# ALAS2023-2026-3251: Security update for 19 packages

ALAS2023-2026-3251, released November 7, 2026, fixes 169 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3251
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-98794, rated Critical)
- CVEs: 169, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3251.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel-livepatch-6.18.56-125.164](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.56-125.164.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |
| [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.56-125.164.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-98794](https://patchblox.com/security/data/cve/CVE-2026-98794.md) | Urgent | ipvs: filter some flags received in the backup server | 9.1 | 0.0022 |  |
| [CVE-2026-98573](https://patchblox.com/security/data/cve/CVE-2026-98573.md) | Urgent | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | 9.4 | 0.0022 |  |
| [CVE-2026-98621](https://patchblox.com/security/data/cve/CVE-2026-98621.md) | Urgent | net: gue: reject invalid REMCSUM offsets | 9.1 | 0.0022 |  |
| [CVE-2026-68399](https://patchblox.com/security/data/cve/CVE-2026-68399.md) | Urgent | bpf: Fix UAF in sock clone early bailouts | 9.8 | 0.0017 |  |
| [CVE-2026-98432](https://patchblox.com/security/data/cve/CVE-2026-98432.md) | High | ipv4: free inet_opt and ireq_opt after an RCU grace period | 9.8 | 0.0076 |  |
| [CVE-2026-98490](https://patchblox.com/security/data/cve/CVE-2026-98490.md) | High | net: openvswitch: conntrack: fix helper UAF due to extensions realloc | 9.8 | 0.0070 |  |
| [CVE-2026-98548](https://patchblox.com/security/data/cve/CVE-2026-98548.md) | High | sctp: discard the rest of the packet on a stale-cookie error | 9.8 | 0.0069 |  |
| [CVE-2026-98550](https://patchblox.com/security/data/cve/CVE-2026-98550.md) | High | tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow | 7.5 | 0.0068 |  |
| [CVE-2026-98532](https://patchblox.com/security/data/cve/CVE-2026-98532.md) | High | ipv6: do not let ipv6_find_hdr() return an offset past the packet end | 8.1 | 0.0061 |  |
| [CVE-2026-98549](https://patchblox.com/security/data/cve/CVE-2026-98549.md) | High | tcp: prevent collapsing skbs across boundary in rtx queue | 9.1 | 0.0056 |  |
| [CVE-2026-98497](https://patchblox.com/security/data/cve/CVE-2026-98497.md) | High | net/mlx5e: fix swapped IPv6 IPsec policy masks | 7.5 | 0.0046 |  |
| [CVE-2026-80734](https://patchblox.com/security/data/cve/CVE-2026-80734.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: initialize inode mapping flags for cached... | 8.8 | 0.0042 |  |
| [CVE-2026-98451](https://patchblox.com/security/data/cve/CVE-2026-98451.md) | High | smb: client: use finish_no_open() for non-regular inodes | 8.8 | 0.0040 |  |
| [CVE-2026-98479](https://patchblox.com/security/data/cve/CVE-2026-98479.md) | High | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | 7.5 | 0.0039 |  |
| [CVE-2026-98454](https://patchblox.com/security/data/cve/CVE-2026-98454.md) | High | smb: client: fix create context out-of-bounds reads | 8.1 | 0.0039 |  |
| [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 |  |
| [CVE-2026-98375](https://patchblox.com/security/data/cve/CVE-2026-98375.md) | High | xen/netfront: drop RX packets with a short Ethernet header | 7.0 | 0.0022 |  |
| [CVE-2026-98626](https://patchblox.com/security/data/cve/CVE-2026-98626.md) | High | bpf: Restrict CO-RE poisoning to relocatable instructions | 7.1 | 0.0021 |  |
| [CVE-2026-98034](https://patchblox.com/security/data/cve/CVE-2026-98034.md) | High | bpf: Mark NULL kptr stores precise | 7.1 | 0.0020 |  |
| [CVE-2026-98463](https://patchblox.com/security/data/cve/CVE-2026-98463.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Derive SCX_RQ_IN_WAKEUP from the core... | n/a | 0.0020 |  |
| [CVE-2026-98542](https://patchblox.com/security/data/cve/CVE-2026-98542.md) | High | cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict | n/a | 0.0020 |  |
| [CVE-2026-98552](https://patchblox.com/security/data/cve/CVE-2026-98552.md) | High | perf/core: Fix a refcount leak in attach_perf_ctx_data() | n/a | 0.0020 |  |
| [CVE-2026-98584](https://patchblox.com/security/data/cve/CVE-2026-98584.md) | High | net/sched: fix potential stack infoleak in em_text_dump() | n/a | 0.0020 |  |
| [CVE-2026-98595](https://patchblox.com/security/data/cve/CVE-2026-98595.md) | High | udp: remove a disconnected socket from the 4-tuple hash table | n/a | 0.0020 |  |
| [CVE-2026-98804](https://patchblox.com/security/data/cve/CVE-2026-98804.md) | High | net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() | n/a | 0.0020 |  |
| [CVE-2026-98933](https://patchblox.com/security/data/cve/CVE-2026-98933.md) | High | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0018 |  |
| [CVE-2026-98716](https://patchblox.com/security/data/cve/CVE-2026-98716.md) | High | KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted | 7.8 | 0.0018 |  |
| [CVE-2026-98466](https://patchblox.com/security/data/cve/CVE-2026-98466.md) | High | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 | 9.8 | 0.0017 |  |
| [CVE-2026-98469](https://patchblox.com/security/data/cve/CVE-2026-98469.md) | High | KVM: arm64: Fix AArch32 DBGBXVR<n> handling | 7.1 | 0.0017 |  |
| [CVE-2026-98485](https://patchblox.com/security/data/cve/CVE-2026-98485.md) | High | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | 7.1 | 0.0017 |  |
| [CVE-2026-98446](https://patchblox.com/security/data/cve/CVE-2026-98446.md) | High | xfs: don't let hidden_space go negative in xfs_metafile_resv_init | n/a | 0.0017 |  |
| [CVE-2026-98686](https://patchblox.com/security/data/cve/CVE-2026-98686.md) | High | smb: client: discard post-EOF pagecache when extending a file via zero range | 7.1 | 0.0017 |  |
| [CVE-2026-98846](https://patchblox.com/security/data/cve/CVE-2026-98846.md) | High | sctp: check RCV_SHUTDOWN after the sendmsg connect wait | 7.5 | 0.0017 |  |
| [CVE-2026-98491](https://patchblox.com/security/data/cve/CVE-2026-98491.md) | High | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | 7.8 | 0.0017 |  |
| [CVE-2026-98720](https://patchblox.com/security/data/cve/CVE-2026-98720.md) | High | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified | 7.7 | 0.0017 |  |
| [CVE-2026-98801](https://patchblox.com/security/data/cve/CVE-2026-98801.md) | High | net: restrict SO_RESERVE_MEM to TCP sockets and cap max value | 7.1 | 0.0017 |  |
| [CVE-2026-98611](https://patchblox.com/security/data/cve/CVE-2026-98611.md) | High | bpf: Check params size before reading reserved fields | n/a | 0.0017 |  |
| [CVE-2026-98713](https://patchblox.com/security/data/cve/CVE-2026-98713.md) | High | KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT | n/a | 0.0017 |  |
| [CVE-2026-98728](https://patchblox.com/security/data/cve/CVE-2026-98728.md) | High | tpm: fix off-by-four bounds check in tpm2_get_random() | n/a | 0.0017 |  |
| [CVE-2026-98791](https://patchblox.com/security/data/cve/CVE-2026-98791.md) | High | net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference | n/a | 0.0017 |  |
| [CVE-2026-98841](https://patchblox.com/security/data/cve/CVE-2026-98841.md) | High | virt: vmgenid: set driver_data before registering notification handlers | n/a | 0.0017 |  |
| [CVE-2026-98923](https://patchblox.com/security/data/cve/CVE-2026-98923.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  arm64: io: Reject non-user protection in ioremap... | n/a | 0.0017 |  |
| [CVE-2026-98447](https://patchblox.com/security/data/cve/CVE-2026-98447.md) | High | xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots | n/a | 0.0017 |  |
| [CVE-2026-98467](https://patchblox.com/security/data/cve/CVE-2026-98467.md) | High | KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race | n/a | 0.0017 |  |
| [CVE-2026-98637](https://patchblox.com/security/data/cve/CVE-2026-98637.md) | High | KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure | n/a | 0.0017 |  |
| [CVE-2026-98638](https://patchblox.com/security/data/cve/CVE-2026-98638.md) | High | KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() | n/a | 0.0017 |  |
| [CVE-2026-98683](https://patchblox.com/security/data/cve/CVE-2026-98683.md) | High | smb: client: flush dirty data before zeroing a range | n/a | 0.0017 |  |
| [CVE-2026-98729](https://patchblox.com/security/data/cve/CVE-2026-98729.md) | High | x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h | n/a | 0.0017 |  |
| [CVE-2026-98821](https://patchblox.com/security/data/cve/CVE-2026-98821.md) | High | block: reject polled dio with user integrity metadata | n/a | 0.0017 |  |
| [CVE-2026-98842](https://patchblox.com/security/data/cve/CVE-2026-98842.md) | High | module: fix lost error code from codetag_load_module() | n/a | 0.0017 |  |
| [CVE-2026-98843](https://patchblox.com/security/data/cve/CVE-2026-98843.md) | High | netfs: zero gaps in read-gaps folio to avoid writing back stale data | n/a | 0.0017 |  |
| [CVE-2026-98928](https://patchblox.com/security/data/cve/CVE-2026-98928.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Derive GUEST_HAS_SVE from the SVE fe... | n/a | 0.0017 |  |
| [CVE-2026-98507](https://patchblox.com/security/data/cve/CVE-2026-98507.md) | High | mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish | 7.8 | 0.0017 |  |
| [CVE-2026-98857](https://patchblox.com/security/data/cve/CVE-2026-98857.md) | High | ipvs: bound LBLCR and LBLC cache growth | 7.5 | 0.0017 |  |
| [CVE-2026-98487](https://patchblox.com/security/data/cve/CVE-2026-98487.md) | High | net: bridge: mdb: restart port group walk after deletion | 7.8 | 0.0016 |  |
| [CVE-2026-98383](https://patchblox.com/security/data/cve/CVE-2026-98383.md) | High | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | 7.8 | 0.0016 |  |
| [CVE-2026-98382](https://patchblox.com/security/data/cve/CVE-2026-98382.md) | High | bpf: Reject dev-bound-only programs on other devices | 7.8 | 0.0016 |  |
| [CVE-2026-98858](https://patchblox.com/security/data/cve/CVE-2026-98858.md) | High | io_uring: fix task_work add use-after-free with SQPOLL | n/a | 0.0016 |  |
| [CVE-2026-98844](https://patchblox.com/security/data/cve/CVE-2026-98844.md) | High | netfs: clear post-EOF pagecache when extending a file via write | n/a | 0.0016 |  |
| [CVE-2026-98845](https://patchblox.com/security/data/cve/CVE-2026-98845.md) | High | tpm: Disable TPM on null key name mismatch | n/a | 0.0016 |  |
| [CVE-2026-98863](https://patchblox.com/security/data/cve/CVE-2026-98863.md) | High | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails | 7.8 | 0.0015 |  |
| [CVE-2026-98543](https://patchblox.com/security/data/cve/CVE-2026-98543.md) | High | bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir | 7.3 | 0.0015 |  |
| [CVE-2026-98927](https://patchblox.com/security/data/cve/CVE-2026-98927.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: nv: Fix life cycle of the nested_mmu... | 7.0 | 0.0015 |  |
| [CVE-2026-98443](https://patchblox.com/security/data/cve/CVE-2026-98443.md) | High | xfs: fix cursor and pointer handling when recovering iunlink buckets | 7.8 | 0.0014 |  |
| [CVE-2026-98381](https://patchblox.com/security/data/cve/CVE-2026-98381.md) | High | veth: manage XDP program pointers during channel resize | 7.8 | 0.0013 |  |
| [CVE-2026-98440](https://patchblox.com/security/data/cve/CVE-2026-98440.md) | High | KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction | 7.0 | 0.0012 |  |
| [CVE-2026-98364](https://patchblox.com/security/data/cve/CVE-2026-98364.md) | High | xfrm: hold net_device reference under RCU in bundle creation | 9.8 | 0.0012 |  |
| [CVE-2026-98378](https://patchblox.com/security/data/cve/CVE-2026-98378.md) | High | bpf: Skip unsettled links in link iterator | 7.8 | 0.0012 |  |
| [CVE-2026-98937](https://patchblox.com/security/data/cve/CVE-2026-98937.md) | Routine | perf/core: Check kernel access when kernel callchains are requested | 3.3 | 0.0029 |  |
| [CVE-2026-98537](https://patchblox.com/security/data/cve/CVE-2026-98537.md) | Routine | workqueue: Fix NULL current_pwq deref in flush dependency check | 4.7 | 0.0022 |  |
| [CVE-2026-98531](https://patchblox.com/security/data/cve/CVE-2026-98531.md) | Routine | ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST | 4.4 | 0.0022 |  |
| [CVE-2026-98856](https://patchblox.com/security/data/cve/CVE-2026-98856.md) | Routine | kprobes: Skip disarmed probes when checking optkprobe overlap | 6.4 | 0.0022 |  |
| [CVE-2026-98567](https://patchblox.com/security/data/cve/CVE-2026-98567.md) | Routine | net: xps: reject an out of range traffic class | 6.7 | 0.0022 |  |
| [CVE-2026-98590](https://patchblox.com/security/data/cve/CVE-2026-98590.md) | Routine | bpf: Fix bpf_sock context code generation | 6.3 | 0.0022 |  |
| [CVE-2026-98495](https://patchblox.com/security/data/cve/CVE-2026-98495.md) | Routine | net: arp: terminate device name before lookup | 6.1 | 0.0022 |  |
| [CVE-2026-98541](https://patchblox.com/security/data/cve/CVE-2026-98541.md) | Routine | fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT | 5.9 | 0.0022 |  |
| [CVE-2026-98610](https://patchblox.com/security/data/cve/CVE-2026-98610.md) | Routine | net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget | 5.9 | 0.0022 |  |
| [CVE-2026-98554](https://patchblox.com/security/data/cve/CVE-2026-98554.md) | Routine | vlan: ensure sufficient headroom in vlan_dev_hard_header() | 5.5 | 0.0022 |  |
| [CVE-2026-98547](https://patchblox.com/security/data/cve/CVE-2026-98547.md) | Routine | af_packet: fix integer overflow in prb_calc_retire_blk_tmo() | 4.4 | 0.0022 |  |
| [CVE-2026-98569](https://patchblox.com/security/data/cve/CVE-2026-98569.md) | Routine | ip_gre: Reject enabling collect metadata through changelink | 4.4 | 0.0022 |  |
| [CVE-2026-98553](https://patchblox.com/security/data/cve/CVE-2026-98553.md) | Routine | autofs: fix sbi->pipe file reference leak in autofs_kill_sb() | 3.3 | 0.0022 |  |
| [CVE-2026-98521](https://patchblox.com/security/data/cve/CVE-2026-98521.md) | Routine | drm/i915: fix incorrect RCU teardown order | 6.5 | 0.0022 |  |
| [CVE-2026-98536](https://patchblox.com/security/data/cve/CVE-2026-98536.md) | Routine | writeback: report a Tasks-RCU quiescent state per cgwb drain pass | 4.1 | 0.0022 |  |
| [CVE-2026-98935](https://patchblox.com/security/data/cve/CVE-2026-98935.md) | Routine | rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak | 3.3 | 0.0022 |  |
| [CVE-2026-98606](https://patchblox.com/security/data/cve/CVE-2026-98606.md) | Routine | drm/virtio: release the GEM object on virtio_gpu_vram_create() errors | 6.5 | 0.0021 |  |
| [CVE-2026-98568](https://patchblox.com/security/data/cve/CVE-2026-98568.md) | Routine | vxlan: use one headroom snapshot for neighbour replies | 6.0 | 0.0021 |  |
| [CVE-2026-98588](https://patchblox.com/security/data/cve/CVE-2026-98588.md) | Routine | bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc | 5.7 | 0.0021 |  |
| [CVE-2026-98625](https://patchblox.com/security/data/cve/CVE-2026-98625.md) | Routine | netfilter: flowtable: publish HW_DEAD after worker is done | 5.7 | 0.0021 |  |
| [CVE-2026-98643](https://patchblox.com/security/data/cve/CVE-2026-98643.md) | Routine | bpf: Fix out-of-bounds read of rtt_min in sock_ops | 4.4 | 0.0021 |  |
| [CVE-2026-98934](https://patchblox.com/security/data/cve/CVE-2026-98934.md) | Routine | ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() | 1.9 | 0.0021 |  |
| [CVE-2026-98631](https://patchblox.com/security/data/cve/CVE-2026-98631.md) | Routine | xsk: Use a 32-bit compare in xsk_map_gen_lookup | 6.0 | 0.0021 |  |
| [CVE-2026-98695](https://patchblox.com/security/data/cve/CVE-2026-98695.md) | Routine | USB: serial: fix ioctl hangup race | 4.2 | 0.0021 |  |
| [CVE-2026-98539](https://patchblox.com/security/data/cve/CVE-2026-98539.md) | Routine | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga | 6.3 | 0.0021 |  |
| [CVE-2026-98523](https://patchblox.com/security/data/cve/CVE-2026-98523.md) | Routine | drm/client: fix restore of partially initialized client | 3.3 | 0.0021 |  |
| [CVE-2026-98528](https://patchblox.com/security/data/cve/CVE-2026-98528.md) | Routine | gpio: cdev: fix kernel stack leak to user-space in error path | 3.3 | 0.0021 |  |
| [CVE-2026-98851](https://patchblox.com/security/data/cve/CVE-2026-98851.md) | Routine | netfilter: nft_flow_offload: drop flowtable reference on init error path | 2.3 | 0.0021 |  |
| [CVE-2026-98545](https://patchblox.com/security/data/cve/CVE-2026-98545.md) | Routine | ata: libata-scsi: bound the ATA passthru sense descriptor writes | 6.8 | 0.0021 |  |
| [CVE-2026-98468](https://patchblox.com/security/data/cve/CVE-2026-98468.md) | Routine | KVM: arm64: Fix spurious warning for benign stage 2 teardown race | 5.5 | 0.0021 |  |
| [CVE-2026-98644](https://patchblox.com/security/data/cve/CVE-2026-98644.md) | Routine | bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() | 4.4 | 0.0021 |  |
| [CVE-2026-98820](https://patchblox.com/security/data/cve/CVE-2026-98820.md) | Routine | blk-mq: set RQF_USE_SCHED when the operation is known | 4.1 | 0.0021 |  |
| [CVE-2026-98484](https://patchblox.com/security/data/cve/CVE-2026-98484.md) | Routine | netfilter: nf_tables: skip expired catchall elements on insert and delete | 3.4 | 0.0021 |  |
| [CVE-2026-98629](https://patchblox.com/security/data/cve/CVE-2026-98629.md) | Routine | net/sched: cls_u32: fix manual hash table handle IDR aliasing | 3.4 | 0.0021 |  |
| [CVE-2026-98596](https://patchblox.com/security/data/cve/CVE-2026-98596.md) | Routine | ipv6: Fix dst leak for uncached routes. | 3.3 | 0.0021 |  |
| [CVE-2026-98591](https://patchblox.com/security/data/cve/CVE-2026-98591.md) | Routine | bpf: Fix bounds check for skb-backed dynptrs | 6.7 | 0.0020 |  |
| [CVE-2026-98862](https://patchblox.com/security/data/cve/CVE-2026-98862.md) | Routine | audit: fix exe mark UAF in kill_rules() | 6.0 | 0.0020 |  |
| [CVE-2026-98855](https://patchblox.com/security/data/cve/CVE-2026-98855.md) | Routine | of/overlay: put property on deadprops only after changeset add succeeds | 5.2 | 0.0020 |  |
| [CVE-2026-98850](https://patchblox.com/security/data/cve/CVE-2026-98850.md) | Routine | net/packet: prevent TX_RING byte count overflow | 4.1 | 0.0020 |  |
| [CVE-2026-98503](https://patchblox.com/security/data/cve/CVE-2026-98503.md) | Routine | packet: use ubuf_info completion for TX_RING packets | 6.0 | 0.0020 |  |
| [CVE-2026-98506](https://patchblox.com/security/data/cve/CVE-2026-98506.md) | Routine | mm/hugetlb: do not dissolve gigantic pages without runtime support | 5.7 | 0.0020 |  |
| [CVE-2026-98508](https://patchblox.com/security/data/cve/CVE-2026-98508.md) | Routine | drm/virtio: fix NULL pointer dereference on fence allocation failure | 5.5 | 0.0020 |  |
| [CVE-2026-98717](https://patchblox.com/security/data/cve/CVE-2026-98717.md) | Routine | KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy | 4.7 | 0.0020 |  |
| [CVE-2026-98509](https://patchblox.com/security/data/cve/CVE-2026-98509.md) | Routine | drm/virtio: fix memory leak of fence event on execbuffer failure | 3.3 | 0.0020 |  |
| [CVE-2026-98505](https://patchblox.com/security/data/cve/CVE-2026-98505.md) | Routine | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() | 1.9 | 0.0020 |  |
| [CVE-2026-98598](https://patchblox.com/security/data/cve/CVE-2026-98598.md) | Routine | ipv6: Prevent rt6_insert_exception() for dying fib6_info. | 4.1 | 0.0020 |  |
| [CVE-2026-98655](https://patchblox.com/security/data/cve/CVE-2026-98655.md) | Routine | perf: Require kernel access for text poke events | 5.5 | 0.0019 |  |
| [CVE-2026-98925](https://patchblox.com/security/data/cve/CVE-2026-98925.md) | Routine | bpf, sockmap: Fix self-redirect copied_seq double-counting | 5.5 | 0.0019 |  |
| [CVE-2026-98924](https://patchblox.com/security/data/cve/CVE-2026-98924.md) | Routine | fs: avoid repeated scans in evict_inodes() | 4.1 | 0.0019 |  |
| [CVE-2026-98763](https://patchblox.com/security/data/cve/CVE-2026-98763.md) | Routine | usb: core: clear both ep_in and ep_out for non-ep0 control endpoints | 6.8 | 0.0018 |  |
| [CVE-2026-98805](https://patchblox.com/security/data/cve/CVE-2026-98805.md) | Routine | tipc: prevent GCM nonce reuse on peer key changes | 6.8 | 0.0018 |  |
| [CVE-2026-98790](https://patchblox.com/security/data/cve/CVE-2026-98790.md) | Routine | perf: Fix race between perf_event_exit_task() and perf_pending_task() | 2.5 | 0.0018 |  |
| [CVE-2026-98811](https://patchblox.com/security/data/cve/CVE-2026-98811.md) | Routine | net/sched: cls_api: reclaim an empty proto on the error path | 1.9 | 0.0018 |  |
| [CVE-2026-98775](https://patchblox.com/security/data/cve/CVE-2026-98775.md) | Routine | nitro_enclaves: fix use-after-free on SLOT_ALLOC failure | 6.5 | 0.0018 |  |
| [CVE-2026-98614](https://patchblox.com/security/data/cve/CVE-2026-98614.md) | Routine | sctp: avoid livelock while updating retransmit path | 5.9 | 0.0018 |  |
| [CVE-2026-98772](https://patchblox.com/security/data/cve/CVE-2026-98772.md) | Routine | USB: serial: fix port tear down use-after-free | 5.7 | 0.0018 |  |
| [CVE-2026-98380](https://patchblox.com/security/data/cve/CVE-2026-98380.md) | Routine | net/sched: reject IDR error pointers when deleting actions | 5.5 | 0.0018 |  |
| [CVE-2026-98608](https://patchblox.com/security/data/cve/CVE-2026-98608.md) | Routine | drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() | 5.5 | 0.0018 |  |
| [CVE-2026-98609](https://patchblox.com/security/data/cve/CVE-2026-98609.md) | Routine | drm/virtio: fix object leak when drm_gem_handle_create() fails | 5.5 | 0.0018 |  |
| [CVE-2026-98624](https://patchblox.com/security/data/cve/CVE-2026-98624.md) | Routine | netfilter: nfnetlink_queue: hold nfnl mutex in event notifier | 5.5 | 0.0018 |  |
| [CVE-2026-98636](https://patchblox.com/security/data/cve/CVE-2026-98636.md) | Routine | squashfs: Add dictionary size range check to prevent shift-out-of-bounds | 4.4 | 0.0018 |  |
| [CVE-2026-98453](https://patchblox.com/security/data/cve/CVE-2026-98453.md) | Routine | smb: client: close handle after create-context parsing failure | 4.3 | 0.0018 |  |
| [CVE-2026-98613](https://patchblox.com/security/data/cve/CVE-2026-98613.md) | Routine | bpf: Bound ownership depth through local kptrs and graph roots | 3.3 | 0.0018 |  |
| [CVE-2026-98450](https://patchblox.com/security/data/cve/CVE-2026-98450.md) | Routine | smb: client: close completed creates on compound wait errors | 3.1 | 0.0018 |  |
| [CVE-2026-98831](https://patchblox.com/security/data/cve/CVE-2026-98831.md) | Routine | of/overlay: don't leak fragment references when changeset init fails | 2.3 | 0.0018 |  |
| [CVE-2026-98750](https://patchblox.com/security/data/cve/CVE-2026-98750.md) | Routine | tty: fix saved termios reset race | 6.4 | 0.0018 |  |
| [CVE-2026-98752](https://patchblox.com/security/data/cve/CVE-2026-98752.md) | Routine | tty: port: fix tty_port_tty_vhangup() race | 5.7 | 0.0018 |  |
| [CVE-2026-98696](https://patchblox.com/security/data/cve/CVE-2026-98696.md) | Routine | USB: serial: fix driver deregistration order | 5.2 | 0.0018 |  |
| [CVE-2026-98681](https://patchblox.com/security/data/cve/CVE-2026-98681.md) | Routine | smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races | 5.0 | 0.0018 |  |
| [CVE-2026-98751](https://patchblox.com/security/data/cve/CVE-2026-98751.md) | Routine | tty: abort break signalling on hangup | 4.7 | 0.0018 |  |
| [CVE-2026-98753](https://patchblox.com/security/data/cve/CVE-2026-98753.md) | Routine | tty: tty_port: restore TTY_IO_ERROR on activation failure | 4.7 | 0.0018 |  |
| [CVE-2026-98840](https://patchblox.com/security/data/cve/CVE-2026-98840.md) | Routine | vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF | 4.7 | 0.0018 |  |
| [CVE-2026-98771](https://patchblox.com/security/data/cve/CVE-2026-98771.md) | Routine | usb: storage: sierra_ms: reject short SWoC info transfers | 4.3 | 0.0018 |  |
| [CVE-2026-98697](https://patchblox.com/security/data/cve/CVE-2026-98697.md) | Routine | USB: serial: fix dynamic id driver deregistration race | 1.9 | 0.0018 |  |
| [CVE-2026-98452](https://patchblox.com/security/data/cve/CVE-2026-98452.md) | Routine | smb: client: clean up failed cached directory opens | 5.5 | 0.0018 |  |
| [CVE-2026-98807](https://patchblox.com/security/data/cve/CVE-2026-98807.md) | Routine | net/mlx5: Fix slab-out-of-bounds when handling team device events | 3.4 | 0.0018 |  |
| [CVE-2026-98448](https://patchblox.com/security/data/cve/CVE-2026-98448.md) | Routine | xfs: release orphanage dir inode if chown fails | 2.3 | 0.0018 |  |
| [CVE-2026-98793](https://patchblox.com/security/data/cve/CVE-2026-98793.md) | Routine | netfilter: bpf: reject invalid NAT manipulation types | 6.7 | 0.0017 |  |
| [CVE-2026-98586](https://patchblox.com/security/data/cve/CVE-2026-98586.md) | Routine | sctp: hold asoc or transport before mod_timer() in timer handlers | 5.9 | 0.0017 |  |
| [CVE-2026-98647](https://patchblox.com/security/data/cve/CVE-2026-98647.md) | Routine | bpf: Fix divide-by-zero in btf_struct_walk() | 5.5 | 0.0017 |  |
| [CVE-2026-98833](https://patchblox.com/security/data/cve/CVE-2026-98833.md) | Routine | mtd: core: call _get_device() with the master MTD | 4.4 | 0.0017 |  |
| [CVE-2026-98607](https://patchblox.com/security/data/cve/CVE-2026-98607.md) | Routine | drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() | 3.3 | 0.0017 |  |
| [CVE-2026-98773](https://patchblox.com/security/data/cve/CVE-2026-98773.md) | Routine | USB: cdc-acm: skip URB restart in port_shutdown if disconnected | 5.7 | 0.0017 |  |
| [CVE-2026-98745](https://patchblox.com/security/data/cve/CVE-2026-98745.md) | Routine | arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems | 4.7 | 0.0017 |  |
| [CVE-2026-98377](https://patchblox.com/security/data/cve/CVE-2026-98377.md) | Routine | vlan: require the MAC header to be present in __vlan_insert_inner_tag() | 5.5 | 0.0017 |  |
| [CVE-2026-98379](https://patchblox.com/security/data/cve/CVE-2026-98379.md) | Routine | netfilter: ip6t_rpfilter: reject routes without inet6_dev | 5.5 | 0.0017 |  |
| [CVE-2026-98642](https://patchblox.com/security/data/cve/CVE-2026-98642.md) | Routine | bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk | 6.4 | 0.0017 |  |
| [CVE-2026-98084](https://patchblox.com/security/data/cve/CVE-2026-98084.md) | Routine | bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks | 6.3 | 0.0017 |  |
| [CVE-2026-98634](https://patchblox.com/security/data/cve/CVE-2026-98634.md) | Routine | scsi: sd_zbc: Reject disks with too many zones | 6.1 | 0.0017 |  |
| [CVE-2026-98646](https://patchblox.com/security/data/cve/CVE-2026-98646.md) | Routine | tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context | 5.5 | 0.0017 |  |
| [CVE-2026-98792](https://patchblox.com/security/data/cve/CVE-2026-98792.md) | Routine | netfilter: flowtable: generalize pending status bit | 5.2 | 0.0017 |  |
| [CVE-2026-98641](https://patchblox.com/security/data/cve/CVE-2026-98641.md) | Routine | bpf, arm64: set up the frame pointer for the exception callback | 5.1 | 0.0017 |  |
| [CVE-2026-98477](https://patchblox.com/security/data/cve/CVE-2026-98477.md) | Routine | perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() | 4.4 | 0.0017 |  |
| [CVE-2026-98839](https://patchblox.com/security/data/cve/CVE-2026-98839.md) | Routine | vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() | 3.0 | 0.0017 |  |
| [CVE-2026-98684](https://patchblox.com/security/data/cve/CVE-2026-98684.md) | Routine | smb: client: flush and commit data before querying allocated ranges | 2.5 | 0.0017 |  |
| [CVE-2026-98373](https://patchblox.com/security/data/cve/CVE-2026-98373.md) | Routine | kernel-uek: ELSA-2026-500572: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0016 |  |
| [CVE-2026-98854](https://patchblox.com/security/data/cve/CVE-2026-98854.md) | Routine | of/overlay: only treat a positive changeset id as registered | 4.1 | 0.0016 |  |
| [CVE-2026-98797](https://patchblox.com/security/data/cve/CVE-2026-98797.md) | Routine | net: cap skb->queue_mapping when the tx queue is picked | 6.4 | 0.0016 |  |
| [CVE-2026-98859](https://patchblox.com/security/data/cve/CVE-2026-98859.md) | Routine | HID: multitouch: stop the release timer from being rearmed on remove | 5.7 | 0.0016 |  |
| [CVE-2026-98852](https://patchblox.com/security/data/cve/CVE-2026-98852.md) | Routine | net: extend IPv6 exthdr detection of tunneled packets | 3.7 | 0.0016 |  |
| [CVE-2026-98384](https://patchblox.com/security/data/cve/CVE-2026-98384.md) | Routine | bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() | 3.3 | 0.0016 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.