# ALAS2023-2026-1968: Security update for 18 packages

ALAS2023-2026-1968, released July 20, 2026, fixes 125 CVEs across 18 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1968
- Platform: Linux
- Released: Jul 20, 2026
- Priority: Patch now (Closes CVE-2026-53266, exploited (CISA KEV))
- CVEs: 125, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1968.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel-livepatch-6.12.94-123.174](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.94-123.174.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.94-123.174.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53266](https://patchblox.com/security/data/cve/CVE-2026-53266.md) | Patch now | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | CISA KEV |
| [CVE-2026-63984](https://patchblox.com/security/data/cve/CVE-2026-63984.md) | Urgent | kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 9.8 | 0.0051 |  |
| [CVE-2026-63939](https://patchblox.com/security/data/cve/CVE-2026-63939.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Compute the correct max length of the... | 9.3 | 0.0020 |  |
| [CVE-2026-63938](https://patchblox.com/security/data/cve/CVE-2026-63938.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Check PSC request indices against the... | 9.3 | 0.0020 |  |
| [CVE-2026-63983](https://patchblox.com/security/data/cve/CVE-2026-63983.md) | Urgent | net/sched: fix packet loop on netem when duplicate is on | 9.8 | 0.0017 |  |
| [CVE-2026-46242](https://patchblox.com/security/data/cve/CVE-2026-46242.md) | High | kpatch-patch-5_14_0-687_10_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run... | 7.8 | 0.0458 |  |
| [CVE-2026-63913](https://patchblox.com/security/data/cve/CVE-2026-63913.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: s... | 8.8 | 0.0097 |  |
| [CVE-2026-52929](https://patchblox.com/security/data/cve/CVE-2026-52929.md) | High | sctp: stream: fully roll back denied add-stream state | 9.8 | 0.0087 |  |
| [CVE-2026-63887](https://patchblox.com/security/data/cve/CVE-2026-63887.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_outp... | 9.8 | 0.0078 |  |
| [CVE-2026-63888](https://patchblox.com/security/data/cve/CVE-2026-63888.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 9.8 | 0.0078 |  |
| [CVE-2026-63912](https://patchblox.com/security/data/cve/CVE-2026-63912.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0071 |  |
| [CVE-2026-63922](https://patchblox.com/security/data/cve/CVE-2026-63922.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: t... | 9.8 | 0.0071 |  |
| [CVE-2026-63924](https://patchblox.com/security/data/cve/CVE-2026-63924.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: t... | 9.8 | 0.0071 |  |
| [CVE-2026-63886](https://patchblox.com/security/data/cve/CVE-2026-63886.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: s... | 9.8 | 0.0071 |  |
| [CVE-2026-63968](https://patchblox.com/security/data/cve/CVE-2026-63968.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: fix possible infinite loop in fib6_select_... | 7.5 | 0.0067 |  |
| [CVE-2026-52924](https://patchblox.com/security/data/cve/CVE-2026-52924.md) | High | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 |  |
| [CVE-2026-63919](https://patchblox.com/security/data/cve/CVE-2026-63919.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0065 |  |
| [CVE-2026-46331](https://patchblox.com/security/data/cve/CVE-2026-46331.md) | High | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 |  |
| [CVE-2026-53221](https://patchblox.com/security/data/cve/CVE-2026-53221.md) | High | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 | 0.0058 |  |
| [CVE-2026-53228](https://patchblox.com/security/data/cve/CVE-2026-53228.md) | High | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 | 0.0058 |  |
| [CVE-2026-53225](https://patchblox.com/security/data/cve/CVE-2026-53225.md) | High | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() | 9.1 | 0.0058 |  |
| [CVE-2026-53268](https://patchblox.com/security/data/cve/CVE-2026-53268.md) | High | netfilter: conntrack_irc: fix possible out-of-bounds read | 8.2 | 0.0052 |  |
| [CVE-2026-63993](https://patchblox.com/security/data/cve/CVE-2026-63993.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after s... | 9.8 | 0.0051 |  |
| [CVE-2026-63994](https://patchblox.com/security/data/cve/CVE-2026-63994.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0051 |  |
| [CVE-2026-64007](https://patchblox.com/security/data/cve/CVE-2026-64007.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 9.8 | 0.0051 |  |
| [CVE-2026-63992](https://patchblox.com/security/data/cve/CVE-2026-63992.md) | High | kernel-rt-64k-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.1 | 0.0051 |  |
| [CVE-2026-53199](https://patchblox.com/security/data/cve/CVE-2026-53199.md) | High | hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf | 7.5 | 0.0050 |  |
| [CVE-2026-63978](https://patchblox.com/security/data/cve/CVE-2026-63978.md) | High | net/handshake: Drain pending requests at net namespace exit | 9.8 | 0.0049 |  |
| [CVE-2026-53183](https://patchblox.com/security/data/cve/CVE-2026-53183.md) | High | mptcp: allow subflow rcv wnd to shrink | 7.5 | 0.0049 |  |
| [CVE-2026-53184](https://patchblox.com/security/data/cve/CVE-2026-53184.md) | High | udp: clear skb->dev before running a sockmap verdict | 7.5 | 0.0049 |  |
| [CVE-2026-53264](https://patchblox.com/security/data/cve/CVE-2026-53264.md) | High | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 7.8 | 0.0049 |  |
| [CVE-2026-53229](https://patchblox.com/security/data/cve/CVE-2026-53229.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: xsk: Fix DMA and xdp_frame leak on XD... | 7.5 | 0.0048 |  |
| [CVE-2026-52946](https://patchblox.com/security/data/cve/CVE-2026-52946.md) | High | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling | 7.5 | 0.0047 |  |
| [CVE-2026-64523](https://patchblox.com/security/data/cve/CVE-2026-64523.md) | High | net/handshake: Take a long-lived file reference at submit | 9.8 | 0.0045 |  |
| [CVE-2026-53235](https://patchblox.com/security/data/cve/CVE-2026-53235.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: add pskb_may_pull() to skb_gro_receive_list... | 7.8 | 0.0044 |  |
| [CVE-2026-64003](https://patchblox.com/security/data/cve/CVE-2026-64003.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: core: Run queues for all non-SDEV_DEL devi... | 7.5 | 0.0044 |  |
| [CVE-2026-53131](https://patchblox.com/security/data/cve/CVE-2026-53131.md) | High | netfilter: require Ethernet MAC header before using eth_hdr() | 9.4 | 0.0044 |  |
| [CVE-2026-63889](https://patchblox.com/security/data/cve/CVE-2026-63889.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0036 |  |
| [CVE-2026-63925](https://patchblox.com/security/data/cve/CVE-2026-63925.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.1 | 0.0035 |  |
| [CVE-2026-53180](https://patchblox.com/security/data/cve/CVE-2026-53180.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  timers/migration: Fix livelock in tmigr_handle_r... | 7.5 | 0.0034 |  |
| [CVE-2026-63980](https://patchblox.com/security/data/cve/CVE-2026-63980.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/handshake: Use spin_lock_bh for hn_lock  nvm... | 7.5 | 0.0034 |  |
| [CVE-2026-64235](https://patchblox.com/security/data/cve/CVE-2026-64235.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  x86/ftrace: Relocate %rip-relative percpu refs i... | 8.1 | 0.0033 |  |
| [CVE-2026-52943](https://patchblox.com/security/data/cve/CVE-2026-52943.md) | High | net: skbuff: fix missing zerocopy reference in pskb_carve helpers | 7.8 | 0.0030 |  |
| [CVE-2026-63867](https://patchblox.com/security/data/cve/CVE-2026-63867.md) | High | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 8.2 | 0.0027 |  |
| [CVE-2026-53275](https://patchblox.com/security/data/cve/CVE-2026-53275.md) | High | ipv6: mcast: Fix use-after-free when processing MLD queries | 8.8 | 0.0026 |  |
| [CVE-2026-53232](https://patchblox.com/security/data/cve/CVE-2026-53232.md) | High | net: phy: clean the sfp upstream if phy probing fails | 8.8 | 0.0026 |  |
| [CVE-2026-46320](https://patchblox.com/security/data/cve/CVE-2026-46320.md) | High | tap: free page on error paths in tap_get_user_xdp() | 7.4 | 0.0025 |  |
| [CVE-2026-52923](https://patchblox.com/security/data/cve/CVE-2026-52923.md) | High | ipc: limit next_id allocation to the valid ID range | 7.8 | 0.0022 |  |
| [CVE-2026-63896](https://patchblox.com/security/data/cve/CVE-2026-63896.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: composite: fix integer underflow in... | n/a | 0.0021 |  |
| [CVE-2026-53212](https://patchblox.com/security/data/cve/CVE-2026-53212.md) | High | netfilter: nft_tunnel: fix use-after-free on object destroy | 7.8 | 0.0019 |  |
| [CVE-2026-63926](https://patchblox.com/security/data/cve/CVE-2026-63926.md) | High | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 8.4 | 0.0019 |  |
| [CVE-2026-63875](https://patchblox.com/security/data/cve/CVE-2026-63875.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0018 |  |
| [CVE-2026-63884](https://patchblox.com/security/data/cve/CVE-2026-63884.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: m... | 7.8 | 0.0018 |  |
| [CVE-2026-53191](https://patchblox.com/security/data/cve/CVE-2026-53191.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/net: inherit IORING_CQE_F_BUF_MORE acro... | 7.8 | 0.0018 |  |
| [CVE-2026-53233](https://patchblox.com/security/data/cve/CVE-2026-53233.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netdev: fix double-free in netdev_nl_bind_rx_doi... | 7.8 | 0.0018 |  |
| [CVE-2026-63920](https://patchblox.com/security/data/cve/CVE-2026-63920.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.1 | 0.0017 |  |
| [CVE-2026-43303](https://patchblox.com/security/data/cve/CVE-2026-43303.md) | High | mm/page_alloc: clear page->private in free_pages_prepare() | 7.8 | 0.0017 |  |
| [CVE-2026-63917](https://patchblox.com/security/data/cve/CVE-2026-63917.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0017 |  |
| [CVE-2026-45850](https://patchblox.com/security/data/cve/CVE-2026-45850.md) | High | ipvs: skip ipv6 extension headers for csum checks | 7.5 | 0.0016 |  |
| [CVE-2026-63962](https://patchblox.com/security/data/cve/CVE-2026-63962.md) | High | usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() | 8.8 | 0.0016 |  |
| [CVE-2026-63921](https://patchblox.com/security/data/cve/CVE-2026-63921.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0016 |  |
| [CVE-2026-53270](https://patchblox.com/security/data/cve/CVE-2026-53270.md) | High | ipvs: clear the svc scheduler ptr early on edit | 9.8 | 0.0016 |  |
| [CVE-2026-63914](https://patchblox.com/security/data/cve/CVE-2026-63914.md) | High | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 7.3 | 0.0015 |  |
| [CVE-2026-64009](https://patchblox.com/security/data/cve/CVE-2026-64009.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0014 |  |
| [CVE-2026-52910](https://patchblox.com/security/data/cve/CVE-2026-52910.md) | High | bpf: Free reuseport cBPF prog after RCU grace period. | 7.8 | 0.0014 |  |
| [CVE-2026-53132](https://patchblox.com/security/data/cve/CVE-2026-53132.md) | High | vsock/virtio: fix potential unbounded skb queue | 7.1 | 0.0014 |  |
| [CVE-2026-53223](https://patchblox.com/security/data/cve/CVE-2026-53223.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue sk... | 8.1 | 0.0014 |  |
| [CVE-2026-63937](https://patchblox.com/security/data/cve/CVE-2026-63937.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: SEV: Use READ_ONCE() when reading entries/i... | 8.8 | 0.0014 |  |
| [CVE-2026-53356](https://patchblox.com/security/data/cve/CVE-2026-53356.md) | High | drm/i915/gem: Fix phys BO pread/pwrite with offset | 7.8 | 0.0013 |  |
| [CVE-2026-46322](https://patchblox.com/security/data/cve/CVE-2026-46322.md) | High | tun: free page on build_skb failure in tun_xdp_one() | 7.1 | 0.0013 |  |
| [CVE-2026-46321](https://patchblox.com/security/data/cve/CVE-2026-46321.md) | High | tun: free page on short-frame rejection in tun_xdp_one() | 7.1 | 0.0013 |  |
| [CVE-2026-52942](https://patchblox.com/security/data/cve/CVE-2026-52942.md) | High | netfilter: nf_log: validate MAC header was set before dumping it | 7.1 | 0.0013 |  |
| [CVE-2026-63971](https://patchblox.com/security/data/cve/CVE-2026-63971.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 8.8 | 0.0013 |  |
| [CVE-2026-53189](https://patchblox.com/security/data/cve/CVE-2026-53189.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 8.8 | 0.0013 |  |
| [CVE-2026-64002](https://patchblox.com/security/data/cve/CVE-2026-64002.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports... | 8.8 | 0.0013 |  |
| [CVE-2026-53133](https://patchblox.com/security/data/cve/CVE-2026-53133.md) | High | RDMA/umem: Fix truncation for block sizes >= 4G | 7.8 | 0.0013 |  |
| [CVE-2026-63985](https://patchblox.com/security/data/cve/CVE-2026-63985.md) | High | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 7.8 | 0.0013 |  |
| [CVE-2026-63987](https://patchblox.com/security/data/cve/CVE-2026-63987.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0013 |  |
| [CVE-2026-63995](https://patchblox.com/security/data/cve/CVE-2026-63995.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ethtool: cmis: validate start_cmd_payload_size f... | 7.8 | 0.0013 |  |
| [CVE-2026-63996](https://patchblox.com/security/data/cve/CVE-2026-63996.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0013 |  |
| [CVE-2026-53218](https://patchblox.com/security/data/cve/CVE-2026-53218.md) | High | netfilter: nft_exthdr: fix register tracking for F_PRESENT flag | 7.0 | 0.0013 |  |
| [CVE-2026-53249](https://patchblox.com/security/data/cve/CVE-2026-53249.md) | High | ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options | 7.0 | 0.0013 |  |
| [CVE-2026-63952](https://patchblox.com/security/data/cve/CVE-2026-63952.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: n... | 8.4 | 0.0013 |  |
| [CVE-2026-53230](https://patchblox.com/security/data/cve/CVE-2026-53230.md) | High | net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list | 8.8 | 0.0013 |  |
| [CVE-2026-53236](https://patchblox.com/security/data/cve/CVE-2026-53236.md) | High | tcp: restrict SO_ATTACH_FILTER to priv users | 8.8 | 0.0013 |  |
| [CVE-2026-53156](https://patchblox.com/security/data/cve/CVE-2026-53156.md) | High | nvmem: core: fix use-after-free bugs in error paths | 7.8 | 0.0013 |  |
| [CVE-2026-53168](https://patchblox.com/security/data/cve/CVE-2026-53168.md) | High | fuse: reject fuse_notify() pagecache ops on directories | 7.0 | 0.0013 |  |
| [CVE-2026-46054](https://patchblox.com/security/data/cve/CVE-2026-46054.md) | High | selinux: fix overlayfs mmap() and mprotect() access checks | 8.8 | 0.0012 |  |
| [CVE-2026-52927](https://patchblox.com/security/data/cve/CVE-2026-52927.md) | High | netfilter: ebtables: fix OOB read in compat_mtw_from_user | 7.8 | 0.0012 |  |
| [CVE-2026-53267](https://patchblox.com/security/data/cve/CVE-2026-53267.md) | High | netfilter: nft_ct: bail out on template ct in get eval | 7.8 | 0.0012 |  |
| [CVE-2026-52908](https://patchblox.com/security/data/cve/CVE-2026-52908.md) | High | RDMA: During rereg_mr ensure that REREG_ACCESS is compatible | 7.8 | 0.0012 |  |
| [CVE-2026-53272](https://patchblox.com/security/data/cve/CVE-2026-53272.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  erofs: fix use-after-free on sbi->sync_decompres... | 7.8 | 0.0012 |  |
| [CVE-2026-64239](https://patchblox.com/security/data/cve/CVE-2026-64239.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/sysfs-schemes: delete tried region in r... | 7.8 | 0.0012 |  |
| [CVE-2026-53354](https://patchblox.com/security/data/cve/CVE-2026-53354.md) | High | arm64: errata: Mitigate TLBI errata on various Arm CPUs | 8.8 | 0.0010 |  |
| [CVE-2026-53239](https://patchblox.com/security/data/cve/CVE-2026-53239.md) | High | xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() | 8.8 | 0.0010 |  |
| [CVE-2026-64378](https://patchblox.com/security/data/cve/CVE-2026-64378.md) | High | writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() | 8.8 | 0.0010 |  |
| [CVE-2026-64005](https://patchblox.com/security/data/cve/CVE-2026-64005.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/smc: Do not re-initialize smc hashtables  IN... | 7.8 | 0.0010 |  |
| [CVE-2026-63969](https://patchblox.com/security/data/cve/CVE-2026-63969.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: fix possible infinite loop in rt6_fill_nod... | 5.5 | 0.0021 |  |
| [CVE-2026-63876](https://patchblox.com/security/data/cve/CVE-2026-63876.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  serial: zs: Convert to use a platform device  Pr... | 5.5 | 0.0017 |  |
| [CVE-2026-63877](https://patchblox.com/security/data/cve/CVE-2026-63877.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  serial: dz: Convert to use a platform device  Pr... | 5.5 | 0.0017 |  |
| [CVE-2026-53328](https://patchblox.com/security/data/cve/CVE-2026-53328.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don't warn on NULL cgrp_moving_from i... | 5.5 | 0.0016 |  |
| [CVE-2026-64525](https://patchblox.com/security/data/cve/CVE-2026-64525.md) | Routine | xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit | 5.5 | 0.0016 |  |
| [CVE-2026-53227](https://patchblox.com/security/data/cve/CVE-2026-53227.md) | Routine | net: openvswitch: fix possible kfree_skb of ERR_PTR | 5.5 | 0.0013 |  |
| [CVE-2026-63990](https://patchblox.com/security/data/cve/CVE-2026-63990.md) | Routine | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 5.5 | 0.0013 |  |
| [CVE-2026-53134](https://patchblox.com/security/data/cve/CVE-2026-53134.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nft_fib: fix stale stack leak via the... | 5.5 | 0.0013 |  |
| [CVE-2026-53219](https://patchblox.com/security/data/cve/CVE-2026-53219.md) | Routine | netfilter: x_tables: avoid leaking percpu counter pointers | 5.5 | 0.0013 |  |
| [CVE-2026-53245](https://patchblox.com/security/data/cve/CVE-2026-53245.md) | Routine | net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr | 5.5 | 0.0013 |  |
| [CVE-2026-53220](https://patchblox.com/security/data/cve/CVE-2026-53220.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: revalidate bridge ports  ebt_redirect... | 5.5 | 0.0012 |  |
| [CVE-2026-53238](https://patchblox.com/security/data/cve/CVE-2026-53238.md) | Routine | netlabel: validate unlabeled address and mask attribute lengths | 5.5 | 0.0012 |  |
| [CVE-2026-53337](https://patchblox.com/security/data/cve/CVE-2026-53337.md) | Routine | net: bonding: fix NULL pointer dereference in bond_do_ioctl() | 5.5 | 0.0012 |  |
| [CVE-2026-64012](https://patchblox.com/security/data/cve/CVE-2026-64012.md) | Routine | kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 5.5 | 0.0012 |  |
| [CVE-2026-64131](https://patchblox.com/security/data/cve/CVE-2026-64131.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/memory: fix spurious warning when unmapping d... | 5.5 | 0.0012 |  |
| [CVE-2026-53154](https://patchblox.com/security/data/cve/CVE-2026-53154.md) | Routine | mm/hugetlb: restore reservation on error in hugetlb folio copy paths | 5.5 | 0.0012 |  |
| [CVE-2026-53190](https://patchblox.com/security/data/cve/CVE-2026-53190.md) | Routine | drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() | 5.5 | 0.0012 |  |
| [CVE-2026-53214](https://patchblox.com/security/data/cve/CVE-2026-53214.md) | Routine | ipv6: Fix a potential NPD in cleanup_prefix_route() | 5.5 | 0.0012 |  |
| [CVE-2026-63997](https://patchblox.com/security/data/cve/CVE-2026-63997.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ethtool: module: avoid leaking a netdev ref on m... | 5.5 | 0.0012 |  |
| [CVE-2026-63868](https://patchblox.com/security/data/cve/CVE-2026-63868.md) | Routine | bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli)  [Orabug: 39853924]  [5.1... | 5.5 | 0.0012 |  |
| [CVE-2026-53345](https://patchblox.com/security/data/cve/CVE-2026-53345.md) | Routine | KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying | 6.5 | 0.0012 |  |
| [CVE-2026-52930](https://patchblox.com/security/data/cve/CVE-2026-52930.md) | Routine | ipc/shm: serialize orphan cleanup with shm_nattch updates | 5.5 | 0.0012 |  |
| [CVE-2026-53269](https://patchblox.com/security/data/cve/CVE-2026-53269.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  netfilter: synproxy: add mutex to guard hook ref... | 5.5 | 0.0012 |  |
| [CVE-2026-53347](https://patchblox.com/security/data/cve/CVE-2026-53347.md) | Routine | drm/virtio: Fix driver removal with disabled KMS | 5.5 | 0.0012 |  |
| [CVE-2026-53349](https://patchblox.com/security/data/cve/CVE-2026-53349.md) | Routine | netfilter: nf_conntrack: destroy stale expectfn expectations on unregister | 5.5 | 0.0012 |  |
| [CVE-2026-53261](https://patchblox.com/security/data/cve/CVE-2026-53261.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  devlink: Release nested relation on devlink free... | 5.5 | 0.0011 |  |
| [CVE-2026-53207](https://patchblox.com/security/data/cve/CVE-2026-53207.md) | Routine | mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison | 5.5 | 0.0010 |  |
| [CVE-2026-53352](https://patchblox.com/security/data/cve/CVE-2026-53352.md) | Routine | signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() | 5.5 | 0.0010 |  |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.