# ALAS2023-2026-1969: Security update for 19 packages

ALAS2023-2026-1969, released July 20, 2026, fixes 37 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1969
- Platform: Linux
- Released: Jul 20, 2026
- Priority: Urgent (Closes CVE-2026-63800, rated Critical)
- CVEs: 37, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1969.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel-livepatch-6.18.38-73.137](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.38-73.137.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |
| [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.38-73.137.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-63800](https://patchblox.com/security/data/cve/CVE-2026-63800.md) | Urgent | pNFS: Fix use-after-free in pnfs_update_layout() | 9.8 | 0.0064 |  |
| [CVE-2026-63828](https://patchblox.com/security/data/cve/CVE-2026-63828.md) | Urgent | apparmor: mediate the implicit connect of TCP fast open sendmsg | 9.8 | 0.0017 |  |
| [CVE-2026-63824](https://patchblox.com/security/data/cve/CVE-2026-63824.md) | Urgent | KEYS: fix overflow in keyctl_pkey_params_get_2() | 9.8 | 0.0017 |  |
| [CVE-2026-63833](https://patchblox.com/security/data/cve/CVE-2026-63833.md) | Urgent | ntfs3: reject direct userspace writes to reserved $LX* xattrs | 9.8 | 0.0014 |  |
| [CVE-2026-53403](https://patchblox.com/security/data/cve/CVE-2026-53403.md) | Urgent | fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var | 9.8 | 0.0013 |  |
| [CVE-2026-53359](https://patchblox.com/security/data/cve/CVE-2026-53359.md) | High | kpatch-patch-4_18_0-553_109_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run... | 8.8 | 0.0137 |  |
| [CVE-2026-53394](https://patchblox.com/security/data/cve/CVE-2026-53394.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: avoid leaking pre-allocated openowner on u... | 7.5 | 0.0063 |  |
| [CVE-2026-53398](https://patchblox.com/security/data/cve/CVE-2026-53398.md) | High | NFSD: Fix SECINFO_NO_NAME decode error cleanup | 9.8 | 0.0054 |  |
| [CVE-2026-53392](https://patchblox.com/security/data/cve/CVE-2026-53392.md) | High | NFSv4/flexfiles: reject zero filehandle version count | 8.8 | 0.0053 |  |
| [CVE-2026-53397](https://patchblox.com/security/data/cve/CVE-2026-53397.md) | High | nfsd: fix posix_acl leak on SETACL decode failure | 8.8 | 0.0053 |  |
| [CVE-2026-63808](https://patchblox.com/security/data/cve/CVE-2026-63808.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0053 |  |
| [CVE-2026-53391](https://patchblox.com/security/data/cve/CVE-2026-53391.md) | High | NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr | 8.8 | 0.0052 |  |
| [CVE-2026-63801](https://patchblox.com/security/data/cve/CVE-2026-63801.md) | High | tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done | 8.8 | 0.0051 |  |
| [CVE-2026-63830](https://patchblox.com/security/data/cve/CVE-2026-63830.md) | High | net: skmsg: preserve sg.copy across SG transforms | 9.4 | 0.0044 |  |
| [CVE-2026-53070](https://patchblox.com/security/data/cve/CVE-2026-53070.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sctp: disable BH before calling udp_tunnel_xmit_... | 7.5 | 0.0030 |  |
| [CVE-2026-53361](https://patchblox.com/security/data/cve/CVE-2026-53361.md) | High | af_unix: Set gc_in_progress to true in unix_gc(). | 8.8 | 0.0026 |  |
| [CVE-2026-63810](https://patchblox.com/security/data/cve/CVE-2026-63810.md) | High | block: Avoid mounting the bdev pseudo-filesystem in userspace | 7.1 | 0.0021 |  |
| [CVE-2026-63807](https://patchblox.com/security/data/cve/CVE-2026-63807.md) | High | KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level | 8.8 | 0.0017 |  |
| [CVE-2026-63826](https://patchblox.com/security/data/cve/CVE-2026-63826.md) | High | fbdev: fix use-after-free in store_modes() | 7.1 | 0.0017 |  |
| [CVE-2026-63823](https://patchblox.com/security/data/cve/CVE-2026-63823.md) | High | keys: Pin request_key_auth payload in instantiate paths | 8.8 | 0.0016 |  |
| [CVE-2026-63806](https://patchblox.com/security/data/cve/CVE-2026-63806.md) | High | KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() | 7.3 | 0.0016 |  |
| [CVE-2026-64247](https://patchblox.com/security/data/cve/CVE-2026-64247.md) | High | KVM: x86: hyper-v: Bound the bank index when querying sparse banks | 8.4 | 0.0016 |  |
| [CVE-2026-63809](https://patchblox.com/security/data/cve/CVE-2026-63809.md) | High | bpf: use kvfree() for replaced sysctl write buffer | 7.8 | 0.0015 |  |
| [CVE-2026-63829](https://patchblox.com/security/data/cve/CVE-2026-63829.md) | High | net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 |  |
| [CVE-2026-53381](https://patchblox.com/security/data/cve/CVE-2026-53381.md) | High | virtiofs: fix UAF on submount umount | 8.1 | 0.0014 |  |
| [CVE-2026-53400](https://patchblox.com/security/data/cve/CVE-2026-53400.md) | High | i2c: core: fix adapter registration race | 7.8 | 0.0014 |  |
| [CVE-2026-53388](https://patchblox.com/security/data/cve/CVE-2026-53388.md) | High | fuse: re-lock request before replacing page cache folio | 8.8 | 0.0013 |  |
| [CVE-2026-53389](https://patchblox.com/security/data/cve/CVE-2026-53389.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/tcp-ao: fix use-after-free of key in del_asy... | 7.8 | 0.0013 |  |
| [CVE-2026-53393](https://patchblox.com/security/data/cve/CVE-2026-53393.md) | High | nfsd: reset write verifier on deferred writeback errors | 7.0 | 0.0013 |  |
| [CVE-2026-53078](https://patchblox.com/security/data/cve/CVE-2026-53078.md) | High | bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops | 7.8 | 0.0012 |  |
| [CVE-2026-64245](https://patchblox.com/security/data/cve/CVE-2026-64245.md) | High | fbdev: modedb: fix a possible UAF in fb_find_mode() | 7.8 | 0.0012 |  |
| [CVE-2026-63802](https://patchblox.com/security/data/cve/CVE-2026-63802.md) | High | blk-cgroup: fix UAF in __blkcg_rstat_flush() | 8.3 | 0.0010 |  |
| [CVE-2026-64248](https://patchblox.com/security/data/cve/CVE-2026-64248.md) | Routine | MIPS: smp: report dying CPU to RCU in stop_this_cpu() | 5.5 | 0.0016 |  |
| [CVE-2026-64250](https://patchblox.com/security/data/cve/CVE-2026-64250.md) | Routine | LoongArch: Report dying CPU to RCU in stop_this_cpu() | 5.5 | 0.0016 |  |
| [CVE-2026-53385](https://patchblox.com/security/data/cve/CVE-2026-53385.md) | Routine | vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write | 5.5 | 0.0013 |  |
| [CVE-2026-64244](https://patchblox.com/security/data/cve/CVE-2026-64244.md) | Routine | drivers/base/memory: set mem->altmap after successful device registration | 5.5 | 0.0012 |  |
| [CVE-2026-64253](https://patchblox.com/security/data/cve/CVE-2026-64253.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  kernel/fork: clear PF_BLOCK_TS in copy_process()... | 5.5 | 0.0011 |  |

---

Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.