# ALAS2023-2026-1925: Security update for 19 packages

ALAS2023-2026-1925, released July 6, 2026, fixes 84 CVEs across 19 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1925
- Platform: Linux
- Released: Jul 6, 2026
- Priority: Patch now (Closes CVE-2026-53266, exploited (CISA KEV))
- CVEs: 84, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1925.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel-livepatch-6.18.36-69.134](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.36-69.134.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53266](https://patchblox.com/security/data/cve/CVE-2026-53266.md) | Patch now | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | CISA KEV |
| [CVE-2026-53224](https://patchblox.com/security/data/cve/CVE-2026-53224.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  sctp: validate embedded INIT chunk and address l... | 9.1 | 0.0057 |  |
| [CVE-2026-53175](https://patchblox.com/security/data/cve/CVE-2026-53175.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  inet: frags: fix use-after-free caused by the fq... | 9.8 | 0.0031 |  |
| [CVE-2026-52929](https://patchblox.com/security/data/cve/CVE-2026-52929.md) | High | sctp: stream: fully roll back denied add-stream state | 9.8 | 0.0087 |  |
| [CVE-2026-52924](https://patchblox.com/security/data/cve/CVE-2026-52924.md) | High | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 |  |
| [CVE-2026-46331](https://patchblox.com/security/data/cve/CVE-2026-46331.md) | High | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 |  |
| [CVE-2026-53221](https://patchblox.com/security/data/cve/CVE-2026-53221.md) | High | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 | 0.0058 |  |
| [CVE-2026-53228](https://patchblox.com/security/data/cve/CVE-2026-53228.md) | High | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 | 0.0058 |  |
| [CVE-2026-53225](https://patchblox.com/security/data/cve/CVE-2026-53225.md) | High | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() | 9.1 | 0.0058 |  |
| [CVE-2026-53268](https://patchblox.com/security/data/cve/CVE-2026-53268.md) | High | netfilter: conntrack_irc: fix possible out-of-bounds read | 8.2 | 0.0052 |  |
| [CVE-2026-53183](https://patchblox.com/security/data/cve/CVE-2026-53183.md) | High | mptcp: allow subflow rcv wnd to shrink | 7.5 | 0.0049 |  |
| [CVE-2026-53184](https://patchblox.com/security/data/cve/CVE-2026-53184.md) | High | udp: clear skb->dev before running a sockmap verdict | 7.5 | 0.0049 |  |
| [CVE-2026-53264](https://patchblox.com/security/data/cve/CVE-2026-53264.md) | High | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 7.8 | 0.0049 |  |
| [CVE-2026-53229](https://patchblox.com/security/data/cve/CVE-2026-53229.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: xsk: Fix DMA and xdp_frame leak on XD... | 7.5 | 0.0048 |  |
| [CVE-2026-52946](https://patchblox.com/security/data/cve/CVE-2026-52946.md) | High | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling | 7.5 | 0.0047 |  |
| [CVE-2026-53246](https://patchblox.com/security/data/cve/CVE-2026-53246.md) | High | sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing | 9.8 | 0.0044 |  |
| [CVE-2026-53235](https://patchblox.com/security/data/cve/CVE-2026-53235.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: add pskb_may_pull() to skb_gro_receive_list... | 7.8 | 0.0044 |  |
| [CVE-2026-53131](https://patchblox.com/security/data/cve/CVE-2026-53131.md) | High | netfilter: require Ethernet MAC header before using eth_hdr() | 9.4 | 0.0044 |  |
| [CVE-2026-53180](https://patchblox.com/security/data/cve/CVE-2026-53180.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  timers/migration: Fix livelock in tmigr_handle_r... | 7.5 | 0.0034 |  |
| [CVE-2026-63867](https://patchblox.com/security/data/cve/CVE-2026-63867.md) | High | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 8.2 | 0.0027 |  |
| [CVE-2026-53275](https://patchblox.com/security/data/cve/CVE-2026-53275.md) | High | ipv6: mcast: Fix use-after-free when processing MLD queries | 8.8 | 0.0026 |  |
| [CVE-2026-53232](https://patchblox.com/security/data/cve/CVE-2026-53232.md) | High | net: phy: clean the sfp upstream if phy probing fails | 8.8 | 0.0026 |  |
| [CVE-2026-46320](https://patchblox.com/security/data/cve/CVE-2026-46320.md) | High | tap: free page on error paths in tap_get_user_xdp() | 7.4 | 0.0025 |  |
| [CVE-2026-53212](https://patchblox.com/security/data/cve/CVE-2026-53212.md) | High | netfilter: nft_tunnel: fix use-after-free on object destroy | 7.8 | 0.0019 |  |
| [CVE-2026-53191](https://patchblox.com/security/data/cve/CVE-2026-53191.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/net: inherit IORING_CQE_F_BUF_MORE acro... | 7.8 | 0.0018 |  |
| [CVE-2026-53233](https://patchblox.com/security/data/cve/CVE-2026-53233.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netdev: fix double-free in netdev_nl_bind_rx_doi... | 7.8 | 0.0018 |  |
| [CVE-2026-53162](https://patchblox.com/security/data/cve/CVE-2026-53162.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  memcg: use round-robin victim selection in refil... | 7.8 | 0.0017 |  |
| [CVE-2026-45850](https://patchblox.com/security/data/cve/CVE-2026-45850.md) | High | ipvs: skip ipv6 extension headers for csum checks | 7.5 | 0.0016 |  |
| [CVE-2026-53187](https://patchblox.com/security/data/cve/CVE-2026-53187.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Validate cpu_id against nr_cpu_ids in... | 7.1 | 0.0016 |  |
| [CVE-2026-53270](https://patchblox.com/security/data/cve/CVE-2026-53270.md) | High | ipvs: clear the svc scheduler ptr early on edit | 9.8 | 0.0016 |  |
| [CVE-2026-53188](https://patchblox.com/security/data/cve/CVE-2026-53188.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Validate the passed in fops for ib_ge... | 8.8 | 0.0016 |  |
| [CVE-2026-52910](https://patchblox.com/security/data/cve/CVE-2026-52910.md) | High | bpf: Free reuseport cBPF prog after RCU grace period. | 7.8 | 0.0014 |  |
| [CVE-2026-53132](https://patchblox.com/security/data/cve/CVE-2026-53132.md) | High | vsock/virtio: fix potential unbounded skb queue | 7.1 | 0.0014 |  |
| [CVE-2026-53223](https://patchblox.com/security/data/cve/CVE-2026-53223.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue sk... | 8.1 | 0.0014 |  |
| [CVE-2026-53145](https://patchblox.com/security/data/cve/CVE-2026-53145.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/gem: Try to fix change_handle ioctl, attempt... | 7.8 | 0.0014 |  |
| [CVE-2026-53356](https://patchblox.com/security/data/cve/CVE-2026-53356.md) | High | drm/i915/gem: Fix phys BO pread/pwrite with offset | 7.8 | 0.0013 |  |
| [CVE-2026-52942](https://patchblox.com/security/data/cve/CVE-2026-52942.md) | High | netfilter: nf_log: validate MAC header was set before dumping it | 7.1 | 0.0013 |  |
| [CVE-2026-53189](https://patchblox.com/security/data/cve/CVE-2026-53189.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 8.8 | 0.0013 |  |
| [CVE-2026-53133](https://patchblox.com/security/data/cve/CVE-2026-53133.md) | High | RDMA/umem: Fix truncation for block sizes >= 4G | 7.8 | 0.0013 |  |
| [CVE-2026-53167](https://patchblox.com/security/data/cve/CVE-2026-53167.md) | High | fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios | 7.0 | 0.0013 |  |
| [CVE-2026-53218](https://patchblox.com/security/data/cve/CVE-2026-53218.md) | High | netfilter: nft_exthdr: fix register tracking for F_PRESENT flag | 7.0 | 0.0013 |  |
| [CVE-2026-53249](https://patchblox.com/security/data/cve/CVE-2026-53249.md) | High | ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options | 7.0 | 0.0013 |  |
| [CVE-2026-53341](https://patchblox.com/security/data/cve/CVE-2026-53341.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0013 |  |
| [CVE-2026-53230](https://patchblox.com/security/data/cve/CVE-2026-53230.md) | High | net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list | 8.8 | 0.0013 |  |
| [CVE-2026-53236](https://patchblox.com/security/data/cve/CVE-2026-53236.md) | High | tcp: restrict SO_ATTACH_FILTER to priv users | 8.8 | 0.0013 |  |
| [CVE-2026-53156](https://patchblox.com/security/data/cve/CVE-2026-53156.md) | High | nvmem: core: fix use-after-free bugs in error paths | 7.8 | 0.0013 |  |
| [CVE-2026-53168](https://patchblox.com/security/data/cve/CVE-2026-53168.md) | High | fuse: reject fuse_notify() pagecache ops on directories | 7.0 | 0.0013 |  |
| [CVE-2026-46054](https://patchblox.com/security/data/cve/CVE-2026-46054.md) | High | selinux: fix overlayfs mmap() and mprotect() access checks | 8.8 | 0.0012 |  |
| [CVE-2026-53267](https://patchblox.com/security/data/cve/CVE-2026-53267.md) | High | netfilter: nft_ct: bail out on template ct in get eval | 7.8 | 0.0012 |  |
| [CVE-2026-52908](https://patchblox.com/security/data/cve/CVE-2026-52908.md) | High | RDMA: During rereg_mr ensure that REREG_ACCESS is compatible | 7.8 | 0.0012 |  |
| [CVE-2026-53272](https://patchblox.com/security/data/cve/CVE-2026-53272.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  erofs: fix use-after-free on sbi->sync_decompres... | 7.8 | 0.0012 |  |
| [CVE-2026-53259](https://patchblox.com/security/data/cve/CVE-2026-53259.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under... | 7.8 | 0.0012 |  |
| [CVE-2026-52909](https://patchblox.com/security/data/cve/CVE-2026-52909.md) | High | ip6_vti: set netns_immutable on the fallback device. | 7.8 | 0.0011 |  |
| [CVE-2026-53250](https://patchblox.com/security/data/cve/CVE-2026-53250.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  xsk: cache csum_start/csum_offset to fix TOCTOU... | 7.8 | 0.0011 |  |
| [CVE-2026-53354](https://patchblox.com/security/data/cve/CVE-2026-53354.md) | High | arm64: errata: Mitigate TLBI errata on various Arm CPUs | 8.8 | 0.0010 |  |
| [CVE-2026-53239](https://patchblox.com/security/data/cve/CVE-2026-53239.md) | High | xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() | 8.8 | 0.0010 |  |
| [CVE-2026-53153](https://patchblox.com/security/data/cve/CVE-2026-53153.md) | High | kernel-rt-64k: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0010 |  |
| [CVE-2026-53265](https://patchblox.com/security/data/cve/CVE-2026-53265.md) | High | dm cache policy smq: check allocation under invalidate lock | 7.8 | 0.0010 |  |
| [CVE-2026-53334](https://patchblox.com/security/data/cve/CVE-2026-53334.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/reclaim: handle ctx allocation failure... | 5.5 | 0.0017 |  |
| [CVE-2026-53335](https://patchblox.com/security/data/cve/CVE-2026-53335.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/lru_sort: handle ctx allocation failure... | 5.5 | 0.0017 |  |
| [CVE-2026-53328](https://patchblox.com/security/data/cve/CVE-2026-53328.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don't warn on NULL cgrp_moving_from i... | 5.5 | 0.0016 |  |
| [CVE-2026-52940](https://patchblox.com/security/data/cve/CVE-2026-52940.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  tun: zero the whole vnet header in tun_put_user(... | 5.5 | 0.0016 |  |
| [CVE-2026-53164](https://patchblox.com/security/data/cve/CVE-2026-53164.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/dma: Do not try to iommu_map a 0 length re... | 5.5 | 0.0016 |  |
| [CVE-2026-53333](https://patchblox.com/security/data/cve/CVE-2026-53333.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/mincore: handle non-swap entries before !CONF... | 5.5 | 0.0016 |  |
| [CVE-2026-53342](https://patchblox.com/security/data/cve/CVE-2026-53342.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  arm64: mm: call pagetable dtor when freeing hot-... | 5.5 | 0.0016 |  |
| [CVE-2026-53227](https://patchblox.com/security/data/cve/CVE-2026-53227.md) | Routine | net: openvswitch: fix possible kfree_skb of ERR_PTR | 5.5 | 0.0013 |  |
| [CVE-2026-53134](https://patchblox.com/security/data/cve/CVE-2026-53134.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_fib: fix stale stack leak via the... | 5.5 | 0.0013 |  |
| [CVE-2026-53245](https://patchblox.com/security/data/cve/CVE-2026-53245.md) | Routine | net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr | 5.5 | 0.0013 |  |
| [CVE-2026-53163](https://patchblox.com/security/data/cve/CVE-2026-53163.md) | Routine | locking/rtmutex: Skip remove_waiter() when waiter is not enqueued | 5.5 | 0.0012 |  |
| [CVE-2026-53220](https://patchblox.com/security/data/cve/CVE-2026-53220.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: revalidate bridge ports  ebt_redirect... | 5.5 | 0.0012 |  |
| [CVE-2026-53238](https://patchblox.com/security/data/cve/CVE-2026-53238.md) | Routine | netlabel: validate unlabeled address and mask attribute lengths | 5.5 | 0.0012 |  |
| [CVE-2026-53337](https://patchblox.com/security/data/cve/CVE-2026-53337.md) | Routine | net: bonding: fix NULL pointer dereference in bond_do_ioctl() | 5.5 | 0.0012 |  |
| [CVE-2026-53154](https://patchblox.com/security/data/cve/CVE-2026-53154.md) | Routine | mm/hugetlb: restore reservation on error in hugetlb folio copy paths | 5.5 | 0.0012 |  |
| [CVE-2026-53190](https://patchblox.com/security/data/cve/CVE-2026-53190.md) | Routine | drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() | 5.5 | 0.0012 |  |
| [CVE-2026-53214](https://patchblox.com/security/data/cve/CVE-2026-53214.md) | Routine | ipv6: Fix a potential NPD in cleanup_prefix_route() | 5.5 | 0.0012 |  |
| [CVE-2026-63868](https://patchblox.com/security/data/cve/CVE-2026-63868.md) | Routine | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 5.5 | 0.0012 |  |
| [CVE-2026-53345](https://patchblox.com/security/data/cve/CVE-2026-53345.md) | Routine | KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying | 6.5 | 0.0012 |  |
| [CVE-2026-52930](https://patchblox.com/security/data/cve/CVE-2026-52930.md) | Routine | ipc/shm: serialize orphan cleanup with shm_nattch updates | 5.5 | 0.0012 |  |
| [CVE-2026-53269](https://patchblox.com/security/data/cve/CVE-2026-53269.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: synproxy: add mutex to guard hook ref... | 5.5 | 0.0012 |  |
| [CVE-2026-53347](https://patchblox.com/security/data/cve/CVE-2026-53347.md) | Routine | drm/virtio: Fix driver removal with disabled KMS | 5.5 | 0.0012 |  |
| [CVE-2026-53349](https://patchblox.com/security/data/cve/CVE-2026-53349.md) | Routine | netfilter: nf_conntrack: destroy stale expectfn expectations on unregister | 5.5 | 0.0012 |  |
| [CVE-2026-53261](https://patchblox.com/security/data/cve/CVE-2026-53261.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  devlink: Release nested relation on devlink free... | 5.5 | 0.0011 |  |
| [CVE-2026-53207](https://patchblox.com/security/data/cve/CVE-2026-53207.md) | Routine | mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison | 5.5 | 0.0010 |  |
| [CVE-2026-53352](https://patchblox.com/security/data/cve/CVE-2026-53352.md) | Routine | signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() | 5.5 | 0.0010 |  |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.