# ALAS2023-2026-2106: Security update for 19 packages ALAS2023-2026-2106, released August 31, 2026, fixes 197 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-2106 - Platform: Linux - Released: Aug 31, 2026 - Priority: Urgent (Closes CVE-2026-64564, rated Critical) - CVEs: 197, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-2106.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel-livepatch-6.18.44-99.149](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.44-99.149.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | | [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.44-99.149.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-64564](https://patchblox.com/security/data/cve/CVE-2026-64564.md) | Urgent | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 | | | [CVE-2026-68160](https://patchblox.com/security/data/cve/CVE-2026-68160.md) | Urgent | ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() | 9.8 | 0.0077 | | | [CVE-2026-63979](https://patchblox.com/security/data/cve/CVE-2026-63979.md) | Urgent | net/handshake: hand off the pinned file reference to accept_doit | 9.8 | 0.0064 | | | [CVE-2026-68127](https://patchblox.com/security/data/cve/CVE-2026-68127.md) | Urgent | ila: reload IPv6 header after pskb_may_pull in checksum adjust | 9.8 | 0.0054 | | | [CVE-2026-68131](https://patchblox.com/security/data/cve/CVE-2026-68131.md) | Urgent | rbd: Reset positive result codes to zero in object map update path | 9.8 | 0.0052 | | | [CVE-2026-80681](https://patchblox.com/security/data/cve/CVE-2026-80681.md) | Urgent | vxlan: re-fetch eth header after route_shortcircuit() | 9.8 | 0.0050 | | | [CVE-2026-68121](https://patchblox.com/security/data/cve/CVE-2026-68121.md) | Urgent | pppoe: reload header pointer after dev_hard_header() | 9.8 | 0.0037 | | | [CVE-2026-68166](https://patchblox.com/security/data/cve/CVE-2026-68166.md) | Urgent | userfaultfd: prevent registration of special VMAs | 9.8 | 0.0021 | | | [CVE-2026-68132](https://patchblox.com/security/data/cve/CVE-2026-68132.md) | Urgent | super: fix emergency thaw deadlock on frozen block devices | 9.8 | 0.0018 | | | [CVE-2026-68146](https://patchblox.com/security/data/cve/CVE-2026-68146.md) | Urgent | ftrace: Add global mutex to serialize trace_parser access | 9.8 | 0.0018 | | | [CVE-2026-68325](https://patchblox.com/security/data/cve/CVE-2026-68325.md) | Urgent | iommu/amd: Bound the early ACPI HID map | 9.8 | 0.0018 | | | [CVE-2026-80686](https://patchblox.com/security/data/cve/CVE-2026-80686.md) | Urgent | mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE | 9.8 | 0.0017 | | | [CVE-2026-64562](https://patchblox.com/security/data/cve/CVE-2026-64562.md) | Urgent | KVM: nVMX: Hide shadow VMCS right after VMCLEAR | 9.8 | 0.0016 | | | [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 | | | [CVE-2026-64017](https://patchblox.com/security/data/cve/CVE-2026-64017.md) | Urgent | blk-mq: pop cached request if it is usable | 9.8 | 0.0013 | | | [CVE-2026-68153](https://patchblox.com/security/data/cve/CVE-2026-68153.md) | Urgent | libceph: remove debugfs files before client teardown | 9.8 | 0.0013 | | | [CVE-2026-68142](https://patchblox.com/security/data/cve/CVE-2026-68142.md) | Urgent | geneve: require CAP_NET_ADMIN in the device netns for changelink | 9.8 | 0.0012 | | | [CVE-2026-74469](https://patchblox.com/security/data/cve/CVE-2026-74469.md) | High | sctp: prevent peer transport count overflow | 8.8 | 0.0147 | | | [CVE-2026-68154](https://patchblox.com/security/data/cve/CVE-2026-68154.md) | High | libceph: reject zero bucket types in crush_decode | 9.8 | 0.0071 | | | [CVE-2026-68158](https://patchblox.com/security/data/cve/CVE-2026-68158.md) | High | libceph: Fix multiplication overflow in decode_new_up_state_weight() | 9.8 | 0.0071 | | | [CVE-2026-68155](https://patchblox.com/security/data/cve/CVE-2026-68155.md) | High | libceph: Reject monmaps advertising zero monitors | 8.8 | 0.0070 | | | [CVE-2026-68157](https://patchblox.com/security/data/cve/CVE-2026-68157.md) | High | libceph: guard missing CRUSH type name lookup | 7.8 | 0.0070 | | | [CVE-2026-72253](https://patchblox.com/security/data/cve/CVE-2026-72253.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: validate skb_dst()... | 7.5 | 0.0070 | | | [CVE-2026-68156](https://patchblox.com/security/data/cve/CVE-2026-68156.md) | High | libceph: refresh auth->authorizer_buf{,_len} after authorizer update | 9.8 | 0.0069 | | | [CVE-2026-68161](https://patchblox.com/security/data/cve/CVE-2026-68161.md) | High | sctp: close UDP tunnel sockets during netns teardown | 9.8 | 0.0068 | | | [CVE-2026-72254](https://patchblox.com/security/data/cve/CVE-2026-72254.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: reject fib expression on the... | 7.5 | 0.0067 | | | [CVE-2026-80720](https://patchblox.com/security/data/cve/CVE-2026-80720.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_io... | 7.5 | 0.0061 | | | [CVE-2026-68376](https://patchblox.com/security/data/cve/CVE-2026-68376.md) | High | sctp: fix auth_hmacs array size in struct sctp_cookie | 8.1 | 0.0061 | | | [CVE-2026-68300](https://patchblox.com/security/data/cve/CVE-2026-68300.md) | High | sctp: auth: verify auth requirement when auth_chunk is NULL | 9.8 | 0.0058 | | | [CVE-2026-74480](https://patchblox.com/security/data/cve/CVE-2026-74480.md) | High | net: bridge: stop fast-leave after deleting a port group | 9.8 | 0.0058 | | | [CVE-2026-68123](https://patchblox.com/security/data/cve/CVE-2026-68123.md) | High | openvswitch: fix GSO userspace truncation underflow | 9.8 | 0.0055 | | | [CVE-2026-68136](https://patchblox.com/security/data/cve/CVE-2026-68136.md) | High | net: gro: fix double aggregation of flush-marked skbs | 9.8 | 0.0054 | | | [CVE-2026-68096](https://patchblox.com/security/data/cve/CVE-2026-68096.md) | High | audit: fix recursive locking deadlock in audit_dupe_exe() | 7.5 | 0.0053 | | | [CVE-2026-68117](https://patchblox.com/security/data/cve/CVE-2026-68117.md) | High | tipc: clear sock->sk on the failed-insert path in tipc_sk_create() | 9.8 | 0.0053 | | | [CVE-2026-74473](https://patchblox.com/security/data/cve/CVE-2026-74473.md) | High | vxlan: use pskb_network_may_pull() in route_shortcircuit() | 9.8 | 0.0053 | | | [CVE-2026-68388](https://patchblox.com/security/data/cve/CVE-2026-68388.md) | High | smb/client: handle overlapping allocated ranges in fallocate | 9.8 | 0.0051 | | | [CVE-2026-68343](https://patchblox.com/security/data/cve/CVE-2026-68343.md) | High | smb: client: validate DFS referral PathConsumed | 9.1 | 0.0051 | | | [CVE-2026-68315](https://patchblox.com/security/data/cve/CVE-2026-68315.md) | High | sctp: validate stream count in sctp_process_strreset_inreq() | 8.8 | 0.0051 | | | [CVE-2026-68299](https://patchblox.com/security/data/cve/CVE-2026-68299.md) | High | vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets | 8.8 | 0.0050 | | | [CVE-2026-68426](https://patchblox.com/security/data/cve/CVE-2026-68426.md) | High | xfrm: fix stale skb->prev after async crypto steals a GSO segment | 9.8 | 0.0050 | | | [CVE-2026-74474](https://patchblox.com/security/data/cve/CVE-2026-74474.md) | High | vxlan: use pskb_network_may_pull() for transmit path header pulls | 9.8 | 0.0049 | | | [CVE-2026-74476](https://patchblox.com/security/data/cve/CVE-2026-74476.md) | High | veth: convert frag_list skbs before running XDP | 9.1 | 0.0049 | | | [CVE-2026-63978](https://patchblox.com/security/data/cve/CVE-2026-63978.md) | High | net/handshake: Drain pending requests at net namespace exit | 9.8 | 0.0049 | | | [CVE-2026-80714](https://patchblox.com/security/data/cve/CVE-2026-80714.md) | High | ipvs: do not propagate one-packet flag to synced conns | 9.8 | 0.0048 | | | [CVE-2026-74550](https://patchblox.com/security/data/cve/CVE-2026-74550.md) | High | net: do not send ICMP/NDISC Redirects when peer allocation fails | 7.5 | 0.0048 | | | [CVE-2026-74490](https://patchblox.com/security/data/cve/CVE-2026-74490.md) | High | tipc: avoid use-after-free in poll trace queue dumps | 8.8 | 0.0046 | | | [CVE-2026-74475](https://patchblox.com/security/data/cve/CVE-2026-74475.md) | High | vxlan: use neigh_ha_snapshot() in route_shortcircuit() | 10.0 | 0.0045 | | | [CVE-2026-64523](https://patchblox.com/security/data/cve/CVE-2026-64523.md) | High | net/handshake: Take a long-lived file reference at submit | 9.8 | 0.0045 | | | [CVE-2026-80691](https://patchblox.com/security/data/cve/CVE-2026-80691.md) | High | scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE | 7.5 | 0.0044 | | | [CVE-2026-74581](https://patchblox.com/security/data/cve/CVE-2026-74581.md) | High | net: ipv6: clear suppressed fib6 rule result | 9.8 | 0.0042 | | | [CVE-2026-74580](https://patchblox.com/security/data/cve/CVE-2026-74580.md) | High | vhost: reset the vring metadata cache on vring reconfiguration | 8.8 | 0.0041 | | | [CVE-2026-68118](https://patchblox.com/security/data/cve/CVE-2026-68118.md) | High | tcp: challenge ACK for non-exact RST in SYN-RECEIVED | 8.2 | 0.0041 | | | [CVE-2026-74556](https://patchblox.com/security/data/cve/CVE-2026-74556.md) | High | scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer | 9.8 | 0.0040 | | | [CVE-2026-74569](https://patchblox.com/security/data/cve/CVE-2026-74569.md) | High | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 | | | [CVE-2026-74576](https://patchblox.com/security/data/cve/CVE-2026-74576.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free pat... | 7.5 | 0.0038 | | | [CVE-2026-68433](https://patchblox.com/security/data/cve/CVE-2026-68433.md) | High | libceph: bound get_version reply decode to front len | 8.6 | 0.0036 | | | [CVE-2026-72121](https://patchblox.com/security/data/cve/CVE-2026-72121.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and t... | 8.8 | 0.0035 | | | [CVE-2026-74572](https://patchblox.com/security/data/cve/CVE-2026-74572.md) | High | btrfs: zoned: fix deadlock between metadata writeback and transaction commit | 7.5 | 0.0035 | | | [CVE-2026-74557](https://patchblox.com/security/data/cve/CVE-2026-74557.md) | High | scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer | 7.5 | 0.0033 | | | [CVE-2026-80707](https://patchblox.com/security/data/cve/CVE-2026-80707.md) | High | can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer | 7.5 | 0.0033 | | | [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 | | | [CVE-2026-72115](https://patchblox.com/security/data/cve/CVE-2026-72115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for AN... | 8.1 | 0.0030 | | | [CVE-2026-68425](https://patchblox.com/security/data/cve/CVE-2026-68425.md) | High | IB/mad: Drop unmatched RMPP responses before reassembly | 7.1 | 0.0026 | | | [CVE-2026-68278](https://patchblox.com/security/data/cve/CVE-2026-68278.md) | High | drm/dp/mst: fix buffer overflows in sideband chunk accumulation | 8.1 | 0.0024 | | | [CVE-2026-68480](https://patchblox.com/security/data/cve/CVE-2026-68480.md) | High | x86/bugs: Make Safe-RET robust against interrupt injection | 8.8 | 0.0023 | | | [CVE-2026-68138](https://patchblox.com/security/data/cve/CVE-2026-68138.md) | High | net/sched: serialize qdisc_rtab_list against concurrent get/put | 8.8 | 0.0022 | | | [CVE-2026-68186](https://patchblox.com/security/data/cve/CVE-2026-68186.md) | High | binfmt_misc: set have_execfd only once the interpreter is opened | 7.8 | 0.0022 | | | [CVE-2026-68169](https://patchblox.com/security/data/cve/CVE-2026-68169.md) | High | mptcp: pm: userspace: fix use-after-free in get_local_id | 9.8 | 0.0021 | | | [CVE-2026-68165](https://patchblox.com/security/data/cve/CVE-2026-68165.md) | High | mm/damon/core: validate ranges in damon_set_regions() | 7.1 | 0.0021 | | | [CVE-2026-80897](https://patchblox.com/security/data/cve/CVE-2026-80897.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator prep... | n/a | 0.0021 | | | [CVE-2026-68270](https://patchblox.com/security/data/cve/CVE-2026-68270.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calcul... | n/a | 0.0021 | | | [CVE-2026-80701](https://patchblox.com/security/data/cve/CVE-2026-80701.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB c... | n/a | 0.0021 | | | [CVE-2026-80898](https://patchblox.com/security/data/cve/CVE-2026-80898.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: clear PG_private_2 on copy-to-cache appen... | n/a | 0.0021 | | | [CVE-2026-64572](https://patchblox.com/security/data/cve/CVE-2026-64572.md) | High | ipv4: fib: free fib_alias with kfree_rcu() on insert error path | 8.8 | 0.0020 | | | [CVE-2026-68162](https://patchblox.com/security/data/cve/CVE-2026-68162.md) | High | sctp: avoid auth_enable sysctl UAF during netns teardown | 8.8 | 0.0020 | | | [CVE-2026-68174](https://patchblox.com/security/data/cve/CVE-2026-68174.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcn... | n/a | 0.0020 | | | [CVE-2026-68421](https://patchblox.com/security/data/cve/CVE-2026-68421.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle... | n/a | 0.0019 | | | [CVE-2026-68255](https://patchblox.com/security/data/cve/CVE-2026-68255.md) | High | drm/virtio: bound EDID block reads to the response buffer | 7.7 | 0.0019 | | | [CVE-2026-72116](https://patchblox.com/security/data/cve/CVE-2026-72116.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device remov... | 7.1 | 0.0019 | | | [CVE-2026-68093](https://patchblox.com/security/data/cve/CVE-2026-68093.md) | High | KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug | 7.0 | 0.0019 | | | [CVE-2026-68179](https://patchblox.com/security/data/cve/CVE-2026-68179.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock erro... | 8.4 | 0.0018 | | | [CVE-2026-68387](https://patchblox.com/security/data/cve/CVE-2026-68387.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield Wi... | 7.8 | 0.0017 | | | [CVE-2026-80893](https://patchblox.com/security/data/cve/CVE-2026-80893.md) | High | mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() | 7.0 | 0.0017 | | | [CVE-2026-72175](https://patchblox.com/security/data/cve/CVE-2026-72175.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() pr... | 7.1 | 0.0017 | | | [CVE-2026-72113](https://patchblox.com/security/data/cve/CVE-2026-72113.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN fi... | 7.8 | 0.0017 | | | [CVE-2026-72114](https://patchblox.com/security/data/cve/CVE-2026-72114.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm_rx_setup(... | 7.8 | 0.0017 | | | [CVE-2026-72119](https://patchblox.com/security/data/cve/CVE-2026-72119.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and... | 7.8 | 0.0017 | | | [CVE-2026-80887](https://patchblox.com/security/data/cve/CVE-2026-80887.md) | High | drm/vmwgfx: use check_add_overflow for shader size+offset bound | 8.1 | 0.0017 | | | [CVE-2026-64563](https://patchblox.com/security/data/cve/CVE-2026-64563.md) | High | rhashtable: clear stale iter->p on table restart | 8.1 | 0.0017 | | | [CVE-2026-80687](https://patchblox.com/security/data/cve/CVE-2026-80687.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the v... | n/a | 0.0017 | | | [CVE-2026-68095](https://patchblox.com/security/data/cve/CVE-2026-68095.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and co... | n/a | 0.0017 | | | [CVE-2026-68239](https://patchblox.com/security/data/cve/CVE-2026-68239.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in tt... | n/a | 0.0017 | | | [CVE-2026-68292](https://patchblox.com/security/data/cve/CVE-2026-68292.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF V... | n/a | 0.0017 | | | [CVE-2026-74477](https://patchblox.com/security/data/cve/CVE-2026-74477.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_... | n/a | 0.0017 | | | [CVE-2026-74491](https://patchblox.com/security/data/cve/CVE-2026-74491.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_r... | n/a | 0.0017 | | | [CVE-2026-68178](https://patchblox.com/security/data/cve/CVE-2026-68178.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is op... | 7.8 | 0.0016 | | | [CVE-2026-72103](https://patchblox.com/security/data/cve/CVE-2026-72103.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring vi... | 7.3 | 0.0016 | | | [CVE-2026-72244](https://patchblox.com/security/data/cve/CVE-2026-72244.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try_harder when alignment... | 7.8 | 0.0016 | | | [CVE-2026-68416](https://patchblox.com/security/data/cve/CVE-2026-68416.md) | High | mtd: fix double free and WARN_ON in add_mtd_device() error paths | 7.8 | 0.0016 | | | [CVE-2026-68448](https://patchblox.com/security/data/cve/CVE-2026-68448.md) | High | ovl: check access to copy_file_range source with src mounter creds | 7.8 | 0.0016 | | | [CVE-2026-64575](https://patchblox.com/security/data/cve/CVE-2026-64575.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch reall... | 7.8 | 0.0016 | | | [CVE-2026-74465](https://patchblox.com/security/data/cve/CVE-2026-74465.md) | High | net: openvswitch: fix potential UAF on meter attach failure | 7.8 | 0.0015 | | | [CVE-2026-68442](https://patchblox.com/security/data/cve/CVE-2026-68442.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to sp... | 7.8 | 0.0015 | | | [CVE-2026-64283](https://patchblox.com/security/data/cve/CVE-2026-64283.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+s... | 7.0 | 0.0015 | | | [CVE-2026-68432](https://patchblox.com/security/data/cve/CVE-2026-68432.md) | High | vxlan: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-74519](https://patchblox.com/security/data/cve/CVE-2026-74519.md) | High | pinctrl: devicetree: don't free uninitialized dev_name on error path | 7.8 | 0.0015 | | | [CVE-2026-68253](https://patchblox.com/security/data/cve/CVE-2026-68253.md) | High | drm/i915/hdcp: check streams[] bounds before overflow | 7.8 | 0.0014 | | | [CVE-2026-80684](https://patchblox.com/security/data/cve/CVE-2026-80684.md) | High | KVM: s390: pci: Fix NULL dereference on AIBV allocation failure | 9.3 | 0.0014 | | | [CVE-2026-74492](https://patchblox.com/security/data/cve/CVE-2026-74492.md) | High | netfilter: ipset: do not update comments from kernel-side hash adds | 8.4 | 0.0014 | | | [CVE-2026-53090](https://patchblox.com/security/data/cve/CVE-2026-53090.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in s... | 7.8 | 0.0014 | | | [CVE-2026-68293](https://patchblox.com/security/data/cve/CVE-2026-68293.md) | High | net/mlx5: Fix MCIA register buffer overflow on 32 dword reads | 8.8 | 0.0014 | | | [CVE-2026-68128](https://patchblox.com/security/data/cve/CVE-2026-68128.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_pro... | 8.8 | 0.0014 | | | [CVE-2026-68145](https://patchblox.com/security/data/cve/CVE-2026-68145.md) | High | iomap: fix out-of-bounds bitmap_set() with zero-length range | 8.8 | 0.0014 | | | [CVE-2026-68401](https://patchblox.com/security/data/cve/CVE-2026-68401.md) | High | firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() | 7.8 | 0.0014 | | | [CVE-2026-68338](https://patchblox.com/security/data/cve/CVE-2026-68338.md) | High | net/packet: avoid fanout hook re-registration after unregister | 8.8 | 0.0014 | | | [CVE-2026-68149](https://patchblox.com/security/data/cve/CVE-2026-68149.md) | High | fs: preserve ACL_DONT_CACHE state in forget_cached_acl() | 8.4 | 0.0014 | | | [CVE-2026-74516](https://patchblox.com/security/data/cve/CVE-2026-74516.md) | High | KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active | 8.8 | 0.0014 | | | [CVE-2026-68284](https://patchblox.com/security/data/cve/CVE-2026-68284.md) | High | bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() | 7.8 | 0.0014 | | | [CVE-2026-68335](https://patchblox.com/security/data/cve/CVE-2026-68335.md) | High | rds: drop incoming messages that cross network namespace boundaries | 7.8 | 0.0014 | | | [CVE-2026-80723](https://patchblox.com/security/data/cve/CVE-2026-80723.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dyna... | 8.4 | 0.0013 | | | [CVE-2026-74481](https://patchblox.com/security/data/cve/CVE-2026-74481.md) | High | mm/page_reporting: use system_freezable_wq to fix UAF during suspend | 7.8 | 0.0013 | | | [CVE-2026-68297](https://patchblox.com/security/data/cve/CVE-2026-68297.md) | High | tipc: fix u16 MTU truncation in media and bearer MTU validation | 7.8 | 0.0013 | | | [CVE-2026-74443](https://patchblox.com/security/data/cve/CVE-2026-74443.md) | High | drm/vmwgfx: bound DMA command body size against suffix pointer | 8.8 | 0.0013 | | | [CVE-2026-68374](https://patchblox.com/security/data/cve/CVE-2026-68374.md) | High | usb: core: sysfs: add lock to bos_descriptors_read() | 7.8 | 0.0013 | | | [CVE-2026-74444](https://patchblox.com/security/data/cve/CVE-2026-74444.md) | High | drm/vmwgfx: validate DRAW_PRIMITIVES header size before division | 7.8 | 0.0013 | | | [CVE-2026-80700](https://patchblox.com/security/data/cve/CVE-2026-80700.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for... | 7.8 | 0.0013 | | | [CVE-2026-80702](https://patchblox.com/security/data/cve/CVE-2026-80702.md) | High | drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size | 7.8 | 0.0013 | | | [CVE-2026-68400](https://patchblox.com/security/data/cve/CVE-2026-68400.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access De... | 7.8 | 0.0013 | | | [CVE-2026-68320](https://patchblox.com/security/data/cve/CVE-2026-68320.md) | High | sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid | 7.5 | 0.0013 | | | [CVE-2026-68329](https://patchblox.com/security/data/cve/CVE-2026-68329.md) | High | iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() | 8.8 | 0.0013 | | | [CVE-2026-74518](https://patchblox.com/security/data/cve/CVE-2026-74518.md) | High | mm/hugetlb: fix list corruption in allocate_file_region_entries() | 8.8 | 0.0013 | | | [CVE-2026-74471](https://patchblox.com/security/data/cve/CVE-2026-74471.md) | High | tracing: Check return value of __register_event() in trace_module_add_events() | 7.8 | 0.0013 | | | [CVE-2026-74482](https://patchblox.com/security/data/cve/CVE-2026-74482.md) | High | mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios | 7.8 | 0.0013 | | | [CVE-2026-74512](https://patchblox.com/security/data/cve/CVE-2026-74512.md) | High | audit: fix potential use-after-free in audit_del_rule() | 7.8 | 0.0013 | | | [CVE-2026-74485](https://patchblox.com/security/data/cve/CVE-2026-74485.md) | High | binfmt_misc: reject a flag character as the field delimiter | 7.1 | 0.0013 | | | [CVE-2026-64567](https://patchblox.com/security/data/cve/CVE-2026-64567.md) | High | btrfs: reject free space cache with more entries than pages | 7.8 | 0.0013 | | | [CVE-2026-64580](https://patchblox.com/security/data/cve/CVE-2026-64580.md) | High | xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | 0.0013 | | | [CVE-2026-68290](https://patchblox.com/security/data/cve/CVE-2026-68290.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down... | 7.8 | 0.0013 | | | [CVE-2026-80685](https://patchblox.com/security/data/cve/CVE-2026-80685.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios... | 7.1 | 0.0012 | | | [CVE-2026-74565](https://patchblox.com/security/data/cve/CVE-2026-74565.md) | High | netfilter: nf_tables: make nft_object rhltable per table | 7.8 | 0.0012 | | | [CVE-2026-68116](https://patchblox.com/security/data/cve/CVE-2026-68116.md) | High | vxlan: mdb: Fix source list corruption on a failed replace | 7.9 | 0.0012 | | | [CVE-2026-64581](https://patchblox.com/security/data/cve/CVE-2026-64581.md) | High | xfrm: fix sk_dst_cache double-free in xfrm_user_policy() | 7.8 | 0.0012 | | | [CVE-2026-68446](https://patchblox.com/security/data/cve/CVE-2026-68446.md) | High | drm/vmwgfx: Validate vmw_surface_metadata::array_size | 7.8 | 0.0012 | | | [CVE-2026-64576](https://patchblox.com/security/data/cve/CVE-2026-64576.md) | High | nexthop: initialize extack in nh_res_bucket_migrate() | 7.1 | 0.0012 | | | [CVE-2026-74579](https://patchblox.com/security/data/cve/CVE-2026-74579.md) | High | netfilter: nft_payload: fix mask build for partial field offload | 7.1 | 0.0012 | | | [CVE-2026-74564](https://patchblox.com/security/data/cve/CVE-2026-74564.md) | High | netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH | 7.1 | 0.0012 | | | [CVE-2026-74563](https://patchblox.com/security/data/cve/CVE-2026-74563.md) | High | rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() | 7.8 | 0.0012 | | | [CVE-2026-74567](https://patchblox.com/security/data/cve/CVE-2026-74567.md) | High | keys: fix out-of-bounds read in keyring_get_key_chunk() | 7.1 | 0.0012 | | | [CVE-2026-68420](https://patchblox.com/security/data/cve/CVE-2026-68420.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outboun... | 7.1 | 0.0012 | | | [CVE-2026-68277](https://patchblox.com/security/data/cve/CVE-2026-68277.md) | Routine | drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers | 5.5 | 0.0022 | | | [CVE-2026-68184](https://patchblox.com/security/data/cve/CVE-2026-68184.md) | Routine | cdrom: fix stack out-of-bounds read in CDROMVOLCTRL | 5.5 | 0.0022 | | | [CVE-2026-68313](https://patchblox.com/security/data/cve/CVE-2026-68313.md) | Routine | tipc: fix infinite loop in __tipc_nl_compat_dumpit | 5.5 | 0.0022 | | | [CVE-2026-68322](https://patchblox.com/security/data/cve/CVE-2026-68322.md) | Routine | rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled | 5.5 | 0.0022 | | | [CVE-2026-72117](https://patchblox.com/security/data/cve/CVE-2026-72117.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx_stamp/rx_ifindex i... | 5.5 | 0.0022 | | | [CVE-2026-72118](https://patchblox.com/security/data/cve/CVE-2026-72118.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN... | 5.5 | 0.0022 | | | [CVE-2026-68164](https://patchblox.com/security/data/cve/CVE-2026-68164.md) | Routine | mm/damon/core: disallow overlapping input ranges for damon_set_regions() | 5.5 | 0.0022 | | | [CVE-2026-68422](https://patchblox.com/security/data/cve/CVE-2026-68422.md) | Routine | btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() | 5.5 | 0.0022 | | | [CVE-2026-74543](https://patchblox.com/security/data/cve/CVE-2026-74543.md) | Routine | net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() | 5.5 | 0.0021 | | | [CVE-2026-68386](https://patchblox.com/security/data/cve/CVE-2026-68386.md) | Routine | bpf, sockmap: Reject unhashed UDP sockets on sockmap update | 5.5 | 0.0021 | | | [CVE-2026-68241](https://patchblox.com/security/data/cve/CVE-2026-68241.md) | Routine | drm/i915/mst: limit DP MST ESI service loop | 4.6 | 0.0021 | | | [CVE-2026-68269](https://patchblox.com/security/data/cve/CVE-2026-68269.md) | Routine | drm/i915/gem: Add missing nospec on parallel submit slot | 5.5 | 0.0021 | | | [CVE-2026-68296](https://patchblox.com/security/data/cve/CVE-2026-68296.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels wi... | 5.5 | 0.0021 | | | [CVE-2026-68378](https://patchblox.com/security/data/cve/CVE-2026-68378.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpll_msg_a... | 5.5 | 0.0021 | | | [CVE-2026-72030](https://patchblox.com/security/data/cve/CVE-2026-72030.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent p... | 5.5 | 0.0021 | | | [CVE-2026-68396](https://patchblox.com/security/data/cve/CVE-2026-68396.md) | Routine | scsi: core: wake eh reliably when using scsi_schedule_eh | 5.5 | 0.0021 | | | [CVE-2026-68279](https://patchblox.com/security/data/cve/CVE-2026-68279.md) | Routine | drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers | 5.5 | 0.0018 | | | [CVE-2026-80888](https://patchblox.com/security/data/cve/CVE-2026-80888.md) | Routine | drm/vmwgfx: drop dma_buf reference on foreign-fd prime import | 5.5 | 0.0018 | | | [CVE-2026-80890](https://patchblox.com/security/data/cve/CVE-2026-80890.md) | Routine | sctp: reject stale cookies with mismatched verification tags | 4.8 | 0.0018 | | | [CVE-2026-45901](https://patchblox.com/security/data/cve/CVE-2026-45901.md) | Routine | netfilter: nf_tables: revert commit_mutex usage in reset path | 5.5 | 0.0018 | | | [CVE-2026-68336](https://patchblox.com/security/data/cve/CVE-2026-68336.md) | Routine | bonding: fix devconf_all NULL dereference when IPv6 is disabled | 5.5 | 0.0018 | | | [CVE-2026-74445](https://patchblox.com/security/data/cve/CVE-2026-74445.md) | Routine | drm/vmwgfx: reject DX_BIND_QUERY without a DX context | 5.5 | 0.0018 | | | [CVE-2026-74464](https://patchblox.com/security/data/cve/CVE-2026-74464.md) | Routine | net: openvswitch: fix skb leak on flow key update failure during ct | 5.5 | 0.0018 | | | [CVE-2026-74486](https://patchblox.com/security/data/cve/CVE-2026-74486.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() fo... | 5.5 | 0.0018 | | | [CVE-2026-74487](https://patchblox.com/security/data/cve/CVE-2026-74487.md) | Routine | binfmt_misc: restore write access when removing an entry | 5.5 | 0.0018 | | | [CVE-2026-80689](https://patchblox.com/security/data/cve/CVE-2026-80689.md) | Routine | tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions | 5.5 | 0.0018 | | | [CVE-2026-68150](https://patchblox.com/security/data/cve/CVE-2026-68150.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of s_... | 6.7 | 0.0018 | | | [CVE-2026-68133](https://patchblox.com/security/data/cve/CVE-2026-68133.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a... | 5.5 | 0.0018 | | | [CVE-2026-68139](https://patchblox.com/security/data/cve/CVE-2026-68139.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up... | 5.5 | 0.0018 | | | [CVE-2026-80892](https://patchblox.com/security/data/cve/CVE-2026-80892.md) | Routine | erofs: cap LZMA stream pool size | 6.7 | 0.0017 | | | [CVE-2026-68243](https://patchblox.com/security/data/cve/CVE-2026-68243.md) | Routine | drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU | 5.5 | 0.0017 | | | [CVE-2026-68244](https://patchblox.com/security/data/cve/CVE-2026-68244.md) | Routine | drm/i915/gem: Do not leak siblings[] on proto context error | 5.5 | 0.0017 | | | [CVE-2026-68247](https://patchblox.com/security/data/cve/CVE-2026-68247.md) | Routine | drm/i915/bios: range check LFP Data Block panel_type2 | 5.5 | 0.0017 | | | [CVE-2026-68248](https://patchblox.com/security/data/cve/CVE-2026-68248.md) | Routine | drm/i915: Return NULL on error in active_instance | 5.5 | 0.0017 | | | [CVE-2026-68254](https://patchblox.com/security/data/cve/CVE-2026-68254.md) | Routine | drm/i915/vrr: require valid min/max vfreq for VRR | 5.5 | 0.0017 | | | [CVE-2026-68444](https://patchblox.com/security/data/cve/CVE-2026-68444.md) | Routine | firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() | 5.5 | 0.0017 | | | [CVE-2026-64579](https://patchblox.com/security/data/cve/CVE-2026-64579.md) | Routine | xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert | 5.5 | 0.0017 | | | [CVE-2026-68429](https://patchblox.com/security/data/cve/CVE-2026-68429.md) | Routine | drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() | 5.5 | 0.0017 | | | [CVE-2026-74442](https://patchblox.com/security/data/cve/CVE-2026-74442.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkm... | 5.5 | 0.0017 | | | [CVE-2026-74484](https://patchblox.com/security/data/cve/CVE-2026-74484.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't let an 'F' entry pin its own... | 5.5 | 0.0017 | | | [CVE-2026-74559](https://patchblox.com/security/data/cve/CVE-2026-74559.md) | Routine | xsk: drain continuation descs after overflow in xsk_build_skb() | 3.3 | 0.0017 | | | [CVE-2026-68428](https://patchblox.com/security/data/cve/CVE-2026-68428.md) | Routine | KVM: x86/mmu: Fix use-after-free on vendor module reload | 5.5 | 0.0017 | | | [CVE-2026-74566](https://patchblox.com/security/data/cve/CVE-2026-74566.md) | Routine | keys: make keyring key-chunk byte order agree with keyring_diff_objects() | 5.5 | 0.0017 | | | [CVE-2026-74577](https://patchblox.com/security/data/cve/CVE-2026-74577.md) | Routine | net: mpls: initialize rtm_tos in mpls_getroute() | 5.5 | 0.0017 | | | [CVE-2026-68450](https://patchblox.com/security/data/cve/CVE-2026-68450.md) | Routine | btrfs: free mapping node on duplicate reloc root insert | 5.5 | 0.0016 | | | [CVE-2026-80901](https://patchblox.com/security/data/cve/CVE-2026-80901.md) | Routine | ipvs: fix the checksum validations | 5.3 | 0.0016 | | | [CVE-2026-45897](https://patchblox.com/security/data/cve/CVE-2026-45897.md) | Routine | netfilter: nft_counter: serialize reset with spinlock | 5.5 | 0.0016 | | | [CVE-2026-74560](https://patchblox.com/security/data/cve/CVE-2026-74560.md) | Routine | xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx | 3.3 | 0.0016 | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.