# ALAS2023-2026-2110: Security update for 18 packages ALAS2023-2026-2110, released August 31, 2026, fixes 172 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-2110 - Platform: Linux - Released: Aug 31, 2026 - Priority: Urgent (Closes CVE-2026-64564, rated Critical) - CVEs: 172, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-2110.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel-livepatch-6.12.103-127.188](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.103-127.188.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.103-127.188.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-64564](https://patchblox.com/security/data/cve/CVE-2026-64564.md) | Urgent | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 | | | [CVE-2026-68160](https://patchblox.com/security/data/cve/CVE-2026-68160.md) | Urgent | ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() | 9.8 | 0.0077 | | | [CVE-2026-68127](https://patchblox.com/security/data/cve/CVE-2026-68127.md) | Urgent | ila: reload IPv6 header after pskb_may_pull in checksum adjust | 9.8 | 0.0054 | | | [CVE-2026-68131](https://patchblox.com/security/data/cve/CVE-2026-68131.md) | Urgent | rbd: Reset positive result codes to zero in object map update path | 9.8 | 0.0052 | | | [CVE-2026-80681](https://patchblox.com/security/data/cve/CVE-2026-80681.md) | Urgent | vxlan: re-fetch eth header after route_shortcircuit() | 9.8 | 0.0050 | | | [CVE-2026-68121](https://patchblox.com/security/data/cve/CVE-2026-68121.md) | Urgent | pppoe: reload header pointer after dev_hard_header() | 9.8 | 0.0037 | | | [CVE-2026-68146](https://patchblox.com/security/data/cve/CVE-2026-68146.md) | Urgent | ftrace: Add global mutex to serialize trace_parser access | 9.8 | 0.0018 | | | [CVE-2026-68325](https://patchblox.com/security/data/cve/CVE-2026-68325.md) | Urgent | iommu/amd: Bound the early ACPI HID map | 9.8 | 0.0018 | | | [CVE-2026-80686](https://patchblox.com/security/data/cve/CVE-2026-80686.md) | Urgent | mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE | 9.8 | 0.0017 | | | [CVE-2026-64562](https://patchblox.com/security/data/cve/CVE-2026-64562.md) | Urgent | KVM: nVMX: Hide shadow VMCS right after VMCLEAR | 9.8 | 0.0016 | | | [CVE-2026-64017](https://patchblox.com/security/data/cve/CVE-2026-64017.md) | Urgent | blk-mq: pop cached request if it is usable | 9.8 | 0.0013 | | | [CVE-2026-68153](https://patchblox.com/security/data/cve/CVE-2026-68153.md) | Urgent | libceph: remove debugfs files before client teardown | 9.8 | 0.0013 | | | [CVE-2026-68142](https://patchblox.com/security/data/cve/CVE-2026-68142.md) | Urgent | geneve: require CAP_NET_ADMIN in the device netns for changelink | 9.8 | 0.0012 | | | [CVE-2026-74469](https://patchblox.com/security/data/cve/CVE-2026-74469.md) | High | sctp: prevent peer transport count overflow | 8.8 | 0.0147 | | | [CVE-2026-72299](https://patchblox.com/security/data/cve/CVE-2026-72299.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0075 | | | [CVE-2026-68154](https://patchblox.com/security/data/cve/CVE-2026-68154.md) | High | libceph: reject zero bucket types in crush_decode | 9.8 | 0.0071 | | | [CVE-2026-68158](https://patchblox.com/security/data/cve/CVE-2026-68158.md) | High | libceph: Fix multiplication overflow in decode_new_up_state_weight() | 9.8 | 0.0071 | | | [CVE-2026-72137](https://patchblox.com/security/data/cve/CVE-2026-72137.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0071 | | | [CVE-2026-68155](https://patchblox.com/security/data/cve/CVE-2026-68155.md) | High | libceph: Reject monmaps advertising zero monitors | 8.8 | 0.0070 | | | [CVE-2026-68157](https://patchblox.com/security/data/cve/CVE-2026-68157.md) | High | libceph: guard missing CRUSH type name lookup | 7.8 | 0.0070 | | | [CVE-2026-72253](https://patchblox.com/security/data/cve/CVE-2026-72253.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.5 | 0.0070 | | | [CVE-2026-68156](https://patchblox.com/security/data/cve/CVE-2026-68156.md) | High | libceph: refresh auth->authorizer_buf{,_len} after authorizer update | 9.8 | 0.0069 | | | [CVE-2026-68161](https://patchblox.com/security/data/cve/CVE-2026-68161.md) | High | sctp: close UDP tunnel sockets during netns teardown | 9.8 | 0.0068 | | | [CVE-2026-72254](https://patchblox.com/security/data/cve/CVE-2026-72254.md) | High | kernel-uek64k-modules-core: netfilter: nft_fib: reject fib expression on the netdev egress hook (Theodor Arsenij Larionov-Trichkine) | 7.5 | 0.0067 | | | [CVE-2026-68376](https://patchblox.com/security/data/cve/CVE-2026-68376.md) | High | sctp: fix auth_hmacs array size in struct sctp_cookie | 8.1 | 0.0061 | | | [CVE-2026-68300](https://patchblox.com/security/data/cve/CVE-2026-68300.md) | High | sctp: auth: verify auth requirement when auth_chunk is NULL | 9.8 | 0.0058 | | | [CVE-2026-74480](https://patchblox.com/security/data/cve/CVE-2026-74480.md) | High | net: bridge: stop fast-leave after deleting a port group | 9.8 | 0.0058 | | | [CVE-2026-68123](https://patchblox.com/security/data/cve/CVE-2026-68123.md) | High | openvswitch: fix GSO userspace truncation underflow | 9.8 | 0.0055 | | | [CVE-2026-68136](https://patchblox.com/security/data/cve/CVE-2026-68136.md) | High | net: gro: fix double aggregation of flush-marked skbs | 9.8 | 0.0054 | | | [CVE-2026-68096](https://patchblox.com/security/data/cve/CVE-2026-68096.md) | High | audit: fix recursive locking deadlock in audit_dupe_exe() | 7.5 | 0.0053 | | | [CVE-2026-68117](https://patchblox.com/security/data/cve/CVE-2026-68117.md) | High | tipc: clear sock->sk on the failed-insert path in tipc_sk_create() | 9.8 | 0.0053 | | | [CVE-2026-74473](https://patchblox.com/security/data/cve/CVE-2026-74473.md) | High | vxlan: use pskb_network_may_pull() in route_shortcircuit() | 9.8 | 0.0053 | | | [CVE-2026-68388](https://patchblox.com/security/data/cve/CVE-2026-68388.md) | High | smb/client: handle overlapping allocated ranges in fallocate | 9.8 | 0.0051 | | | [CVE-2026-68343](https://patchblox.com/security/data/cve/CVE-2026-68343.md) | High | smb: client: validate DFS referral PathConsumed | 9.1 | 0.0051 | | | [CVE-2026-68315](https://patchblox.com/security/data/cve/CVE-2026-68315.md) | High | sctp: validate stream count in sctp_process_strreset_inreq() | 8.8 | 0.0051 | | | [CVE-2026-68299](https://patchblox.com/security/data/cve/CVE-2026-68299.md) | High | vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets | 8.8 | 0.0050 | | | [CVE-2026-74476](https://patchblox.com/security/data/cve/CVE-2026-74476.md) | High | veth: convert frag_list skbs before running XDP | 9.1 | 0.0049 | | | [CVE-2026-80714](https://patchblox.com/security/data/cve/CVE-2026-80714.md) | High | ipvs: do not propagate one-packet flag to synced conns | 9.8 | 0.0048 | | | [CVE-2026-74550](https://patchblox.com/security/data/cve/CVE-2026-74550.md) | High | net: do not send ICMP/NDISC Redirects when peer allocation fails | 7.5 | 0.0048 | | | [CVE-2026-74490](https://patchblox.com/security/data/cve/CVE-2026-74490.md) | High | tipc: avoid use-after-free in poll trace queue dumps | 8.8 | 0.0046 | | | [CVE-2026-74475](https://patchblox.com/security/data/cve/CVE-2026-74475.md) | High | vxlan: use neigh_ha_snapshot() in route_shortcircuit() | 10.0 | 0.0045 | | | [CVE-2026-80691](https://patchblox.com/security/data/cve/CVE-2026-80691.md) | High | scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE | 7.5 | 0.0044 | | | [CVE-2026-74581](https://patchblox.com/security/data/cve/CVE-2026-74581.md) | High | net: ipv6: clear suppressed fib6 rule result | 9.8 | 0.0042 | | | [CVE-2026-74580](https://patchblox.com/security/data/cve/CVE-2026-74580.md) | High | vhost: reset the vring metadata cache on vring reconfiguration | 8.8 | 0.0041 | | | [CVE-2026-74556](https://patchblox.com/security/data/cve/CVE-2026-74556.md) | High | scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer | 9.8 | 0.0040 | | | [CVE-2026-74569](https://patchblox.com/security/data/cve/CVE-2026-74569.md) | High | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 | | | [CVE-2026-74576](https://patchblox.com/security/data/cve/CVE-2026-74576.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free pat... | 7.5 | 0.0038 | | | [CVE-2026-68433](https://patchblox.com/security/data/cve/CVE-2026-68433.md) | High | libceph: bound get_version reply decode to front len | 8.6 | 0.0036 | | | [CVE-2026-72121](https://patchblox.com/security/data/cve/CVE-2026-72121.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0035 | | | [CVE-2026-74572](https://patchblox.com/security/data/cve/CVE-2026-74572.md) | High | btrfs: zoned: fix deadlock between metadata writeback and transaction commit | 7.5 | 0.0035 | | | [CVE-2026-74557](https://patchblox.com/security/data/cve/CVE-2026-74557.md) | High | scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer | 7.5 | 0.0033 | | | [CVE-2026-80707](https://patchblox.com/security/data/cve/CVE-2026-80707.md) | High | can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer | 7.5 | 0.0033 | | | [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 | | | [CVE-2026-72115](https://patchblox.com/security/data/cve/CVE-2026-72115.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0030 | | | [CVE-2026-68425](https://patchblox.com/security/data/cve/CVE-2026-68425.md) | High | IB/mad: Drop unmatched RMPP responses before reassembly | 7.1 | 0.0026 | | | [CVE-2026-68278](https://patchblox.com/security/data/cve/CVE-2026-68278.md) | High | drm/dp/mst: fix buffer overflows in sideband chunk accumulation | 8.1 | 0.0024 | | | [CVE-2026-68480](https://patchblox.com/security/data/cve/CVE-2026-68480.md) | High | x86/bugs: Make Safe-RET robust against interrupt injection | 8.8 | 0.0023 | | | [CVE-2026-68138](https://patchblox.com/security/data/cve/CVE-2026-68138.md) | High | net/sched: serialize qdisc_rtab_list against concurrent get/put | 8.8 | 0.0022 | | | [CVE-2026-68186](https://patchblox.com/security/data/cve/CVE-2026-68186.md) | High | binfmt_misc: set have_execfd only once the interpreter is opened | 7.8 | 0.0022 | | | [CVE-2026-68169](https://patchblox.com/security/data/cve/CVE-2026-68169.md) | High | mptcp: pm: userspace: fix use-after-free in get_local_id | 9.8 | 0.0021 | | | [CVE-2026-68165](https://patchblox.com/security/data/cve/CVE-2026-68165.md) | High | mm/damon/core: validate ranges in damon_set_regions() | 7.1 | 0.0021 | | | [CVE-2026-64572](https://patchblox.com/security/data/cve/CVE-2026-64572.md) | High | ipv4: fib: free fib_alias with kfree_rcu() on insert error path | 8.8 | 0.0020 | | | [CVE-2026-68162](https://patchblox.com/security/data/cve/CVE-2026-68162.md) | High | sctp: avoid auth_enable sysctl UAF during netns teardown | 8.8 | 0.0020 | | | [CVE-2026-68255](https://patchblox.com/security/data/cve/CVE-2026-68255.md) | High | drm/virtio: bound EDID block reads to the response buffer | 7.7 | 0.0019 | | | [CVE-2026-72116](https://patchblox.com/security/data/cve/CVE-2026-72116.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0019 | | | [CVE-2026-68093](https://patchblox.com/security/data/cve/CVE-2026-68093.md) | High | KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug | 7.0 | 0.0019 | | | [CVE-2026-68179](https://patchblox.com/security/data/cve/CVE-2026-68179.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock erro... | 8.4 | 0.0018 | | | [CVE-2026-72111](https://patchblox.com/security/data/cve/CVE-2026-72111.md) | High | kernel-uek64k-modules-core: bpf: Reset register bounds before narrowing retval range in check_mem_access() (Tristan Madani) | 8.8 | 0.0018 | | | [CVE-2026-74344](https://patchblox.com/security/data/cve/CVE-2026-74344.md) | High | bpf: Clear rb node linkage when freeing bpf_rb_root | 7.8 | 0.0018 | | | [CVE-2026-72183](https://patchblox.com/security/data/cve/CVE-2026-72183.md) | High | kernel-uek64k-modules-core: landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path (Bryam Vargas) | 8.4 | 0.0017 | | | [CVE-2026-80893](https://patchblox.com/security/data/cve/CVE-2026-80893.md) | High | mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() | 7.0 | 0.0017 | | | [CVE-2026-72175](https://patchblox.com/security/data/cve/CVE-2026-72175.md) | High | kernel-uek64k-modules-core: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race (Kiryl Shutsemau) | 7.1 | 0.0017 | | | [CVE-2026-72113](https://patchblox.com/security/data/cve/CVE-2026-72113.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72114](https://patchblox.com/security/data/cve/CVE-2026-72114.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72119](https://patchblox.com/security/data/cve/CVE-2026-72119.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-80887](https://patchblox.com/security/data/cve/CVE-2026-80887.md) | High | drm/vmwgfx: use check_add_overflow for shader size+offset bound | 8.1 | 0.0017 | | | [CVE-2026-64563](https://patchblox.com/security/data/cve/CVE-2026-64563.md) | High | rhashtable: clear stale iter->p on table restart | 8.1 | 0.0017 | | | [CVE-2026-68178](https://patchblox.com/security/data/cve/CVE-2026-68178.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is op... | 7.8 | 0.0016 | | | [CVE-2026-72103](https://patchblox.com/security/data/cve/CVE-2026-72103.md) | High | kernel-uek64k-modules-core: dm: avoid leaking the caller's thread keyring via the table device file (Ingo Blechschmidt) | 7.3 | 0.0016 | | | [CVE-2026-72213](https://patchblox.com/security/data/cve/CVE-2026-72213.md) | High | kernel-uek64k-modules-core: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (Deepanshu Kartikey) | 7.1 | 0.0016 | | | [CVE-2026-72244](https://patchblox.com/security/data/cve/CVE-2026-72244.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-68416](https://patchblox.com/security/data/cve/CVE-2026-68416.md) | High | mtd: fix double free and WARN_ON in add_mtd_device() error paths | 7.8 | 0.0016 | | | [CVE-2026-74465](https://patchblox.com/security/data/cve/CVE-2026-74465.md) | High | net: openvswitch: fix potential UAF on meter attach failure | 7.8 | 0.0015 | | | [CVE-2026-68442](https://patchblox.com/security/data/cve/CVE-2026-68442.md) | High | kernel-uek64k-modules-core: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (Leo Martins) | 7.8 | 0.0015 | | | [CVE-2026-72051](https://patchblox.com/security/data/cve/CVE-2026-72051.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0015 | | | [CVE-2026-68432](https://patchblox.com/security/data/cve/CVE-2026-68432.md) | High | vxlan: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-74519](https://patchblox.com/security/data/cve/CVE-2026-74519.md) | High | pinctrl: devicetree: don't free uninitialized dev_name on error path | 7.8 | 0.0015 | | | [CVE-2026-68253](https://patchblox.com/security/data/cve/CVE-2026-68253.md) | High | drm/i915/hdcp: check streams[] bounds before overflow | 7.8 | 0.0014 | | | [CVE-2026-80684](https://patchblox.com/security/data/cve/CVE-2026-80684.md) | High | KVM: s390: pci: Fix NULL dereference on AIBV allocation failure | 9.3 | 0.0014 | | | [CVE-2026-74492](https://patchblox.com/security/data/cve/CVE-2026-74492.md) | High | netfilter: ipset: do not update comments from kernel-side hash adds | 8.4 | 0.0014 | | | [CVE-2026-53090](https://patchblox.com/security/data/cve/CVE-2026-53090.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in s... | 7.8 | 0.0014 | | | [CVE-2026-68293](https://patchblox.com/security/data/cve/CVE-2026-68293.md) | High | net/mlx5: Fix MCIA register buffer overflow on 32 dword reads | 8.8 | 0.0014 | | | [CVE-2026-68128](https://patchblox.com/security/data/cve/CVE-2026-68128.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_pro... | 8.8 | 0.0014 | | | [CVE-2026-68145](https://patchblox.com/security/data/cve/CVE-2026-68145.md) | High | iomap: fix out-of-bounds bitmap_set() with zero-length range | 8.8 | 0.0014 | | | [CVE-2026-68338](https://patchblox.com/security/data/cve/CVE-2026-68338.md) | High | net/packet: avoid fanout hook re-registration after unregister | 8.8 | 0.0014 | | | [CVE-2026-68149](https://patchblox.com/security/data/cve/CVE-2026-68149.md) | High | fs: preserve ACL_DONT_CACHE state in forget_cached_acl() | 8.4 | 0.0014 | | | [CVE-2026-74516](https://patchblox.com/security/data/cve/CVE-2026-74516.md) | High | KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active | 8.8 | 0.0014 | | | [CVE-2026-68284](https://patchblox.com/security/data/cve/CVE-2026-68284.md) | High | bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() | 7.8 | 0.0014 | | | [CVE-2026-68335](https://patchblox.com/security/data/cve/CVE-2026-68335.md) | High | rds: drop incoming messages that cross network namespace boundaries | 7.8 | 0.0014 | | | [CVE-2026-80723](https://patchblox.com/security/data/cve/CVE-2026-80723.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0013 | | | [CVE-2026-74481](https://patchblox.com/security/data/cve/CVE-2026-74481.md) | High | mm/page_reporting: use system_freezable_wq to fix UAF during suspend | 7.8 | 0.0013 | | | [CVE-2026-68297](https://patchblox.com/security/data/cve/CVE-2026-68297.md) | High | tipc: fix u16 MTU truncation in media and bearer MTU validation | 7.8 | 0.0013 | | | [CVE-2026-74443](https://patchblox.com/security/data/cve/CVE-2026-74443.md) | High | drm/vmwgfx: bound DMA command body size against suffix pointer | 8.8 | 0.0013 | | | [CVE-2026-68374](https://patchblox.com/security/data/cve/CVE-2026-68374.md) | High | usb: core: sysfs: add lock to bos_descriptors_read() | 7.8 | 0.0013 | | | [CVE-2026-74444](https://patchblox.com/security/data/cve/CVE-2026-74444.md) | High | drm/vmwgfx: validate DRAW_PRIMITIVES header size before division | 7.8 | 0.0013 | | | [CVE-2026-80700](https://patchblox.com/security/data/cve/CVE-2026-80700.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0013 | | | [CVE-2026-80702](https://patchblox.com/security/data/cve/CVE-2026-80702.md) | High | drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size | 7.8 | 0.0013 | | | [CVE-2026-68320](https://patchblox.com/security/data/cve/CVE-2026-68320.md) | High | sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid | 7.5 | 0.0013 | | | [CVE-2026-68329](https://patchblox.com/security/data/cve/CVE-2026-68329.md) | High | iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() | 8.8 | 0.0013 | | | [CVE-2026-74518](https://patchblox.com/security/data/cve/CVE-2026-74518.md) | High | mm/hugetlb: fix list corruption in allocate_file_region_entries() | 8.8 | 0.0013 | | | [CVE-2026-74471](https://patchblox.com/security/data/cve/CVE-2026-74471.md) | High | tracing: Check return value of __register_event() in trace_module_add_events() | 7.8 | 0.0013 | | | [CVE-2026-74482](https://patchblox.com/security/data/cve/CVE-2026-74482.md) | High | mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios | 7.8 | 0.0013 | | | [CVE-2026-74512](https://patchblox.com/security/data/cve/CVE-2026-74512.md) | High | audit: fix potential use-after-free in audit_del_rule() | 7.8 | 0.0013 | | | [CVE-2026-74485](https://patchblox.com/security/data/cve/CVE-2026-74485.md) | High | binfmt_misc: reject a flag character as the field delimiter | 7.1 | 0.0013 | | | [CVE-2026-64567](https://patchblox.com/security/data/cve/CVE-2026-64567.md) | High | btrfs: reject free space cache with more entries than pages | 7.8 | 0.0013 | | | [CVE-2026-64580](https://patchblox.com/security/data/cve/CVE-2026-64580.md) | High | xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | 0.0013 | | | [CVE-2026-68290](https://patchblox.com/security/data/cve/CVE-2026-68290.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down... | 7.8 | 0.0013 | | | [CVE-2026-74565](https://patchblox.com/security/data/cve/CVE-2026-74565.md) | High | netfilter: nf_tables: make nft_object rhltable per table | 7.8 | 0.0012 | | | [CVE-2026-68116](https://patchblox.com/security/data/cve/CVE-2026-68116.md) | High | vxlan: mdb: Fix source list corruption on a failed replace | 7.9 | 0.0012 | | | [CVE-2026-64581](https://patchblox.com/security/data/cve/CVE-2026-64581.md) | High | xfrm: fix sk_dst_cache double-free in xfrm_user_policy() | 7.8 | 0.0012 | | | [CVE-2026-68446](https://patchblox.com/security/data/cve/CVE-2026-68446.md) | High | drm/vmwgfx: Validate vmw_surface_metadata::array_size | 7.8 | 0.0012 | | | [CVE-2026-64576](https://patchblox.com/security/data/cve/CVE-2026-64576.md) | High | nexthop: initialize extack in nh_res_bucket_migrate() | 7.1 | 0.0012 | | | [CVE-2026-74579](https://patchblox.com/security/data/cve/CVE-2026-74579.md) | High | netfilter: nft_payload: fix mask build for partial field offload | 7.1 | 0.0012 | | | [CVE-2026-74564](https://patchblox.com/security/data/cve/CVE-2026-74564.md) | High | netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH | 7.1 | 0.0012 | | | [CVE-2026-74563](https://patchblox.com/security/data/cve/CVE-2026-74563.md) | High | rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() | 7.8 | 0.0012 | | | [CVE-2026-74567](https://patchblox.com/security/data/cve/CVE-2026-74567.md) | High | keys: fix out-of-bounds read in keyring_get_key_chunk() | 7.1 | 0.0012 | | | [CVE-2026-68277](https://patchblox.com/security/data/cve/CVE-2026-68277.md) | Routine | drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers | 5.5 | 0.0022 | | | [CVE-2026-68184](https://patchblox.com/security/data/cve/CVE-2026-68184.md) | Routine | cdrom: fix stack out-of-bounds read in CDROMVOLCTRL | 5.5 | 0.0022 | | | [CVE-2026-68313](https://patchblox.com/security/data/cve/CVE-2026-68313.md) | Routine | tipc: fix infinite loop in __tipc_nl_compat_dumpit | 5.5 | 0.0022 | | | [CVE-2026-68322](https://patchblox.com/security/data/cve/CVE-2026-68322.md) | Routine | rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled | 5.5 | 0.0022 | | | [CVE-2026-72117](https://patchblox.com/security/data/cve/CVE-2026-72117.md) | Routine | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0022 | | | [CVE-2026-72118](https://patchblox.com/security/data/cve/CVE-2026-72118.md) | Routine | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0022 | | | [CVE-2026-68164](https://patchblox.com/security/data/cve/CVE-2026-68164.md) | Routine | mm/damon/core: disallow overlapping input ranges for damon_set_regions() | 5.5 | 0.0022 | | | [CVE-2026-68422](https://patchblox.com/security/data/cve/CVE-2026-68422.md) | Routine | btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() | 5.5 | 0.0022 | | | [CVE-2026-74543](https://patchblox.com/security/data/cve/CVE-2026-74543.md) | Routine | net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() | 5.5 | 0.0021 | | | [CVE-2026-68386](https://patchblox.com/security/data/cve/CVE-2026-68386.md) | Routine | bpf, sockmap: Reject unhashed UDP sockets on sockmap update | 5.5 | 0.0021 | | | [CVE-2026-72040](https://patchblox.com/security/data/cve/CVE-2026-72040.md) | Routine | kernel-uek64k-modules-core: ipmi: fix refcount leak in i_ipmi_request() (Wentao Liang) | 5.5 | 0.0021 | | | [CVE-2026-68269](https://patchblox.com/security/data/cve/CVE-2026-68269.md) | Routine | drm/i915/gem: Add missing nospec on parallel submit slot | 5.5 | 0.0021 | | | [CVE-2026-68296](https://patchblox.com/security/data/cve/CVE-2026-68296.md) | Routine | kernel-uek64k-modules-core: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (Yun Zhou) | 5.5 | 0.0021 | | | [CVE-2026-72030](https://patchblox.com/security/data/cve/CVE-2026-72030.md) | Routine | kernel-uek64k-modules-core: ata: libata-core: Reject an invalid concurrent positioning ranges count (Bryam Vargas) | 5.5 | 0.0021 | | | [CVE-2026-72032](https://patchblox.com/security/data/cve/CVE-2026-72032.md) | Routine | kernel-uek64k-modules-core: net/mlx5: HWS, fix matcher leak on resize target setup failure (Dawei Feng) | 5.5 | 0.0021 | | | [CVE-2026-68396](https://patchblox.com/security/data/cve/CVE-2026-68396.md) | Routine | scsi: core: wake eh reliably when using scsi_schedule_eh | 5.5 | 0.0021 | | | [CVE-2026-72101](https://patchblox.com/security/data/cve/CVE-2026-72101.md) | Routine | kernel-uek64k-modules-core: dm-integrity: fix leaking uninitialized kernel memory (Mikulas Patocka) | 5.5 | 0.0020 | | | [CVE-2026-68279](https://patchblox.com/security/data/cve/CVE-2026-68279.md) | Routine | drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers | 5.5 | 0.0018 | | | [CVE-2026-80888](https://patchblox.com/security/data/cve/CVE-2026-80888.md) | Routine | drm/vmwgfx: drop dma_buf reference on foreign-fd prime import | 5.5 | 0.0018 | | | [CVE-2026-80890](https://patchblox.com/security/data/cve/CVE-2026-80890.md) | Routine | sctp: reject stale cookies with mismatched verification tags | 4.8 | 0.0018 | | | [CVE-2026-45901](https://patchblox.com/security/data/cve/CVE-2026-45901.md) | Routine | netfilter: nf_tables: revert commit_mutex usage in reset path | 5.5 | 0.0018 | | | [CVE-2026-68336](https://patchblox.com/security/data/cve/CVE-2026-68336.md) | Routine | bonding: fix devconf_all NULL dereference when IPv6 is disabled | 5.5 | 0.0018 | | | [CVE-2026-74445](https://patchblox.com/security/data/cve/CVE-2026-74445.md) | Routine | drm/vmwgfx: reject DX_BIND_QUERY without a DX context | 5.5 | 0.0018 | | | [CVE-2026-74464](https://patchblox.com/security/data/cve/CVE-2026-74464.md) | Routine | net: openvswitch: fix skb leak on flow key update failure during ct | 5.5 | 0.0018 | | | [CVE-2026-80689](https://patchblox.com/security/data/cve/CVE-2026-80689.md) | Routine | tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions | 5.5 | 0.0018 | | | [CVE-2026-68133](https://patchblox.com/security/data/cve/CVE-2026-68133.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a... | 5.5 | 0.0018 | | | [CVE-2026-68139](https://patchblox.com/security/data/cve/CVE-2026-68139.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up... | 5.5 | 0.0018 | | | [CVE-2026-80892](https://patchblox.com/security/data/cve/CVE-2026-80892.md) | Routine | erofs: cap LZMA stream pool size | 6.7 | 0.0017 | | | [CVE-2026-68243](https://patchblox.com/security/data/cve/CVE-2026-68243.md) | Routine | drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU | 5.5 | 0.0017 | | | [CVE-2026-68244](https://patchblox.com/security/data/cve/CVE-2026-68244.md) | Routine | drm/i915/gem: Do not leak siblings[] on proto context error | 5.5 | 0.0017 | | | [CVE-2026-68247](https://patchblox.com/security/data/cve/CVE-2026-68247.md) | Routine | drm/i915/bios: range check LFP Data Block panel_type2 | 5.5 | 0.0017 | | | [CVE-2026-68248](https://patchblox.com/security/data/cve/CVE-2026-68248.md) | Routine | drm/i915: Return NULL on error in active_instance | 5.5 | 0.0017 | | | [CVE-2026-68254](https://patchblox.com/security/data/cve/CVE-2026-68254.md) | Routine | drm/i915/vrr: require valid min/max vfreq for VRR | 5.5 | 0.0017 | | | [CVE-2026-68444](https://patchblox.com/security/data/cve/CVE-2026-68444.md) | Routine | firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() | 5.5 | 0.0017 | | | [CVE-2026-64579](https://patchblox.com/security/data/cve/CVE-2026-64579.md) | Routine | xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert | 5.5 | 0.0017 | | | [CVE-2026-68429](https://patchblox.com/security/data/cve/CVE-2026-68429.md) | Routine | drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() | 5.5 | 0.0017 | | | [CVE-2026-74442](https://patchblox.com/security/data/cve/CVE-2026-74442.md) | Routine | kernel-uek64k-modules-core: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (Zack Rusin) | 5.5 | 0.0017 | | | [CVE-2026-74484](https://patchblox.com/security/data/cve/CVE-2026-74484.md) | Routine | kernel-uek64k-modules-core: binfmt_misc: don't let an 'F' entry pin its own instance (Christian Brauner) | 5.5 | 0.0017 | | | [CVE-2026-68428](https://patchblox.com/security/data/cve/CVE-2026-68428.md) | Routine | KVM: x86/mmu: Fix use-after-free on vendor module reload | 5.5 | 0.0017 | | | [CVE-2026-74566](https://patchblox.com/security/data/cve/CVE-2026-74566.md) | Routine | keys: make keyring key-chunk byte order agree with keyring_diff_objects() | 5.5 | 0.0017 | | | [CVE-2026-74577](https://patchblox.com/security/data/cve/CVE-2026-74577.md) | Routine | net: mpls: initialize rtm_tos in mpls_getroute() | 5.5 | 0.0017 | | | [CVE-2026-68450](https://patchblox.com/security/data/cve/CVE-2026-68450.md) | Routine | btrfs: free mapping node on duplicate reloc root insert | 5.5 | 0.0016 | | | [CVE-2026-80901](https://patchblox.com/security/data/cve/CVE-2026-80901.md) | Routine | ipvs: fix the checksum validations | 5.3 | 0.0016 | | | [CVE-2026-45897](https://patchblox.com/security/data/cve/CVE-2026-45897.md) | Routine | netfilter: nft_counter: serialize reset with spinlock | 5.5 | 0.0016 | | | [CVE-2026-64290](https://patchblox.com/security/data/cve/CVE-2026-64290.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fa... | 5.5 | 0.0016 | | | [CVE-2026-64205](https://patchblox.com/security/data/cve/CVE-2026-64205.md) | Routine | i2c: i801: fix hardware state machine corruption in error path | 5.5 | 0.0013 | | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.