# ALAS2023-2026-3139: Security update for 19 packages ALAS2023-2026-3139, released September 28, 2026, fixes 150 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3139 - Platform: Linux - Released: Sep 28, 2026 - Priority: Urgent (Closes CVE-2026-80557, rated Critical) - CVEs: 150, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3139.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel-livepatch-6.18.48-107.148](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.48-107.148.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | | [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.48-107.148.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-80557](https://patchblox.com/security/data/cve/CVE-2026-80557.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via m... | 9.8 | 0.0053 | | | [CVE-2026-80725](https://patchblox.com/security/data/cve/CVE-2026-80725.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation... | 9.8 | 0.0046 | | | [CVE-2026-74591](https://patchblox.com/security/data/cve/CVE-2026-74591.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index... | 9.8 | 0.0044 | | | [CVE-2026-74665](https://patchblox.com/security/data/cve/CVE-2026-74665.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP... | 9.1 | 0.0037 | | | [CVE-2026-74517](https://patchblox.com/security/data/cve/CVE-2026-74517.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling b... | 9.3 | 0.0014 | | | [CVE-2026-68159](https://patchblox.com/security/data/cve/CVE-2026-68159.md) | High | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 | | | [CVE-2026-97557](https://patchblox.com/security/data/cve/CVE-2026-97557.md) | High | smb: client: avoid leaking refcount in cifs_queue_oplock_break() | 7.5 | 0.0070 | | | [CVE-2026-80590](https://patchblox.com/security/data/cve/CVE-2026-80590.md) | High | inet: frags: strip GSO state from fragments before reassembly | 8.8 | 0.0058 | | | [CVE-2026-74597](https://patchblox.com/security/data/cve/CVE-2026-74597.md) | High | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() | 9.8 | 0.0054 | | | [CVE-2026-74743](https://patchblox.com/security/data/cve/CVE-2026-74743.md) | High | macvlan: inherit needed_headroom and needed_tailroom from lowerdev | 9.8 | 0.0054 | | | [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 | | | [CVE-2026-80587](https://patchblox.com/security/data/cve/CVE-2026-80587.md) | High | mptcp: avoid combining some incoming suboptions | 9.8 | 0.0052 | | | [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 | | | [CVE-2026-74669](https://patchblox.com/security/data/cve/CVE-2026-74669.md) | High | ipvs: clear IPv4 options after rebasing tunnel ICMP errors | 9.8 | 0.0051 | | | [CVE-2026-80528](https://patchblox.com/security/data/cve/CVE-2026-80528.md) | High | ceph: avoid fs reclaim while using current->journal_info | 9.8 | 0.0051 | | | [CVE-2026-80558](https://patchblox.com/security/data/cve/CVE-2026-80558.md) | High | libceph: Avoid using invalid osd indices from primary_temp | 9.8 | 0.0051 | | | [CVE-2026-80561](https://patchblox.com/security/data/cve/CVE-2026-80561.md) | High | libceph: fix multiple unsafe decodes in decode_locker() | 9.8 | 0.0051 | | | [CVE-2026-74616](https://patchblox.com/security/data/cve/CVE-2026-74616.md) | High | xdp: reject clones that overrun skb_shared_info tailroom | 9.8 | 0.0051 | | | [CVE-2026-74744](https://patchblox.com/security/data/cve/CVE-2026-74744.md) | High | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev | 9.8 | 0.0051 | | | [CVE-2026-74730](https://patchblox.com/security/data/cve/CVE-2026-74730.md) | High | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call | 9.8 | 0.0051 | | | [CVE-2026-80527](https://patchblox.com/security/data/cve/CVE-2026-80527.md) | High | ceph: fix hanging __ceph_get_caps() with stale mds_wanted | 7.8 | 0.0050 | | | [CVE-2026-74717](https://patchblox.com/security/data/cve/CVE-2026-74717.md) | High | net/mlx5: fw_tracer, return NULL on create error | 7.5 | 0.0050 | | | [CVE-2026-74705](https://patchblox.com/security/data/cve/CVE-2026-74705.md) | High | udp: fix potential use-after-free in tunnel segmentation | 10.0 | 0.0050 | | | [CVE-2026-74586](https://patchblox.com/security/data/cve/CVE-2026-74586.md) | High | sctp: clear new_transport when removing a peer | 9.8 | 0.0050 | | | [CVE-2026-74587](https://patchblox.com/security/data/cve/CVE-2026-74587.md) | High | sctp: fix use-after-free of cached ASCONF chunk | 9.8 | 0.0050 | | | [CVE-2026-74588](https://patchblox.com/security/data/cve/CVE-2026-74588.md) | High | sctp: keep chunk->transport in step with the list it is queued on | 9.8 | 0.0050 | | | [CVE-2026-74688](https://patchblox.com/security/data/cve/CVE-2026-74688.md) | High | sctp: clear control chunk transport if it is being removed | 9.8 | 0.0050 | | | [CVE-2026-68082](https://patchblox.com/security/data/cve/CVE-2026-68082.md) | High | libceph: fix two unsafe bare decodes in decode_lockers() | 9.8 | 0.0050 | | | [CVE-2026-74612](https://patchblox.com/security/data/cve/CVE-2026-74612.md) | High | veth: fix skb length accounting after XDP frag adjustment | 10.0 | 0.0049 | | | [CVE-2026-74611](https://patchblox.com/security/data/cve/CVE-2026-74611.md) | High | tls: rx: restore msg_iter before TLS 1.3 optimistic retry | 9.8 | 0.0049 | | | [CVE-2026-74696](https://patchblox.com/security/data/cve/CVE-2026-74696.md) | High | tcp: fix TFO max_qlen accounting across reuseport migration | 7.5 | 0.0049 | | | [CVE-2026-74624](https://patchblox.com/security/data/cve/CVE-2026-74624.md) | High | netfilter: nf_conntrack: defer invalid log until after unlock | 7.5 | 0.0048 | | | [CVE-2026-74695](https://patchblox.com/security/data/cve/CVE-2026-74695.md) | High | netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() | 7.5 | 0.0048 | | | [CVE-2026-74608](https://patchblox.com/security/data/cve/CVE-2026-74608.md) | High | smb: client: Fix use-after-free in cifs_try_adding_channels() | 9.8 | 0.0048 | | | [CVE-2026-74742](https://patchblox.com/security/data/cve/CVE-2026-74742.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq... | 7.5 | 0.0046 | | | [CVE-2026-74704](https://patchblox.com/security/data/cve/CVE-2026-74704.md) | High | net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter | 8.2 | 0.0044 | | | [CVE-2026-74598](https://patchblox.com/security/data/cve/CVE-2026-74598.md) | High | ipv6: fix Route Information option length validation | 7.5 | 0.0043 | | | [CVE-2026-80586](https://patchblox.com/security/data/cve/CVE-2026-80586.md) | High | mptcp: options: reset DSS fields in case of unexpected size | 9.8 | 0.0040 | | | [CVE-2026-80589](https://patchblox.com/security/data/cve/CVE-2026-80589.md) | High | block: stop the timeout timer when releasing a never added disk | 9.8 | 0.0037 | | | [CVE-2026-74592](https://patchblox.com/security/data/cve/CVE-2026-74592.md) | High | ima: Instantiate file_truncate and path_truncate hooks | 8.1 | 0.0034 | | | [CVE-2026-80588](https://patchblox.com/security/data/cve/CVE-2026-80588.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX pa... | 7.5 | 0.0034 | | | [CVE-2026-80585](https://patchblox.com/security/data/cve/CVE-2026-80585.md) | High | mptcp: fastopen: only mark MPTFO subflows with SYN data | 9.4 | 0.0031 | | | [CVE-2026-80777](https://patchblox.com/security/data/cve/CVE-2026-80777.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec() race The ch... | n/a | 0.0021 | | | [CVE-2026-80810](https://patchblox.com/security/data/cve/CVE-2026-80810.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec... | n/a | 0.0021 | | | [CVE-2026-80818](https://patchblox.com/security/data/cve/CVE-2026-80818.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-fre... | n/a | 0.0021 | | | [CVE-2026-80792](https://patchblox.com/security/data/cve/CVE-2026-80792.md) | High | ipv6: fix use-after-free in ip6_finish_output2() | 8.1 | 0.0020 | | | [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 | | | [CVE-2026-80775](https://patchblox.com/security/data/cve/CVE-2026-80775.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.r... | 7.0 | 0.0019 | | | [CVE-2026-74672](https://patchblox.com/security/data/cve/CVE-2026-74672.md) | High | mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF | 7.0 | 0.0018 | | | [CVE-2026-80724](https://patchblox.com/security/data/cve/CVE-2026-80724.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from be... | 8.8 | 0.0018 | | | [CVE-2026-74728](https://patchblox.com/security/data/cve/CVE-2026-74728.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xf... | n/a | 0.0017 | | | [CVE-2026-80758](https://patchblox.com/security/data/cve/CVE-2026-80758.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on fina... | n/a | 0.0017 | | | [CVE-2026-80778](https://patchblox.com/security/data/cve/CVE-2026-80778.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners... | n/a | 0.0017 | | | [CVE-2026-74709](https://patchblox.com/security/data/cve/CVE-2026-74709.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is... | n/a | 0.0017 | | | [CVE-2026-74593](https://patchblox.com/security/data/cve/CVE-2026-74593.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Take cgroup_lock() first in scx_cgrou... | n/a | 0.0017 | | | [CVE-2026-74633](https://patchblox.com/security/data/cve/CVE-2026-74633.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module... | n/a | 0.0017 | | | [CVE-2026-74698](https://patchblox.com/security/data/cve/CVE-2026-74698.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation ml... | n/a | 0.0017 | | | [CVE-2026-80776](https://patchblox.com/security/data/cve/CVE-2026-80776.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futex_pivot_pending() during... | n/a | 0.0017 | | | [CVE-2026-80904](https://patchblox.com/security/data/cve/CVE-2026-80904.md) | High | net/tls: Fail tls_sw_splice_read() after a failed async decrypt | 7.8 | 0.0016 | | | [CVE-2026-74684](https://patchblox.com/security/data/cve/CVE-2026-74684.md) | High | net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() | 7.1 | 0.0015 | | | [CVE-2026-74614](https://patchblox.com/security/data/cve/CVE-2026-74614.md) | High | vsock/virtio: read virtqueues under worker locks | 8.4 | 0.0014 | | | [CVE-2026-80536](https://patchblox.com/security/data/cve/CVE-2026-80536.md) | High | xfs: bounds-check buffer log item's dirty bitmap | 8.4 | 0.0014 | | | [CVE-2026-80731](https://patchblox.com/security/data/cve/CVE-2026-80731.md) | High | net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header | 7.8 | 0.0014 | | | [CVE-2026-74739](https://patchblox.com/security/data/cve/CVE-2026-74739.md) | High | net/sched: cls_u32: skip hash tables in u32_bind_class() | 7.8 | 0.0014 | | | [CVE-2026-74748](https://patchblox.com/security/data/cve/CVE-2026-74748.md) | High | netfilter: ipset: fix refcount race between list:set GC and swap | 7.8 | 0.0014 | | | [CVE-2026-74589](https://patchblox.com/security/data/cve/CVE-2026-74589.md) | High | bpf, sockmap: Fix sk_redir use-after-free in send verdict | 8.4 | 0.0014 | | | [CVE-2026-74736](https://patchblox.com/security/data/cve/CVE-2026-74736.md) | High | net/sched: cls_bpf: reject dev-bound programs bound to a different device | 7.8 | 0.0014 | | | [CVE-2026-74601](https://patchblox.com/security/data/cve/CVE-2026-74601.md) | High | ring-buffer: Use current_context for safe per-CPU buffer swap | 7.8 | 0.0014 | | | [CVE-2026-74667](https://patchblox.com/security/data/cve/CVE-2026-74667.md) | High | net/packet: reset the MAC header on the packet-socket transmit path | 7.8 | 0.0014 | | | [CVE-2026-74707](https://patchblox.com/security/data/cve/CVE-2026-74707.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests... | 7.8 | 0.0014 | | | [CVE-2026-80530](https://patchblox.com/security/data/cve/CVE-2026-80530.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing is... | 7.8 | 0.0013 | | | [CVE-2026-80574](https://patchblox.com/security/data/cve/CVE-2026-80574.md) | High | Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet | 8.4 | 0.0013 | | | [CVE-2026-74701](https://patchblox.com/security/data/cve/CVE-2026-74701.md) | High | net/openvswitch: check Ethernet header length in key_extract() | 7.8 | 0.0013 | | | [CVE-2026-74753](https://patchblox.com/security/data/cve/CVE-2026-74753.md) | High | perf: Reject exited events as group leaders | 8.8 | 0.0013 | | | [CVE-2026-74594](https://patchblox.com/security/data/cve/CVE-2026-74594.md) | High | sched/psi: Shut down rtpoll_timer in psi_cgroup_free() | 7.8 | 0.0013 | | | [CVE-2026-74610](https://patchblox.com/security/data/cve/CVE-2026-74610.md) | High | tls: don't leave a full plaintext sk_msg ring unpushed | 7.8 | 0.0013 | | | [CVE-2026-74632](https://patchblox.com/security/data/cve/CVE-2026-74632.md) | High | mm/huge_memory: fix huge_zero_pfn race | 7.8 | 0.0013 | | | [CVE-2026-74635](https://patchblox.com/security/data/cve/CVE-2026-74635.md) | High | fbdev: bitblit: bound-check glyph index in bit_cursor() | 7.8 | 0.0013 | | | [CVE-2026-74663](https://patchblox.com/security/data/cve/CVE-2026-74663.md) | High | net/sched: reject overly deep qdisc hierarchies | 7.8 | 0.0013 | | | [CVE-2026-74666](https://patchblox.com/security/data/cve/CVE-2026-74666.md) | High | packet: synchronize pressure clearing with ring reconfiguration | 7.8 | 0.0013 | | | [CVE-2026-74668](https://patchblox.com/security/data/cve/CVE-2026-74668.md) | High | packet: use consistent hard_header_len in TX_RING send path | 7.8 | 0.0013 | | | [CVE-2026-74670](https://patchblox.com/security/data/cve/CVE-2026-74670.md) | High | ipvs: stop estimator after disabled calc phase | 7.8 | 0.0013 | | | [CVE-2026-74675](https://patchblox.com/security/data/cve/CVE-2026-74675.md) | High | vt: stabilize tty reference in kbd_keycode with tty_port_tty_get | 7.8 | 0.0013 | | | [CVE-2026-74710](https://patchblox.com/security/data/cve/CVE-2026-74710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata A... | 7.8 | 0.0013 | | | [CVE-2026-74720](https://patchblox.com/security/data/cve/CVE-2026-74720.md) | High | bpf: Preserve pointer state for commuted arithmetic | 7.8 | 0.0013 | | | [CVE-2026-80737](https://patchblox.com/security/data/cve/CVE-2026-80737.md) | High | serial: amba-pl011: synchronize DMA teardown | 7.8 | 0.0013 | | | [CVE-2026-74630](https://patchblox.com/security/data/cve/CVE-2026-74630.md) | High | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | 7.8 | 0.0013 | | | [CVE-2026-74627](https://patchblox.com/security/data/cve/CVE-2026-74627.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We s... | 7.8 | 0.0013 | | | [CVE-2026-74652](https://patchblox.com/security/data/cve/CVE-2026-74652.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after... | 7.8 | 0.0013 | | | [CVE-2026-74708](https://patchblox.com/security/data/cve/CVE-2026-74708.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-... | 7.8 | 0.0013 | | | [CVE-2026-74615](https://patchblox.com/security/data/cve/CVE-2026-74615.md) | High | vxlan: do not arm the ageing timer on a device that is down | 8.8 | 0.0013 | | | [CVE-2026-74609](https://patchblox.com/security/data/cve/CVE-2026-74609.md) | High | tipc: read le->link under the node lock in tipc_node_link_down() | 7.8 | 0.0013 | | | [CVE-2026-74613](https://patchblox.com/security/data/cve/CVE-2026-74613.md) | High | vsock/virtio: avoid refilling the RX queue after teardown | 7.8 | 0.0013 | | | [CVE-2026-74637](https://patchblox.com/security/data/cve/CVE-2026-74637.md) | High | perf/core: Fix group leader use-after-free after sibling detach | 7.8 | 0.0013 | | | [CVE-2026-74656](https://patchblox.com/security/data/cve/CVE-2026-74656.md) | High | ipv4: fix use-after-free in fib_nhc_update_mtu() | 7.8 | 0.0013 | | | [CVE-2026-74660](https://patchblox.com/security/data/cve/CVE-2026-74660.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_... | 7.8 | 0.0013 | | | [CVE-2026-74700](https://patchblox.com/security/data/cve/CVE-2026-74700.md) | High | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 7.8 | 0.0013 | | | [CVE-2026-74714](https://patchblox.com/security/data/cve/CVE-2026-74714.md) | High | bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() | 7.8 | 0.0013 | | | [CVE-2026-74726](https://patchblox.com/security/data/cve/CVE-2026-74726.md) | High | bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor | 7.3 | 0.0013 | | | [CVE-2026-74606](https://patchblox.com/security/data/cve/CVE-2026-74606.md) | High | eventfs: Fix use-after-free in eventfs_remove_rec() | 7.8 | 0.0013 | | | [CVE-2026-74634](https://patchblox.com/security/data/cve/CVE-2026-74634.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when re... | 7.8 | 0.0013 | | | [CVE-2026-74724](https://patchblox.com/security/data/cve/CVE-2026-74724.md) | High | ipvs: avoid out-of-bounds write in ip_vs_nat_icmp | 7.8 | 0.0012 | | | [CVE-2026-74582](https://patchblox.com/security/data/cve/CVE-2026-74582.md) | High | packet: use consistent hard_header_len in non-ring send paths | 9.8 | 0.0012 | | | [CVE-2026-80572](https://patchblox.com/security/data/cve/CVE-2026-80572.md) | High | Input: byd - synchronize timer deletion before freeing private data | 7.8 | 0.0012 | | | [CVE-2026-74583](https://patchblox.com/security/data/cve/CVE-2026-74583.md) | High | net/sched: cls_route: fix fastmap use-after-free on filter | 8.8 | 0.0012 | | | [CVE-2026-80578](https://patchblox.com/security/data/cve/CVE-2026-80578.md) | High | fbdev: core: Fix pointer desynchronization in fb_io_read() | 7.3 | 0.0012 | | | [CVE-2026-74595](https://patchblox.com/security/data/cve/CVE-2026-74595.md) | High | fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() | 7.8 | 0.0009 | | | [CVE-2026-80726](https://patchblox.com/security/data/cve/CVE-2026-80726.md) | High | KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page | 9.3 | n/a | | | [CVE-2026-80811](https://patchblox.com/security/data/cve/CVE-2026-80811.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak when the async cmd... | n/a | n/a | | | [CVE-2026-80905](https://patchblox.com/security/data/cve/CVE-2026-80905.md) | Routine | net: tap: fix wrong transport_header when sending VLAN-tagged frame | 5.5 | 0.0020 | | | [CVE-2026-97547](https://patchblox.com/security/data/cve/CVE-2026-97547.md) | Routine | xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN | 5.3 | 0.0020 | | | [CVE-2026-80793](https://patchblox.com/security/data/cve/CVE-2026-80793.md) | Routine | ipv4: reject undersized MTUs in ip_do_fragment() | 5.5 | 0.0020 | | | [CVE-2026-80781](https://patchblox.com/security/data/cve/CVE-2026-80781.md) | Routine | HID: core: fix OOB read of field->usage in hid_set_field() | 5.3 | 0.0020 | | | [CVE-2026-80765](https://patchblox.com/security/data/cve/CVE-2026-80765.md) | Routine | HID: hyperv: validate initial device info bounds | 4.5 | 0.0020 | | | [CVE-2026-80805](https://patchblox.com/security/data/cve/CVE-2026-80805.md) | Routine | xfs: validate attr entry pointer before field access | 4.4 | 0.0020 | | | [CVE-2026-74683](https://patchblox.com/security/data/cve/CVE-2026-74683.md) | Routine | Input: evdev - sanitize event type index when fetching event masks | 5.5 | 0.0019 | | | [CVE-2026-80918](https://patchblox.com/security/data/cve/CVE-2026-80918.md) | Routine | HID: core: fix number/pointer type confusion on long items | 3.3 | 0.0018 | | | [CVE-2026-74740](https://patchblox.com/security/data/cve/CVE-2026-74740.md) | Routine | net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain | 5.5 | 0.0018 | | | [CVE-2026-74620](https://patchblox.com/security/data/cve/CVE-2026-74620.md) | Routine | net/sched: act_gact, act_police: range check the fallback control action | 5.5 | 0.0018 | | | [CVE-2026-74654](https://patchblox.com/security/data/cve/CVE-2026-74654.md) | Routine | serial: 8250_dma: Clear stale RX state on shutdown | 5.5 | 0.0018 | | | [CVE-2026-74657](https://patchblox.com/security/data/cve/CVE-2026-74657.md) | Routine | ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops | 5.5 | 0.0018 | | | [CVE-2026-74658](https://patchblox.com/security/data/cve/CVE-2026-74658.md) | Routine | futex: Prevent robust futex exit race some more | 5.5 | 0.0018 | | | [CVE-2026-74664](https://patchblox.com/security/data/cve/CVE-2026-74664.md) | Routine | net: openvswitch: reallocate update replies for mismatched IDs | 5.5 | 0.0018 | | | [CVE-2026-74671](https://patchblox.com/security/data/cve/CVE-2026-74671.md) | Routine | ima: fix out-of-bounds read in xattr_verify() | 5.5 | 0.0018 | | | [CVE-2026-74673](https://patchblox.com/security/data/cve/CVE-2026-74673.md) | Routine | Input: evdev - fix information leak in evdev_pass_values() | 5.5 | 0.0018 | | | [CVE-2026-74676](https://patchblox.com/security/data/cve/CVE-2026-74676.md) | Routine | vt: add permission check for KDSKBMETA ioctl | 5.5 | 0.0018 | | | [CVE-2026-80534](https://patchblox.com/security/data/cve/CVE-2026-80534.md) | Routine | xfs: fix ilock leak on error in xfs_dq_get_next_id | 5.5 | 0.0018 | | | [CVE-2026-80733](https://patchblox.com/security/data/cve/CVE-2026-80733.md) | Routine | net: remove WARN_ON_ONCE() from sk_mc_loop() | 5.5 | 0.0018 | | | [CVE-2026-80742](https://patchblox.com/security/data/cve/CVE-2026-80742.md) | Routine | af_packet: Don't send zero-byte data in tpacket_snd(). | 5.5 | 0.0018 | | | [CVE-2026-80744](https://patchblox.com/security/data/cve/CVE-2026-80744.md) | Routine | netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path | 3.3 | 0.0018 | | | [CVE-2026-80529](https://patchblox.com/security/data/cve/CVE-2026-80529.md) | Routine | xfs: don't swallow dquot recovery verification errors | 6.3 | 0.0017 | | | [CVE-2026-74636](https://patchblox.com/security/data/cve/CVE-2026-74636.md) | Routine | tracing: Fix race between update_event_fields and, event_define_fields | 5.5 | 0.0017 | | | [CVE-2026-74722](https://patchblox.com/security/data/cve/CVE-2026-74722.md) | Routine | btrfs: fix memory leak in btrfs_do_encoded_write() | 5.5 | 0.0017 | | | [CVE-2026-80739](https://patchblox.com/security/data/cve/CVE-2026-80739.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acqu... | 5.5 | 0.0017 | | | [CVE-2026-80806](https://patchblox.com/security/data/cve/CVE-2026-80806.md) | Routine | ext4: don't enable DAX on new encrypted files | 5.5 | 0.0017 | | | [CVE-2026-80784](https://patchblox.com/security/data/cve/CVE-2026-80784.md) | Routine | mptcp: pm: fix memory leak from alloc-during-teardown race | 4.4 | 0.0017 | | | [CVE-2026-80727](https://patchblox.com/security/data/cve/CVE-2026-80727.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI di... | 6.4 | 0.0017 | | | [CVE-2026-74483](https://patchblox.com/security/data/cve/CVE-2026-74483.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when... | 5.5 | 0.0017 | | | [CVE-2026-74602](https://patchblox.com/security/data/cve/CVE-2026-74602.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_... | 5.5 | 0.0017 | | | [CVE-2026-74618](https://patchblox.com/security/data/cve/CVE-2026-74618.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is comple... | 5.5 | 0.0017 | | | [CVE-2026-74619](https://patchblox.com/security/data/cve/CVE-2026-74619.md) | Routine | ovl: don't warn when the mount is completed from another user namespace | 5.5 | 0.0017 | | | [CVE-2026-74644](https://patchblox.com/security/data/cve/CVE-2026-74644.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid m... | 5.5 | 0.0017 | | | [CVE-2026-74653](https://patchblox.com/security/data/cve/CVE-2026-74653.md) | Routine | serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx | 5.5 | 0.0017 | | | [CVE-2026-74718](https://patchblox.com/security/data/cve/CVE-2026-74718.md) | Routine | devlink: fix net namespace reference leak in reload | 5.5 | 0.0017 | | | [CVE-2026-80757](https://patchblox.com/security/data/cve/CVE-2026-80757.md) | Routine | selinux: reject a class permission count below its inherited common | 6.7 | 0.0017 | | | [CVE-2026-80756](https://patchblox.com/security/data/cve/CVE-2026-80756.md) | Routine | selinux: do not cancel a policy conversion that never started | 4.4 | 0.0017 | | | [CVE-2026-80906](https://patchblox.com/security/data/cve/CVE-2026-80906.md) | Routine | net: packet: fix wrong transport_header when sending VLAN-tagged frame | 4.4 | 0.0017 | | | [CVE-2026-80912](https://patchblox.com/security/data/cve/CVE-2026-80912.md) | Routine | selinux: reject an unclaimed class value in security_get_classes() | 4.4 | 0.0017 | | | [CVE-2026-80913](https://patchblox.com/security/data/cve/CVE-2026-80913.md) | Routine | selinux: require every boolean value to be defined | 4.4 | 0.0017 | | | [CVE-2026-80917](https://patchblox.com/security/data/cve/CVE-2026-80917.md) | Routine | PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems | 4.1 | 0.0017 | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.