVE-2025-71091](https://patchblox.com/security/data/cve/CVE-2025-71091.md) | High | team: fix check for port enabled in team_queue_override_port_prio_changed() | 7.8 | 0.0015 | | | [CVE-2025-71147](https://patchblox.com/security/data/cve/CVE-2025-71147.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd... | 8.8 | 0.0014 | | | [CVE-2025-68724](https://patchblox.com/security/data/cve/CVE-2025-68724.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in as... | 8.1 | 0.0014 | | | [CVE-2026-22979](https://patchblox.com/security/data/cve/CVE-2026-22979.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO... | 7.8 | 0.0014 | | | [CVE-2025-71096](https://patchblox.com/security/data/cve/CVE-2025-71096.md) | High | RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly | 7.1 | 0.0014 | | | [CVE-2026-22991](https://patchblox.com/security/data/cve/CVE-2026-22991.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to... | 5.5 | 0.0047 | | | [CVE-2026-22992](https://patchblox.com/security/data/cve/CVE-2026-22992.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handl... | 6.5 | 0.0045 | | | [CVE-2025-71183](https://patchblox.com/security/data/cve/CVE-2025-71183.md) | Routine | btrfs: always detect conflicting inodes when logging inode refs | 5.5 | 0.0032 | | | [CVE-2025-71131](https://patchblox.com/security/data/cve/CVE-2025-71131.md) | Routine | kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_a... | 5.5 | 0.0031 | | | [CVE-2025-68788](https://patchblox.com/security/data/cve/CVE-2025-68788.md) | Routine | fsnotify: do not generate ACCESS/MODIFY events on child for special files | 5.5 | 0.0028 | | | [CVE-2025-71126](https://patchblox.com/security/data/cve/CVE-2025-71126.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinject... | 5.5 | 0.0027 | | | [CVE-2025-68816](https://patchblox.com/security/data/cve/CVE-2025-68816.md) | Routine | net/mlx5: fw_tracer, Validate format string parameters | 6.6 | 0.0024 | | | [CVE-2025-68820](https://patchblox.com/security/data/cve/CVE-2025-68820.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_... | 5.5 | 0.0024 | | | [CVE-2025-68264](https://patchblox.com/security/data/cve/CVE-2025-68264.md) | Routine | ext4: refresh inline data size before write operations | 5.5 | 0.0022 | | | [CVE-2025-68742](https://patchblox.com/security/data/cve/CVE-2025-68742.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_... | 5.8 | 0.0021 | | | [CVE-2025-68363](https://patchblox.com/security/data/cve/CVE-2025-68363.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_s... | 5.5 | 0.0021 | | | [CVE-2025-68798](https://patchblox.com/security/data/cve/CVE-2025-68798.md) | Routine | perf/x86/amd: Check event before enable to avoid GPF | 5.8 | 0.0021 | | | [CVE-2025-68740](https://patchblox.com/security/data/cve/CVE-2025-68740.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_ru... | 5.5 | 0.0021 | | | [CVE-2025-68780](https://patchblox.com/security/data/cve/CVE-2025-68780.md) | Routine | sched/deadline: only set free_cpus for online runqueues | 5.5 | 0.0021 | | | [CVE-2025-68813](https://patchblox.com/security/data/cve/CVE-2025-68813.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error pat... | 5.5 | 0.0021 | | | [CVE-2025-68821](https://patchblox.com/security/data/cve/CVE-2025-68821.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26... | 5.5 | 0.0021 | | | [CVE-2025-40110](https://patchblox.com/security/data/cve/CVE-2025-40110.md) | Routine | drm/vmwgfx: Fix a null-ptr access in the cursor snooper | 4.7 | 0.0021 | | | [CVE-2025-68778](https://patchblox.com/security/data/cve/CVE-2025-68778.md) | Routine | btrfs: don't log conflicting inode if it's a dir moved in the current transaction | 6.1 | 0.0020 | | | [CVE-2025-68372](https://patchblox.com/security/data/cve/CVE-2025-68372.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one... | 5.5 | 0.0020 | | | [CVE-2025-68259](https://patchblox.com/security/data/cve/CVE-2025-68259.md) | Routine | KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced | 6.2 | 0.0019 | | | [CVE-2026-23047](https://patchblox.com/security/data/cve/CVE-2026-23047.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not j... | 5.5 | 0.0019 | | | [CVE-2026-22976](https://patchblox.com/security/data/cve/CVE-2026-22976.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactiva... | 5.5 | 0.0018 | | | [CVE-2025-71118](https://patchblox.com/security/data/cve/CVE-2025-71118.md) | Routine | ACPICA: Avoid walking the Namespace if start_node is NULL | 5.5 | 0.0017 | | | [CVE-2025-71125](https://patchblox.com/security/data/cve/CVE-2025-71125.md) | Routine | tracing: Do not register unsupported perf events | 5.5 | 0.0016 | | | [CVE-2025-71077](https://patchblox.com/security/data/cve/CVE-2025-71077.md) | Routine | tpm: Cap the number of PCR banks | 6.1 | 0.0015 | | | [CVE-2026-23140](https://patchblox.com/security/data/cve/CVE-2026-23140.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from a... | 5.5 | 0.0015 | | | [CVE-2025-71088](https://patchblox.com/security/data/cve/CVE-2025-71088.md) | Routine | mptcp: fallback earlier on simult connection | 5.5 | 0.0015 | | | [CVE-2025-71097](https://patchblox.com/security/data/cve/CVE-2025-71097.md) | Routine | ipv4: Fix reference count leak when using error routes with nexthop objects | 6.5 | 0.0014 | | | [CVE-2026-22994](https://patchblox.com/security/data/cve/CVE-2026-22994.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_r... | 5.5 | 0.0014 | | | [CVE-2025-71083](https://patchblox.com/security/data/cve/CVE-2025-71083.md) | Routine | drm/ttm: Avoid NULL pointer deref for evicted BOs | 5.5 | 0.0014 | | | [CVE-2025-71084](https://patchblox.com/security/data/cve/CVE-2025-71084.md) | Routine | RDMA/cm: Fix leaking the multicast GID table reference | 5.5 | 0.0014 | | | [CVE-2025-71104](https://patchblox.com/security/data/cve/CVE-2025-71104.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged ina... | 5.5 | 0.0011 | | | [CVE-2025-71149](https://patchblox.com/security/data/cve/CVE-2025-71149.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: correctly handle io_poll_add() re... | 5.5 | n/a | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.