# ALAS2023-2026-3193: Security update for 18 packages

ALAS2023-2026-3193, released November 7, 2026, fixes 203 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3193
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-89660, rated Critical)
- CVEs: 203, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3193.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel-livepatch-6.12.111-136.204](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.111-136.204.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.111-136.204.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-89660](https://patchblox.com/security/data/cve/CVE-2026-89660.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during admin... | 9.8 | 0.0062 |  |
| [CVE-2026-89637](https://patchblox.com/security/data/cve/CVE-2026-89637.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix UAF and buffer leak in cifs_che... | 9.8 | 0.0060 |  |
| [CVE-2026-90037](https://patchblox.com/security/data/cve/CVE-2026-90037.md) | Urgent | NFSD: Prevent client use-after-free during close_lru reaping | 9.8 | 0.0051 |  |
| [CVE-2026-90042](https://patchblox.com/security/data/cve/CVE-2026-90042.md) | Urgent | ceph: properly decrypt filenames in vmalloc() buffers | 9.8 | 0.0050 |  |
| [CVE-2026-89676](https://patchblox.com/security/data/cve/CVE-2026-89676.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix stale s2s_cp_stateids IDR entry for as... | 9.8 | 0.0049 |  |
| [CVE-2026-90036](https://patchblox.com/security/data/cve/CVE-2026-90036.md) | Urgent | NFSD: Prevent client use-after-free during blocked-lock reaping | 9.8 | 0.0048 |  |
| [CVE-2026-97524](https://patchblox.com/security/data/cve/CVE-2026-97524.md) | High | mptcp: avoid unneeded actions on subflow reset | 9.8 | 0.0075 |  |
| [CVE-2026-97523](https://patchblox.com/security/data/cve/CVE-2026-97523.md) | High | mptcp: close race between scheduler and state change | 7.5 | 0.0073 |  |
| [CVE-2026-89544](https://patchblox.com/security/data/cve/CVE-2026-89544.md) | High | SUNRPC: fix gssx_dec_option_array error path bugs | 9.8 | 0.0072 |  |
| [CVE-2026-89685](https://patchblox.com/security/data/cve/CVE-2026-89685.md) | High | nfsd: fix clock domain mismatch in clients_still_reclaiming() | 7.5 | 0.0061 |  |
| [CVE-2026-98056](https://patchblox.com/security/data/cve/CVE-2026-98056.md) | High | nvme: remove stale namespaces by NSID range during scan | 7.5 | 0.0061 |  |
| [CVE-2026-98401](https://patchblox.com/security/data/cve/CVE-2026-98401.md) | High | net: iptunnel: fix stale transport header during tunnel decapsulation | 7.5 | 0.0060 |  |
| [CVE-2026-97555](https://patchblox.com/security/data/cve/CVE-2026-97555.md) | High | smb: client: fix heap overflow in DACL owner/group rewrite | 9.8 | 0.0058 |  |
| [CVE-2026-98069](https://patchblox.com/security/data/cve/CVE-2026-98069.md) | High | net/rds: acquire the fastpath locks in rds_conn_shutdown() | 8.1 | 0.0056 |  |
| [CVE-2026-89667](https://patchblox.com/security/data/cve/CVE-2026-89667.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: close shrinker/GC/fsnotify vs per-net shut... | 8.1 | 0.0054 |  |
| [CVE-2026-98096](https://patchblox.com/security/data/cve/CVE-2026-98096.md) | High | ipv6: sr: restore network header before routing and forwarding | 7.8 | 0.0051 |  |
| [CVE-2026-72438](https://patchblox.com/security/data/cve/CVE-2026-72438.md) | High | md/raid10: fix writes_pending and barrier reference leaks on discard failures | 7.5 | 0.0050 |  |
| [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 |  |
| [CVE-2026-89561](https://patchblox.com/security/data/cve/CVE-2026-89561.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: rpl: fix NULL dereference of idev in ipv6_... | 7.5 | 0.0048 |  |
| [CVE-2026-89659](https://patchblox.com/security/data/cve/CVE-2026-89659.md) | High | NFSD: Prevent client use-after-free during delegation revoke | 9.8 | 0.0048 |  |
| [CVE-2026-98070](https://patchblox.com/security/data/cve/CVE-2026-98070.md) | High | net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() | 8.1 | 0.0047 |  |
| [CVE-2026-98130](https://patchblox.com/security/data/cve/CVE-2026-98130.md) | High | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | 8.1 | 0.0045 |  |
| [CVE-2026-89708](https://patchblox.com/security/data/cve/CVE-2026-89708.md) | High | nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown | 9.8 | 0.0044 |  |
| [CVE-2026-97562](https://patchblox.com/security/data/cve/CVE-2026-97562.md) | High | smb: client: pin DFS superblock in iterator callback | 7.8 | 0.0041 |  |
| [CVE-2026-93787](https://patchblox.com/security/data/cve/CVE-2026-93787.md) | High | smb: client: bound dirent name against end of SMB response in cifs_filldir | 9.8 | 0.0034 |  |
| [CVE-2026-89796](https://patchblox.com/security/data/cve/CVE-2026-89796.md) | High | mm/damon/core: avoid infinite kdamond_merge_regions() internal loop | 7.8 | 0.0023 |  |
| [CVE-2026-97616](https://patchblox.com/security/data/cve/CVE-2026-97616.md) | High | net/sched: act_api: release all action references on NEWACTION failure | 7.1 | 0.0022 |  |
| [CVE-2026-97564](https://patchblox.com/security/data/cve/CVE-2026-97564.md) | High | smb: client: reject userspace cifs.idmap descriptions | 7.8 | 0.0022 |  |
| [CVE-2026-97598](https://patchblox.com/security/data/cve/CVE-2026-97598.md) | High | ipv4: fib: bound automatic table ID allocation | 7.8 | 0.0022 |  |
| [CVE-2026-97998](https://patchblox.com/security/data/cve/CVE-2026-97998.md) | High | netfilter: nfnetlink_log: cope with concurrent instance destruction | 7.8 | 0.0022 |  |
| [CVE-2026-98076](https://patchblox.com/security/data/cve/CVE-2026-98076.md) | High | tracing/probes: Fix use-after-free on field name/type of events with multiple probes | 7.8 | 0.0022 |  |
| [CVE-2026-97568](https://patchblox.com/security/data/cve/CVE-2026-97568.md) | High | mptcp: syncookies: remember the request backup flag | 7.1 | 0.0022 |  |
| [CVE-2026-97904](https://patchblox.com/security/data/cve/CVE-2026-97904.md) | High | cpufreq: initialize policy rwsem before sysfs publication | 7.0 | 0.0022 |  |
| [CVE-2026-89543](https://patchblox.com/security/data/cve/CVE-2026-89543.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sunrpc: fix use-after-free in __rpc_clnt_handle_... | 7.8 | 0.0021 |  |
| [CVE-2026-97556](https://patchblox.com/security/data/cve/CVE-2026-97556.md) | High | smb: client: avoid leaking refcount when cifs_sb_tlink() fails | 8.8 | 0.0021 |  |
| [CVE-2026-97617](https://patchblox.com/security/data/cve/CVE-2026-97617.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Check resize_disabled before publis... | 7.8 | 0.0021 |  |
| [CVE-2026-98104](https://patchblox.com/security/data/cve/CVE-2026-98104.md) | High | net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted | 7.8 | 0.0021 |  |
| [CVE-2026-98398](https://patchblox.com/security/data/cve/CVE-2026-98398.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  locking/lockdep: Invalidate stale class_cache en... | n/a | 0.0021 |  |
| [CVE-2026-97560](https://patchblox.com/security/data/cve/CVE-2026-97560.md) | High | smb: client: fix one-byte OOB read in smb2_parse_native_symlink() | 8.8 | 0.0020 |  |
| [CVE-2026-90430](https://patchblox.com/security/data/cve/CVE-2026-90430.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/tegra241-cmdqv: Publish an LVCMDQ only aft... | n/a | 0.0020 |  |
| [CVE-2026-90039](https://patchblox.com/security/data/cve/CVE-2026-90039.md) | High | NFSD: Guard admin state-revocation walks with NFSD_NET_UP | 7.8 | 0.0019 |  |
| [CVE-2026-68289](https://patchblox.com/security/data/cve/CVE-2026-68289.md) | High | tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() | 7.0 | 0.0018 |  |
| [CVE-2026-98900](https://patchblox.com/security/data/cve/CVE-2026-98900.md) | High | xen/gntalloc: validate grant count before allocation | 7.8 | 0.0018 |  |
| [CVE-2026-98881](https://patchblox.com/security/data/cve/CVE-2026-98881.md) | High | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | 7.1 | 0.0018 |  |
| [CVE-2026-98902](https://patchblox.com/security/data/cve/CVE-2026-98902.md) | High | md/raid5: let stripe batch bm_seq comparison wrap-safe | 7.1 | 0.0018 |  |
| [CVE-2026-89693](https://patchblox.com/security/data/cve/CVE-2026-89693.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: check nfsd4_acl_to_attr() return value in... | 9.8 | 0.0018 |  |
| [CVE-2026-97959](https://patchblox.com/security/data/cve/CVE-2026-97959.md) | High | net/sched: cls_route: free emptied bucket on filter move | 9.1 | 0.0018 |  |
| [CVE-2026-97995](https://patchblox.com/security/data/cve/CVE-2026-97995.md) | High | virtio_console: do not free control-out buffers on remove | 7.8 | 0.0018 |  |
| [CVE-2026-98011](https://patchblox.com/security/data/cve/CVE-2026-98011.md) | High | net/sched: hhf: clamp quantum in change and init paths | 7.8 | 0.0018 |  |
| [CVE-2026-98015](https://patchblox.com/security/data/cve/CVE-2026-98015.md) | High | net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put | 7.8 | 0.0018 |  |
| [CVE-2026-98074](https://patchblox.com/security/data/cve/CVE-2026-98074.md) | High | bonding: do not clear curr_active_slave prematurely when releasing all slaves | 7.8 | 0.0018 |  |
| [CVE-2026-97951](https://patchblox.com/security/data/cve/CVE-2026-97951.md) | High | scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands | 7.5 | 0.0018 |  |
| [CVE-2026-98063](https://patchblox.com/security/data/cve/CVE-2026-98063.md) | High | bpf: Fix NULL-ptr-deref in btf_var_show() | 7.1 | 0.0018 |  |
| [CVE-2026-98064](https://patchblox.com/security/data/cve/CVE-2026-98064.md) | High | bpf: Fix NULL-ptr-deref when showing a void BTF type | 7.1 | 0.0018 |  |
| [CVE-2026-98072](https://patchblox.com/security/data/cve/CVE-2026-98072.md) | High | net/rds: use wq_has_sleeper() in release_in_xmit() | 7.1 | 0.0018 |  |
| [CVE-2026-98068](https://patchblox.com/security/data/cve/CVE-2026-98068.md) | High | net/rds: don't let rds_conn_shutdown() consume a concurrent drop | 7.0 | 0.0018 |  |
| [CVE-2026-89602](https://patchblox.com/security/data/cve/CVE-2026-89602.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  erofs: skip sufficiently large global buffers wh... | 7.8 | 0.0018 |  |
| [CVE-2026-98021](https://patchblox.com/security/data/cve/CVE-2026-98021.md) | High | net: reject oversized tx_queue_len at netlink parse time | 7.8 | 0.0018 |  |
| [CVE-2026-89799](https://patchblox.com/security/data/cve/CVE-2026-89799.md) | High | bpf: Disable preemption in bpf_get_stackid | 7.8 | 0.0018 |  |
| [CVE-2026-98089](https://patchblox.com/security/data/cve/CVE-2026-98089.md) | High | bonding: alb: fix uninitialized transport header access in alb_determine_nd() | 8.1 | 0.0017 |  |
| [CVE-2026-80841](https://patchblox.com/security/data/cve/CVE-2026-80841.md) | High | net/packet: defer vmalloc TX_RING free until skbs finish | 7.8 | 0.0017 |  |
| [CVE-2026-93785](https://patchblox.com/security/data/cve/CVE-2026-93785.md) | High | cifs: validate idmap key payload length | 7.8 | 0.0017 |  |
| [CVE-2026-97441](https://patchblox.com/security/data/cve/CVE-2026-97441.md) | High | ata: ahci: fail probe if BAR too small for claimed ports | 7.8 | 0.0017 |  |
| [CVE-2026-97964](https://patchblox.com/security/data/cve/CVE-2026-97964.md) | High | ppp_synctty: ensure a writeable skb header | 7.8 | 0.0017 |  |
| [CVE-2026-98016](https://patchblox.com/security/data/cve/CVE-2026-98016.md) | High | net/mlx5e: Fix use-after-free race in sample_restore_put() | 7.8 | 0.0017 |  |
| [CVE-2026-98014](https://patchblox.com/security/data/cve/CVE-2026-98014.md) | High | net/mlx5: E-Switch, prevent mc_list repopulation during vport disable | 7.1 | 0.0017 |  |
| [CVE-2026-98046](https://patchblox.com/security/data/cve/CVE-2026-98046.md) | High | bpf: Mark bpf_btf_find_by_name_kind() as sleepable | 7.1 | 0.0017 |  |
| [CVE-2026-98075](https://patchblox.com/security/data/cve/CVE-2026-98075.md) | High | bpf: reject BPF_PSEUDO_FUNC reference to the main program | 7.1 | 0.0017 |  |
| [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 |  |
| [CVE-2026-98088](https://patchblox.com/security/data/cve/CVE-2026-98088.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Avoid out-of-bounds cpumask_of_no... | 7.0 | 0.0017 |  |
| [CVE-2026-97612](https://patchblox.com/security/data/cve/CVE-2026-97612.md) | High | net: mpls: clear inner_protocol when the last label is popped | 7.8 | 0.0017 |  |
| [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 |  |
| [CVE-2026-98899](https://patchblox.com/security/data/cve/CVE-2026-98899.md) | High | netfilter: ipset: mark the rcu locked areas properly | 7.8 | 0.0017 |  |
| [CVE-2026-97984](https://patchblox.com/security/data/cve/CVE-2026-97984.md) | High | net: ipv6: Fix UDP length overflow with PMTU discover and big MTU | 9.1 | 0.0017 |  |
| [CVE-2026-74258](https://patchblox.com/security/data/cve/CVE-2026-74258.md) | High | bpf: Guard __get_user acesss with access_ok for uprobe_multi data | 7.8 | 0.0017 |  |
| [CVE-2026-97978](https://patchblox.com/security/data/cve/CVE-2026-97978.md) | High | eth: ice: don't dereference pointers from TP_printk() | 7.8 | 0.0017 |  |
| [CVE-2026-98026](https://patchblox.com/security/data/cve/CVE-2026-98026.md) | High | net: bridge: mcast: properly convert mglist to rcu | 7.8 | 0.0017 |  |
| [CVE-2026-98102](https://patchblox.com/security/data/cve/CVE-2026-98102.md) | High | ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() | 7.8 | 0.0017 |  |
| [CVE-2026-98103](https://patchblox.com/security/data/cve/CVE-2026-98103.md) | High | igmp: convert struct ip_sf_list to RCU | 7.8 | 0.0017 |  |
| [CVE-2026-68337](https://patchblox.com/security/data/cve/CVE-2026-68337.md) | High | bpf: Reject redirect helpers without a bpf_net_context | 7.3 | 0.0017 |  |
| [CVE-2026-97961](https://patchblox.com/security/data/cve/CVE-2026-97961.md) | High | perf/core: Allow list_del during perf_event_overflow() | 7.1 | 0.0017 |  |
| [CVE-2026-97965](https://patchblox.com/security/data/cve/CVE-2026-97965.md) | High | vxlan: initialize _md in vxlan_xmit_one() | 7.1 | 0.0017 |  |
| [CVE-2026-98057](https://patchblox.com/security/data/cve/CVE-2026-98057.md) | High | ring-buffer: Add checking nr_subbufs to persistent ring buffer validation | 7.0 | 0.0017 |  |
| [CVE-2026-97611](https://patchblox.com/security/data/cve/CVE-2026-97611.md) | High | net: openvswitch: fix use-after-free of the flow table mask array | 7.8 | 0.0016 |  |
| [CVE-2026-89545](https://patchblox.com/security/data/cve/CVE-2026-89545.md) | High | sunrpc: defer rq_argp and rq_resp free until after RCU grace period | 7.8 | 0.0016 |  |
| [CVE-2026-89755](https://patchblox.com/security/data/cve/CVE-2026-89755.md) | High | mm/migrate_device: clear stale mapping after freeing swapcache | 7.8 | 0.0016 |  |
| [CVE-2026-97505](https://patchblox.com/security/data/cve/CVE-2026-97505.md) | High | PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() | 7.3 | 0.0016 |  |
| [CVE-2026-80860](https://patchblox.com/security/data/cve/CVE-2026-80860.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  fuse: fix race between interrupt and resend  Aft... | 7.8 | 0.0016 |  |
| [CVE-2026-97445](https://patchblox.com/security/data/cve/CVE-2026-97445.md) | High | ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() | 7.7 | 0.0016 |  |
| [CVE-2026-97602](https://patchblox.com/security/data/cve/CVE-2026-97602.md) | High | inet: frags: invalidate queues before flushing them | 7.8 | 0.0016 |  |
| [CVE-2026-98078](https://patchblox.com/security/data/cve/CVE-2026-98078.md) | High | ipvs: fix reversed sequence option serialization | 7.8 | 0.0016 |  |
| [CVE-2026-97608](https://patchblox.com/security/data/cve/CVE-2026-97608.md) | High | netfilter: nf_log: unregister loggers before per-net teardown | 7.8 | 0.0015 |  |
| [CVE-2026-98041](https://patchblox.com/security/data/cve/CVE-2026-98041.md) | High | bpf: Don't predict JMP32 pointer vs zero comparisons | 7.0 | 0.0015 |  |
| [CVE-2026-97450](https://patchblox.com/security/data/cve/CVE-2026-97450.md) | High | ACPICA: validate handler object type in two places | 8.4 | 0.0014 |  |
| [CVE-2026-97451](https://patchblox.com/security/data/cve/CVE-2026-97451.md) | High | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) | 8.4 | 0.0014 |  |
| [CVE-2026-97452](https://patchblox.com/security/data/cve/CVE-2026-97452.md) | High | ACPICA: Prevent adding invalid references | 8.4 | 0.0014 |  |
| [CVE-2026-97444](https://patchblox.com/security/data/cve/CVE-2026-97444.md) | High | ACPICA: add boundary checks in two places | 7.7 | 0.0014 |  |
| [CVE-2026-97454](https://patchblox.com/security/data/cve/CVE-2026-97454.md) | High | ACPICA: add boundary checks in acpi_ps_get_next_field() | 7.7 | 0.0014 |  |
| [CVE-2026-97455](https://patchblox.com/security/data/cve/CVE-2026-97455.md) | High | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() | 8.4 | 0.0014 |  |
| [CVE-2026-93827](https://patchblox.com/security/data/cve/CVE-2026-93827.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setu... | 9.8 | 0.0014 |  |
| [CVE-2026-89564](https://patchblox.com/security/data/cve/CVE-2026-89564.md) | High | ip: orphan prefetched skbs before multicast forwarding | 7.8 | 0.0014 |  |
| [CVE-2026-97448](https://patchblox.com/security/data/cve/CVE-2026-97448.md) | High | ACPICA: Add validation for node in acpi_ns_build_normalized_path() | 7.8 | 0.0014 |  |
| [CVE-2026-97437](https://patchblox.com/security/data/cve/CVE-2026-97437.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs3: fix out-of-bounds read in ntfs_dir_emit()... | 7.1 | 0.0014 |  |
| [CVE-2026-98080](https://patchblox.com/security/data/cve/CVE-2026-98080.md) | High | btrfs: do not force reloc root creation during qgroup_account_snapshot() | 7.8 | 0.0013 |  |
| [CVE-2026-97415](https://patchblox.com/security/data/cve/CVE-2026-97415.md) | High | btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF | 7.8 | 0.0013 |  |
| [CVE-2026-97438](https://patchblox.com/security/data/cve/CVE-2026-97438.md) | High | fs/ntfs3: validate index entry key bounds | 7.1 | 0.0013 |  |
| [CVE-2026-98127](https://patchblox.com/security/data/cve/CVE-2026-98127.md) | High | smb/client: validate new EOF for insert range | 7.8 | 0.0013 |  |
| [CVE-2026-93288](https://patchblox.com/security/data/cve/CVE-2026-93288.md) | High | netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state | 8.8 | 0.0013 |  |
| [CVE-2026-93817](https://patchblox.com/security/data/cve/CVE-2026-93817.md) | High | perf: Fix addr_filter_ranges lifetime | 8.8 | 0.0013 |  |
| [CVE-2026-93125](https://patchblox.com/security/data/cve/CVE-2026-93125.md) | High | bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max | 7.8 | 0.0013 |  |
| [CVE-2026-93287](https://patchblox.com/security/data/cve/CVE-2026-93287.md) | High | i2c: smbus: reject oversized block transfers in the common path | 7.8 | 0.0013 |  |
| [CVE-2026-93798](https://patchblox.com/security/data/cve/CVE-2026-93798.md) | High | btrfs: fix reloc root cleanup in merge_reloc_roots() | 7.8 | 0.0013 |  |
| [CVE-2026-93813](https://patchblox.com/security/data/cve/CVE-2026-93813.md) | High | btrfs: tree-checker: validate INODE_REF's namelen | 7.8 | 0.0013 |  |
| [CVE-2026-97421](https://patchblox.com/security/data/cve/CVE-2026-97421.md) | High | RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() | 7.8 | 0.0013 |  |
| [CVE-2026-98017](https://patchblox.com/security/data/cve/CVE-2026-98017.md) | High | net/sched: defer qdisc freeing after failed creation | 7.8 | 0.0013 |  |
| [CVE-2026-74496](https://patchblox.com/security/data/cve/CVE-2026-74496.md) | High | fou: Fix use-after-free in fou_create() | 9.8 | 0.0013 |  |
| [CVE-2026-74289](https://patchblox.com/security/data/cve/CVE-2026-74289.md) | High | ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). | 7.8 | 0.0013 |  |
| [CVE-2026-98023](https://patchblox.com/security/data/cve/CVE-2026-98023.md) | High | vxlan: reject dynamic fdb entries that reference a nexthop id | 7.8 | 0.0013 |  |
| [CVE-2026-93801](https://patchblox.com/security/data/cve/CVE-2026-93801.md) | High | smb/client: zero-initialize stack-allocated cifs_open_info_data | 7.0 | 0.0013 |  |
| [CVE-2026-98122](https://patchblox.com/security/data/cve/CVE-2026-98122.md) | High | vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() | 7.8 | 0.0013 |  |
| [CVE-2026-98095](https://patchblox.com/security/data/cve/CVE-2026-98095.md) | High | af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). | 7.1 | 0.0012 |  |
| [CVE-2026-98082](https://patchblox.com/security/data/cve/CVE-2026-98082.md) | High | btrfs: fix the possible bioc_list memory leak during error | 7.0 | 0.0012 |  |
| [CVE-2026-93810](https://patchblox.com/security/data/cve/CVE-2026-93810.md) | High | cachefiles: Fix double fput | 7.8 | 0.0012 |  |
| [CVE-2026-89763](https://patchblox.com/security/data/cve/CVE-2026-89763.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KEYS: trusted: Fix TPM teardown ordering  truste... | 7.8 | 0.0012 |  |
| [CVE-2026-98098](https://patchblox.com/security/data/cve/CVE-2026-98098.md) | High | tipc: fix NULL deref in tipc_named_node_up() on empty publication list | 7.8 | 0.0012 |  |
| [CVE-2026-98083](https://patchblox.com/security/data/cve/CVE-2026-98083.md) | High | btrfs: fix transaction use-after-free in raid stripe insertion | 7.8 | 0.0012 |  |
| [CVE-2026-98158](https://patchblox.com/security/data/cve/CVE-2026-98158.md) | High | ppp_async: drop the errored frame instead of resetting its headroom | 9.8 | 0.0011 |  |
| [CVE-2026-98097](https://patchblox.com/security/data/cve/CVE-2026-98097.md) | Routine | tipc: Dont send random pad bytes in RESET/ACTIVATE messages | 5.3 | 0.0031 |  |
| [CVE-2026-97905](https://patchblox.com/security/data/cve/CVE-2026-97905.md) | Routine | cpufreq: zero-initialize policy cpumask before sysfs publication | 5.5 | 0.0022 |  |
| [CVE-2026-98077](https://patchblox.com/security/data/cve/CVE-2026-98077.md) | Routine | netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | 5.5 | 0.0022 |  |
| [CVE-2026-98388](https://patchblox.com/security/data/cve/CVE-2026-98388.md) | Routine | exec: do_close_on_exec() before taking exec_update_lock | 5.5 | 0.0022 |  |
| [CVE-2026-97596](https://patchblox.com/security/data/cve/CVE-2026-97596.md) | Routine | ipvs: reject invalid states in connection template sync records | 4.8 | 0.0022 |  |
| [CVE-2026-98404](https://patchblox.com/security/data/cve/CVE-2026-98404.md) | Routine | drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() | 4.7 | 0.0022 |  |
| [CVE-2026-98538](https://patchblox.com/security/data/cve/CVE-2026-98538.md) | Routine | writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes | 4.1 | 0.0022 |  |
| [CVE-2026-80847](https://patchblox.com/security/data/cve/CVE-2026-80847.md) | Routine | tcp: clamp route advmss to TCP_MIN_MSS | 5.5 | 0.0021 |  |
| [CVE-2026-97925](https://patchblox.com/security/data/cve/CVE-2026-97925.md) | Routine | tick/broadcast: Plug clockevents replacement race | 6.7 | 0.0021 |  |
| [CVE-2026-72402](https://patchblox.com/security/data/cve/CVE-2026-72402.md) | Routine | bpf: Mask pseudo pointer values in verifier logs | 5.5 | 0.0021 |  |
| [CVE-2026-98402](https://patchblox.com/security/data/cve/CVE-2026-98402.md) | Routine | net: icmp: avoid invalid transport header access in icmp_send tracepoint | 3.7 | 0.0021 |  |
| [CVE-2026-97945](https://patchblox.com/security/data/cve/CVE-2026-97945.md) | Routine | x86/mm: Fix user-space data loss with MADV_FREE and THP | 6.1 | 0.0021 |  |
| [CVE-2026-97522](https://patchblox.com/security/data/cve/CVE-2026-97522.md) | Routine | mptcp: fix bad accounting in __mptcp_subflow_push_pending() | 5.5 | 0.0021 |  |
| [CVE-2026-97902](https://patchblox.com/security/data/cve/CVE-2026-97902.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  fs: don't return -EINVAL for successful nested t... | 3.4 | 0.0021 |  |
| [CVE-2026-89698](https://patchblox.com/security/data/cve/CVE-2026-89698.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: widen nfsd_genl_rqstp address fields to so... | 3.3 | 0.0021 |  |
| [CVE-2026-97606](https://patchblox.com/security/data/cve/CVE-2026-97606.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  fs: autofs: fix memory leak in autofs_fill_super... | 2.3 | 0.0021 |  |
| [CVE-2026-98037](https://patchblox.com/security/data/cve/CVE-2026-98037.md) | Routine | bpf: Reject untrusted allocated-object pointers | 6.7 | 0.0020 |  |
| [CVE-2026-97551](https://patchblox.com/security/data/cve/CVE-2026-97551.md) | Routine | xfs: initialise args->total for parent pointer updates | 5.5 | 0.0020 |  |
| [CVE-2026-98394](https://patchblox.com/security/data/cve/CVE-2026-98394.md) | Routine | af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. | 2.5 | 0.0020 |  |
| [CVE-2026-98888](https://patchblox.com/security/data/cve/CVE-2026-98888.md) | Routine | arm64: kprobes: Allow reentering kprobes while single-stepping | 5.5 | 0.0019 |  |
| [CVE-2026-80861](https://patchblox.com/security/data/cve/CVE-2026-80861.md) | Routine | usb: xhci: bail out of setup if the controller is inaccessible | 4.7 | 0.0018 |  |
| [CVE-2026-98877](https://patchblox.com/security/data/cve/CVE-2026-98877.md) | Routine | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed | 6.5 | 0.0018 |  |
| [CVE-2026-98873](https://patchblox.com/security/data/cve/CVE-2026-98873.md) | Routine | netfilter: nf_conntrack_expect: zero at allocation time | 6.1 | 0.0018 |  |
| [CVE-2026-98879](https://patchblox.com/security/data/cve/CVE-2026-98879.md) | Routine | isofs: handle set_blocksize failures | 5.5 | 0.0018 |  |
| [CVE-2026-98885](https://patchblox.com/security/data/cve/CVE-2026-98885.md) | Routine | ima: return error early if file xattr cannot be changed | 5.5 | 0.0018 |  |
| [CVE-2026-98775](https://patchblox.com/security/data/cve/CVE-2026-98775.md) | Routine | nitro_enclaves: fix use-after-free on SLOT_ALLOC failure | 6.5 | 0.0018 |  |
| [CVE-2026-98010](https://patchblox.com/security/data/cve/CVE-2026-98010.md) | Routine | net/sched: drr: clamp quantum in change class | 6.1 | 0.0018 |  |
| [CVE-2026-97899](https://patchblox.com/security/data/cve/CVE-2026-97899.md) | Routine | drm/i915: Fix memory leak in query_perf_config_list() | 5.5 | 0.0018 |  |
| [CVE-2026-97958](https://patchblox.com/security/data/cve/CVE-2026-97958.md) | Routine | net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). | 5.5 | 0.0018 |  |
| [CVE-2026-98012](https://patchblox.com/security/data/cve/CVE-2026-98012.md) | Routine | net/sched: sfq: clamp quantum in change path | 5.5 | 0.0018 |  |
| [CVE-2026-98022](https://patchblox.com/security/data/cve/CVE-2026-98022.md) | Routine | net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations | 5.5 | 0.0018 |  |
| [CVE-2026-98071](https://patchblox.com/security/data/cve/CVE-2026-98071.md) | Routine | net/rds: clear cp_flags bits individually in rds_conn_path_reset() | 5.5 | 0.0018 |  |
| [CVE-2026-89589](https://patchblox.com/security/data/cve/CVE-2026-89589.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  acpi/apei/ghes: Use raw_spinlock_t for CXL CPER... | 4.7 | 0.0018 |  |
| [CVE-2026-98880](https://patchblox.com/security/data/cve/CVE-2026-98880.md) | Routine | ntfs3: handle set_blocksize failures | 5.5 | 0.0017 |  |
| [CVE-2026-93800](https://patchblox.com/security/data/cve/CVE-2026-93800.md) | Routine | btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() | 6.7 | 0.0017 |  |
| [CVE-2026-97416](https://patchblox.com/security/data/cve/CVE-2026-97416.md) | Routine | btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() | 6.7 | 0.0017 |  |
| [CVE-2026-97476](https://patchblox.com/security/data/cve/CVE-2026-97476.md) | Routine | rds: filter RDS_INFO_* getsockopt by caller's netns | 6.5 | 0.0017 |  |
| [CVE-2026-97439](https://patchblox.com/security/data/cve/CVE-2026-97439.md) | Routine | fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib | 5.7 | 0.0017 |  |
| [CVE-2026-97456](https://patchblox.com/security/data/cve/CVE-2026-97456.md) | Routine | ACPICA: Fix condition check in acpi_ps_parse_loop() | 5.6 | 0.0017 |  |
| [CVE-2026-93825](https://patchblox.com/security/data/cve/CVE-2026-93825.md) | Routine | spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() | 5.5 | 0.0017 |  |
| [CVE-2026-97481](https://patchblox.com/security/data/cve/CVE-2026-97481.md) | Routine | serial: 8250: fix possible ISR soft lockup | 5.5 | 0.0017 |  |
| [CVE-2026-97483](https://patchblox.com/security/data/cve/CVE-2026-97483.md) | Routine | usb: core: hcd: fix possible deadlock in rh control transfers | 5.5 | 0.0017 |  |
| [CVE-2026-97979](https://patchblox.com/security/data/cve/CVE-2026-97979.md) | Routine | ice: add missing xa_destroy for sched_node_ids | 5.5 | 0.0017 |  |
| [CVE-2026-98031](https://patchblox.com/security/data/cve/CVE-2026-98031.md) | Routine | nexthop: Initialize extack in remove_nh_grp_entry() | 5.5 | 0.0017 |  |
| [CVE-2026-97453](https://patchblox.com/security/data/cve/CVE-2026-97453.md) | Routine | ACPICA: validate byte_count in acpi_ps_get_next_package_length() | 5.1 | 0.0017 |  |
| [CVE-2026-97484](https://patchblox.com/security/data/cve/CVE-2026-97484.md) | Routine | usbip: vhci_hcd: fix NULL deref in status_show_vhci | 5.1 | 0.0017 |  |
| [CVE-2026-93795](https://patchblox.com/security/data/cve/CVE-2026-93795.md) | Routine | blk-cgroup: fix leaks and online flag on radix_tree_insert failure | 4.7 | 0.0017 |  |
| [CVE-2026-97446](https://patchblox.com/security/data/cve/CVE-2026-97446.md) | Routine | ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() | 4.7 | 0.0017 |  |
| [CVE-2026-97420](https://patchblox.com/security/data/cve/CVE-2026-97420.md) | Routine | bpf: NUL-terminate replaced sysctl value | 4.4 | 0.0017 |  |
| [CVE-2026-97472](https://patchblox.com/security/data/cve/CVE-2026-97472.md) | Routine | ipv6: addrconf: fix temp address generation after prefix deprecation | 4.4 | 0.0017 |  |
| [CVE-2026-97449](https://patchblox.com/security/data/cve/CVE-2026-97449.md) | Routine | ACPICA: Add package limit checks in parser functions | 4.0 | 0.0017 |  |
| [CVE-2026-89644](https://patchblox.com/security/data/cve/CVE-2026-89644.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix extent map leak in NOCOW direct I/O w... | 3.3 | 0.0017 |  |
| [CVE-2026-93824](https://patchblox.com/security/data/cve/CVE-2026-93824.md) | Routine | tls: reject the combination of TLS and sockmap | 6.7 | 0.0017 |  |
| [CVE-2026-93828](https://patchblox.com/security/data/cve/CVE-2026-93828.md) | Routine | exfat: fix handling of damaged volume in exfat_create_upcase_table() | 6.7 | 0.0017 |  |
| [CVE-2026-93829](https://patchblox.com/security/data/cve/CVE-2026-93829.md) | Routine | smb: client: fix races in cifsd thread creation | 6.7 | 0.0017 |  |
| [CVE-2026-98039](https://patchblox.com/security/data/cve/CVE-2026-98039.md) | Routine | bpf: Require MEM_PERCPU for percpu kptr stores | 6.7 | 0.0017 |  |
| [CVE-2026-98045](https://patchblox.com/security/data/cve/CVE-2026-98045.md) | Routine | bpf: Mark faultable stack helpers as sleepable | 6.7 | 0.0017 |  |
| [CVE-2026-89717](https://patchblox.com/security/data/cve/CVE-2026-89717.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  zram: set default primary compressor in zram_des... | 5.5 | 0.0017 |  |
| [CVE-2026-93781](https://patchblox.com/security/data/cve/CVE-2026-93781.md) | Routine | scsi: core: Do not block on tag allocation in scsi_eh_lock_door() | 5.5 | 0.0017 |  |
| [CVE-2026-97900](https://patchblox.com/security/data/cve/CVE-2026-97900.md) | Routine | drm/drm_exec: fix up contended obj when num_objects is 0 | 5.5 | 0.0017 |  |
| [CVE-2026-97985](https://patchblox.com/security/data/cve/CVE-2026-97985.md) | Routine | af_unix: Update last skb marker in manage_oob(). | 5.5 | 0.0017 |  |
| [CVE-2026-98007](https://patchblox.com/security/data/cve/CVE-2026-98007.md) | Routine | bpf: Reject non-scalar bpf_loop iteration counts | 5.5 | 0.0017 |  |
| [CVE-2026-98081](https://patchblox.com/security/data/cve/CVE-2026-98081.md) | Routine | btrfs: zoned: finish active block group cleanup if call_zone_finish() fails | 5.5 | 0.0017 |  |
| [CVE-2026-89700](https://patchblox.com/security/data/cve/CVE-2026-89700.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: validate sockaddr length per family in lis... | 3.3 | 0.0017 |  |
| [CVE-2026-93794](https://patchblox.com/security/data/cve/CVE-2026-93794.md) | Routine | smb/client: flush dirty data before punching a hole | 3.3 | 0.0017 |  |
| [CVE-2026-97443](https://patchblox.com/security/data/cve/CVE-2026-97443.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  perf/ftrace: Fix WARNING in __unregister_ftrace_... | 2.3 | 0.0017 |  |
| [CVE-2026-80925](https://patchblox.com/security/data/cve/CVE-2026-80925.md) | Routine | vlan: fix skb_under_panic and races when toggling HW VLAN offload | 5.5 | 0.0016 |  |
| [CVE-2026-98090](https://patchblox.com/security/data/cve/CVE-2026-98090.md) | Routine | btrfs: restore active device pointers after failed sprout | 6.7 | 0.0012 |  |
| [CVE-2026-98091](https://patchblox.com/security/data/cve/CVE-2026-98091.md) | Routine | btrfs: detach failed sprout device from transaction update list | 6.7 | 0.0012 |  |
| [CVE-2026-98128](https://patchblox.com/security/data/cve/CVE-2026-98128.md) | Routine | scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() | 5.5 | 0.0012 |  |
| [CVE-2026-98129](https://patchblox.com/security/data/cve/CVE-2026-98129.md) | Routine | scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() | 5.5 | 0.0012 |  |
| [CVE-2026-98059](https://patchblox.com/security/data/cve/CVE-2026-98059.md) | Routine | bpf: Mark sched_process_wait argument as nullable | 5.5 | 0.0012 |  |
| [CVE-2026-98126](https://patchblox.com/security/data/cve/CVE-2026-98126.md) | Routine | smb/client: validate new EOF for zero range | 5.5 | 0.0012 |  |
| [CVE-2026-98157](https://patchblox.com/security/data/cve/CVE-2026-98157.md) | Routine | EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation | 5.5 | 0.0012 |  |
| [CVE-2026-98151](https://patchblox.com/security/data/cve/CVE-2026-98151.md) | Routine | bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic | 6.7 | 0.0011 |  |
| [CVE-2026-98123](https://patchblox.com/security/data/cve/CVE-2026-98123.md) | Routine | sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration | 6.5 | 0.0010 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.