# ALAS2023-2026-3336: Security update for 19 packages

ALAS2023-2026-3336, released November 7, 2026, fixes 197 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3336
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-90048, rated Critical)
- CVEs: 197, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3336.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-livepatch-6.1.189-236.399](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.189-236.399.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [microvm-kernel](https://patchblox.com/security/data/product/linux/microvm-kernel.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |
| [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.189-236.399.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-90048](https://patchblox.com/security/data/cve/CVE-2026-90048.md) | Urgent | fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() | 9.8 | 0.0072 |  |
| [CVE-2026-98171](https://patchblox.com/security/data/cve/CVE-2026-98171.md) | Urgent | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | 9.8 | 0.0054 |  |
| [CVE-2026-98167](https://patchblox.com/security/data/cve/CVE-2026-98167.md) | Urgent | smb: client: fix server->total_read for compound encrypted PDUs | 9.8 | 0.0022 |  |
| [CVE-2026-98573](https://patchblox.com/security/data/cve/CVE-2026-98573.md) | Urgent | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | 9.4 | 0.0022 |  |
| [CVE-2026-98621](https://patchblox.com/security/data/cve/CVE-2026-98621.md) | Urgent | net: gue: reject invalid REMCSUM offsets | 9.1 | 0.0022 |  |
| [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 |  |
| [CVE-2026-98322](https://patchblox.com/security/data/cve/CVE-2026-98322.md) | Urgent | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | 0.0018 |  |
| [CVE-2026-98301](https://patchblox.com/security/data/cve/CVE-2026-98301.md) | Urgent | net: bridge: mst: move switchdev call outside rcu | 9.8 | 0.0018 |  |
| [CVE-2026-98303](https://patchblox.com/security/data/cve/CVE-2026-98303.md) | Urgent | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | 9.8 | 0.0018 |  |
| [CVE-2026-98233](https://patchblox.com/security/data/cve/CVE-2026-98233.md) | Urgent | net/packet: clear RX owner on VNET header error | 9.8 | 0.0018 |  |
| [CVE-2026-98255](https://patchblox.com/security/data/cve/CVE-2026-98255.md) | Urgent | tcp: exclude old ACKs from tcp fast path | 9.8 | 0.0018 |  |
| [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 |  |
| [CVE-2026-98249](https://patchblox.com/security/data/cve/CVE-2026-98249.md) | Urgent | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | 0.0017 |  |
| [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 |  |
| [CVE-2026-98222](https://patchblox.com/security/data/cve/CVE-2026-98222.md) | Urgent | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | 0.0017 |  |
| [CVE-2026-98320](https://patchblox.com/security/data/cve/CVE-2026-98320.md) | Urgent | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | 0.0014 |  |
| [CVE-2026-98251](https://patchblox.com/security/data/cve/CVE-2026-98251.md) | Urgent | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | 0.0013 |  |
| [CVE-2026-98253](https://patchblox.com/security/data/cve/CVE-2026-98253.md) | Urgent | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | 0.0013 |  |
| [CVE-2026-98252](https://patchblox.com/security/data/cve/CVE-2026-98252.md) | Urgent | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | 0.0012 |  |
| [CVE-2026-98368](https://patchblox.com/security/data/cve/CVE-2026-98368.md) | Urgent | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | 0.0012 |  |
| [CVE-2026-97524](https://patchblox.com/security/data/cve/CVE-2026-97524.md) | High | mptcp: avoid unneeded actions on subflow reset | 9.8 | 0.0075 |  |
| [CVE-2026-97523](https://patchblox.com/security/data/cve/CVE-2026-97523.md) | High | mptcp: close race between scheduler and state change | 7.5 | 0.0073 |  |
| [CVE-2026-98548](https://patchblox.com/security/data/cve/CVE-2026-98548.md) | High | sctp: discard the rest of the packet on a stale-cookie error | 9.8 | 0.0069 |  |
| [CVE-2026-68161](https://patchblox.com/security/data/cve/CVE-2026-68161.md) | High | sctp: close UDP tunnel sockets during netns teardown | 9.8 | 0.0068 |  |
| [CVE-2026-98550](https://patchblox.com/security/data/cve/CVE-2026-98550.md) | High | tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow | 7.5 | 0.0068 |  |
| [CVE-2026-89648](https://patchblox.com/security/data/cve/CVE-2026-89648.md) | High | ceph: cap delegated inode count in ceph_parse_deleg_inos() | 7.5 | 0.0068 |  |
| [CVE-2026-98532](https://patchblox.com/security/data/cve/CVE-2026-98532.md) | High | ipv6: do not let ipv6_find_hdr() return an offset past the packet end | 8.1 | 0.0061 |  |
| [CVE-2026-98069](https://patchblox.com/security/data/cve/CVE-2026-98069.md) | High | net/rds: acquire the fastpath locks in rds_conn_shutdown() | 8.1 | 0.0056 |  |
| [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 |  |
| [CVE-2026-98070](https://patchblox.com/security/data/cve/CVE-2026-98070.md) | High | net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() | 8.1 | 0.0047 |  |
| [CVE-2026-98130](https://patchblox.com/security/data/cve/CVE-2026-98130.md) | High | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | 8.1 | 0.0045 |  |
| [CVE-2026-98169](https://patchblox.com/security/data/cve/CVE-2026-98169.md) | High | smb: client: fix potential OOB read in smb3_enum_snapshots() | 7.1 | 0.0045 |  |
| [CVE-2026-98479](https://patchblox.com/security/data/cve/CVE-2026-98479.md) | High | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | 7.5 | 0.0039 |  |
| [CVE-2026-93787](https://patchblox.com/security/data/cve/CVE-2026-93787.md) | High | smb: client: bound dirent name against end of SMB response in cifs_filldir | 9.8 | 0.0034 |  |
| [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 |  |
| [CVE-2026-89796](https://patchblox.com/security/data/cve/CVE-2026-89796.md) | High | mm/damon/core: avoid infinite kdamond_merge_regions() internal loop | 7.8 | 0.0023 |  |
| [CVE-2026-97564](https://patchblox.com/security/data/cve/CVE-2026-97564.md) | High | smb: client: reject userspace cifs.idmap descriptions | 7.8 | 0.0022 |  |
| [CVE-2026-97598](https://patchblox.com/security/data/cve/CVE-2026-97598.md) | High | ipv4: fib: bound automatic table ID allocation | 7.8 | 0.0022 |  |
| [CVE-2026-97998](https://patchblox.com/security/data/cve/CVE-2026-97998.md) | High | netfilter: nfnetlink_log: cope with concurrent instance destruction | 7.8 | 0.0022 |  |
| [CVE-2026-98076](https://patchblox.com/security/data/cve/CVE-2026-98076.md) | High | tracing/probes: Fix use-after-free on field name/type of events with multiple probes | 7.8 | 0.0022 |  |
| [CVE-2026-97568](https://patchblox.com/security/data/cve/CVE-2026-97568.md) | High | mptcp: syncookies: remember the request backup flag | 7.1 | 0.0022 |  |
| [CVE-2026-97904](https://patchblox.com/security/data/cve/CVE-2026-97904.md) | High | cpufreq: initialize policy rwsem before sysfs publication | 7.0 | 0.0022 |  |
| [CVE-2026-98626](https://patchblox.com/security/data/cve/CVE-2026-98626.md) | High | bpf: Restrict CO-RE poisoning to relocatable instructions | 7.1 | 0.0021 |  |
| [CVE-2026-97556](https://patchblox.com/security/data/cve/CVE-2026-97556.md) | High | smb: client: avoid leaking refcount when cifs_sb_tlink() fails | 8.8 | 0.0021 |  |
| [CVE-2026-98104](https://patchblox.com/security/data/cve/CVE-2026-98104.md) | High | net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted | 7.8 | 0.0021 |  |
| [CVE-2026-98034](https://patchblox.com/security/data/cve/CVE-2026-98034.md) | High | bpf: Mark NULL kptr stores precise | 7.1 | 0.0020 |  |
| [CVE-2026-98260](https://patchblox.com/security/data/cve/CVE-2026-98260.md) | High | exec: Cleanup POSIX timers right after de_thread() | 8.8 | 0.0019 |  |
| [CVE-2026-68289](https://patchblox.com/security/data/cve/CVE-2026-68289.md) | High | tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() | 7.0 | 0.0018 |  |
| [CVE-2026-98900](https://patchblox.com/security/data/cve/CVE-2026-98900.md) | High | xen/gntalloc: validate grant count before allocation | 7.8 | 0.0018 |  |
| [CVE-2026-98881](https://patchblox.com/security/data/cve/CVE-2026-98881.md) | High | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | 7.1 | 0.0018 |  |
| [CVE-2026-98902](https://patchblox.com/security/data/cve/CVE-2026-98902.md) | High | md/raid5: let stripe batch bm_seq comparison wrap-safe | 7.1 | 0.0018 |  |
| [CVE-2026-89638](https://patchblox.com/security/data/cve/CVE-2026-89638.md) | High | smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions | 8.8 | 0.0018 |  |
| [CVE-2026-97959](https://patchblox.com/security/data/cve/CVE-2026-97959.md) | High | net/sched: cls_route: free emptied bucket on filter move | 9.1 | 0.0018 |  |
| [CVE-2026-97995](https://patchblox.com/security/data/cve/CVE-2026-97995.md) | High | virtio_console: do not free control-out buffers on remove | 7.8 | 0.0018 |  |
| [CVE-2026-98011](https://patchblox.com/security/data/cve/CVE-2026-98011.md) | High | net/sched: hhf: clamp quantum in change and init paths | 7.8 | 0.0018 |  |
| [CVE-2026-98015](https://patchblox.com/security/data/cve/CVE-2026-98015.md) | High | net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put | 7.8 | 0.0018 |  |
| [CVE-2026-98074](https://patchblox.com/security/data/cve/CVE-2026-98074.md) | High | bonding: do not clear curr_active_slave prematurely when releasing all slaves | 7.8 | 0.0018 |  |
| [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 |  |
| [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 |  |
| [CVE-2026-97951](https://patchblox.com/security/data/cve/CVE-2026-97951.md) | High | scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands | 7.5 | 0.0018 |  |
| [CVE-2026-98063](https://patchblox.com/security/data/cve/CVE-2026-98063.md) | High | bpf: Fix NULL-ptr-deref in btf_var_show() | 7.1 | 0.0018 |  |
| [CVE-2026-98064](https://patchblox.com/security/data/cve/CVE-2026-98064.md) | High | bpf: Fix NULL-ptr-deref when showing a void BTF type | 7.1 | 0.0018 |  |
| [CVE-2026-98072](https://patchblox.com/security/data/cve/CVE-2026-98072.md) | High | net/rds: use wq_has_sleeper() in release_in_xmit() | 7.1 | 0.0018 |  |
| [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 |  |
| [CVE-2026-98234](https://patchblox.com/security/data/cve/CVE-2026-98234.md) | High | net/sched: hhf: cap hh_flows_limit at change time | 7.1 | 0.0018 |  |
| [CVE-2026-98068](https://patchblox.com/security/data/cve/CVE-2026-98068.md) | High | net/rds: don't let rds_conn_shutdown() consume a concurrent drop | 7.0 | 0.0018 |  |
| [CVE-2026-98089](https://patchblox.com/security/data/cve/CVE-2026-98089.md) | High | bonding: alb: fix uninitialized transport header access in alb_determine_nd() | 8.1 | 0.0017 |  |
| [CVE-2026-93785](https://patchblox.com/security/data/cve/CVE-2026-93785.md) | High | cifs: validate idmap key payload length | 7.8 | 0.0017 |  |
| [CVE-2026-97441](https://patchblox.com/security/data/cve/CVE-2026-97441.md) | High | ata: ahci: fail probe if BAR too small for claimed ports | 7.8 | 0.0017 |  |
| [CVE-2026-97964](https://patchblox.com/security/data/cve/CVE-2026-97964.md) | High | ppp_synctty: ensure a writeable skb header | 7.8 | 0.0017 |  |
| [CVE-2026-98016](https://patchblox.com/security/data/cve/CVE-2026-98016.md) | High | net/mlx5e: Fix use-after-free race in sample_restore_put() | 7.8 | 0.0017 |  |
| [CVE-2026-98014](https://patchblox.com/security/data/cve/CVE-2026-98014.md) | High | net/mlx5: E-Switch, prevent mc_list repopulation during vport disable | 7.1 | 0.0017 |  |
| [CVE-2026-98046](https://patchblox.com/security/data/cve/CVE-2026-98046.md) | High | bpf: Mark bpf_btf_find_by_name_kind() as sleepable | 7.1 | 0.0017 |  |
| [CVE-2026-98075](https://patchblox.com/security/data/cve/CVE-2026-98075.md) | High | bpf: reject BPF_PSEUDO_FUNC reference to the main program | 7.1 | 0.0017 |  |
| [CVE-2026-98485](https://patchblox.com/security/data/cve/CVE-2026-98485.md) | High | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | 7.1 | 0.0017 |  |
| [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 |  |
| [CVE-2026-98088](https://patchblox.com/security/data/cve/CVE-2026-98088.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Avoid out-of-bounds cpumask_of_no... | 7.0 | 0.0017 |  |
| [CVE-2026-97612](https://patchblox.com/security/data/cve/CVE-2026-97612.md) | High | net: mpls: clear inner_protocol when the last label is popped | 7.8 | 0.0017 |  |
| [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 |  |
| [CVE-2026-98491](https://patchblox.com/security/data/cve/CVE-2026-98491.md) | High | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | 7.8 | 0.0017 |  |
| [CVE-2026-98899](https://patchblox.com/security/data/cve/CVE-2026-98899.md) | High | netfilter: ipset: mark the rcu locked areas properly | 7.8 | 0.0017 |  |
| [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 |  |
| [CVE-2026-97611](https://patchblox.com/security/data/cve/CVE-2026-97611.md) | High | net: openvswitch: fix use-after-free of the flow table mask array | 7.8 | 0.0016 |  |
| [CVE-2026-98383](https://patchblox.com/security/data/cve/CVE-2026-98383.md) | High | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | 7.8 | 0.0016 |  |
| [CVE-2026-97445](https://patchblox.com/security/data/cve/CVE-2026-97445.md) | High | ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() | 7.7 | 0.0016 |  |
| [CVE-2026-98078](https://patchblox.com/security/data/cve/CVE-2026-98078.md) | High | ipvs: fix reversed sequence option serialization | 7.8 | 0.0016 |  |
| [CVE-2026-97608](https://patchblox.com/security/data/cve/CVE-2026-97608.md) | High | netfilter: nf_log: unregister loggers before per-net teardown | 7.8 | 0.0015 |  |
| [CVE-2026-97450](https://patchblox.com/security/data/cve/CVE-2026-97450.md) | High | ACPICA: validate handler object type in two places | 8.4 | 0.0014 |  |
| [CVE-2026-97451](https://patchblox.com/security/data/cve/CVE-2026-97451.md) | High | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) | 8.4 | 0.0014 |  |
| [CVE-2026-97452](https://patchblox.com/security/data/cve/CVE-2026-97452.md) | High | ACPICA: Prevent adding invalid references | 8.4 | 0.0014 |  |
| [CVE-2026-97444](https://patchblox.com/security/data/cve/CVE-2026-97444.md) | High | ACPICA: add boundary checks in two places | 7.7 | 0.0014 |  |
| [CVE-2026-97454](https://patchblox.com/security/data/cve/CVE-2026-97454.md) | High | ACPICA: add boundary checks in acpi_ps_get_next_field() | 7.7 | 0.0014 |  |
| [CVE-2026-97455](https://patchblox.com/security/data/cve/CVE-2026-97455.md) | High | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() | 8.4 | 0.0014 |  |
| [CVE-2026-97448](https://patchblox.com/security/data/cve/CVE-2026-97448.md) | High | ACPICA: Add validation for node in acpi_ns_build_normalized_path() | 7.8 | 0.0014 |  |
| [CVE-2026-97437](https://patchblox.com/security/data/cve/CVE-2026-97437.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs3: fix out-of-bounds read in ntfs_dir_emit()... | 7.1 | 0.0014 |  |
| [CVE-2026-98369](https://patchblox.com/security/data/cve/CVE-2026-98369.md) | High | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | 7.8 | 0.0014 |  |
| [CVE-2026-98080](https://patchblox.com/security/data/cve/CVE-2026-98080.md) | High | btrfs: do not force reloc root creation during qgroup_account_snapshot() | 7.8 | 0.0013 |  |
| [CVE-2026-97415](https://patchblox.com/security/data/cve/CVE-2026-97415.md) | High | btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF | 7.8 | 0.0013 |  |
| [CVE-2026-97438](https://patchblox.com/security/data/cve/CVE-2026-97438.md) | High | fs/ntfs3: validate index entry key bounds | 7.1 | 0.0013 |  |
| [CVE-2026-93288](https://patchblox.com/security/data/cve/CVE-2026-93288.md) | High | netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state | 8.8 | 0.0013 |  |
| [CVE-2026-93817](https://patchblox.com/security/data/cve/CVE-2026-93817.md) | High | perf: Fix addr_filter_ranges lifetime | 8.8 | 0.0013 |  |
| [CVE-2026-93287](https://patchblox.com/security/data/cve/CVE-2026-93287.md) | High | i2c: smbus: reject oversized block transfers in the common path | 7.8 | 0.0013 |  |
| [CVE-2026-93798](https://patchblox.com/security/data/cve/CVE-2026-93798.md) | High | btrfs: fix reloc root cleanup in merge_reloc_roots() | 7.8 | 0.0013 |  |
| [CVE-2026-93813](https://patchblox.com/security/data/cve/CVE-2026-93813.md) | High | btrfs: tree-checker: validate INODE_REF's namelen | 7.8 | 0.0013 |  |
| [CVE-2026-97421](https://patchblox.com/security/data/cve/CVE-2026-97421.md) | High | RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() | 7.8 | 0.0013 |  |
| [CVE-2026-98017](https://patchblox.com/security/data/cve/CVE-2026-98017.md) | High | net/sched: defer qdisc freeing after failed creation | 7.8 | 0.0013 |  |
| [CVE-2026-98241](https://patchblox.com/security/data/cve/CVE-2026-98241.md) | High | ipv6: xfrm: use full sockets in local error paths | 7.8 | 0.0013 |  |
| [CVE-2026-74496](https://patchblox.com/security/data/cve/CVE-2026-74496.md) | High | fou: Fix use-after-free in fou_create() | 9.8 | 0.0013 |  |
| [CVE-2026-74289](https://patchblox.com/security/data/cve/CVE-2026-74289.md) | High | ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). | 7.8 | 0.0013 |  |
| [CVE-2026-98023](https://patchblox.com/security/data/cve/CVE-2026-98023.md) | High | vxlan: reject dynamic fdb entries that reference a nexthop id | 7.8 | 0.0013 |  |
| [CVE-2026-98276](https://patchblox.com/security/data/cve/CVE-2026-98276.md) | High | net: lock the socket in sock_gettstamp() | 7.8 | 0.0013 |  |
| [CVE-2026-98381](https://patchblox.com/security/data/cve/CVE-2026-98381.md) | High | veth: manage XDP program pointers during channel resize | 7.8 | 0.0013 |  |
| [CVE-2026-98095](https://patchblox.com/security/data/cve/CVE-2026-98095.md) | High | af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). | 7.1 | 0.0012 |  |
| [CVE-2026-98364](https://patchblox.com/security/data/cve/CVE-2026-98364.md) | High | xfrm: hold net_device reference under RCU in bundle creation | 9.8 | 0.0012 |  |
| [CVE-2026-93810](https://patchblox.com/security/data/cve/CVE-2026-93810.md) | High | cachefiles: Fix double fput | 7.8 | 0.0012 |  |
| [CVE-2026-98098](https://patchblox.com/security/data/cve/CVE-2026-98098.md) | High | tipc: fix NULL deref in tipc_named_node_up() on empty publication list | 7.8 | 0.0012 |  |
| [CVE-2026-98378](https://patchblox.com/security/data/cve/CVE-2026-98378.md) | High | bpf: Skip unsettled links in link iterator | 7.8 | 0.0012 |  |
| [CVE-2026-98359](https://patchblox.com/security/data/cve/CVE-2026-98359.md) | High | RDMA/core: Reject unregistering netdevs in ib_get_eth_speed | 7.8 | 0.0012 |  |
| [CVE-2026-98158](https://patchblox.com/security/data/cve/CVE-2026-98158.md) | High | ppp_async: drop the errored frame instead of resetting its headroom | 9.8 | 0.0011 |  |
| [CVE-2026-98413](https://patchblox.com/security/data/cve/CVE-2026-98413.md) | Routine | selinux: always fill AVC decision in avc_has_perm_noaudit() | 6.1 | 0.0022 |  |
| [CVE-2026-98537](https://patchblox.com/security/data/cve/CVE-2026-98537.md) | Routine | workqueue: Fix NULL current_pwq deref in flush dependency check | 4.7 | 0.0022 |  |
| [CVE-2026-98531](https://patchblox.com/security/data/cve/CVE-2026-98531.md) | Routine | ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST | 4.4 | 0.0022 |  |
| [CVE-2026-98567](https://patchblox.com/security/data/cve/CVE-2026-98567.md) | Routine | net: xps: reject an out of range traffic class | 6.7 | 0.0022 |  |
| [CVE-2026-98590](https://patchblox.com/security/data/cve/CVE-2026-98590.md) | Routine | bpf: Fix bpf_sock context code generation | 6.3 | 0.0022 |  |
| [CVE-2026-98495](https://patchblox.com/security/data/cve/CVE-2026-98495.md) | Routine | net: arp: terminate device name before lookup | 6.1 | 0.0022 |  |
| [CVE-2026-98541](https://patchblox.com/security/data/cve/CVE-2026-98541.md) | Routine | fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT | 5.9 | 0.0022 |  |
| [CVE-2026-98610](https://patchblox.com/security/data/cve/CVE-2026-98610.md) | Routine | net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget | 5.9 | 0.0022 |  |
| [CVE-2026-97905](https://patchblox.com/security/data/cve/CVE-2026-97905.md) | Routine | cpufreq: zero-initialize policy cpumask before sysfs publication | 5.5 | 0.0022 |  |
| [CVE-2026-98077](https://patchblox.com/security/data/cve/CVE-2026-98077.md) | Routine | netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | 5.5 | 0.0022 |  |
| [CVE-2026-98388](https://patchblox.com/security/data/cve/CVE-2026-98388.md) | Routine | exec: do_close_on_exec() before taking exec_update_lock | 5.5 | 0.0022 |  |
| [CVE-2026-98554](https://patchblox.com/security/data/cve/CVE-2026-98554.md) | Routine | vlan: ensure sufficient headroom in vlan_dev_hard_header() | 5.5 | 0.0022 |  |
| [CVE-2026-97596](https://patchblox.com/security/data/cve/CVE-2026-97596.md) | Routine | ipvs: reject invalid states in connection template sync records | 4.8 | 0.0022 |  |
| [CVE-2026-98404](https://patchblox.com/security/data/cve/CVE-2026-98404.md) | Routine | drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() | 4.7 | 0.0022 |  |
| [CVE-2026-98547](https://patchblox.com/security/data/cve/CVE-2026-98547.md) | Routine | af_packet: fix integer overflow in prb_calc_retire_blk_tmo() | 4.4 | 0.0022 |  |
| [CVE-2026-98569](https://patchblox.com/security/data/cve/CVE-2026-98569.md) | Routine | ip_gre: Reject enabling collect metadata through changelink | 4.4 | 0.0022 |  |
| [CVE-2026-98553](https://patchblox.com/security/data/cve/CVE-2026-98553.md) | Routine | autofs: fix sbi->pipe file reference leak in autofs_kill_sb() | 3.3 | 0.0022 |  |
| [CVE-2026-98521](https://patchblox.com/security/data/cve/CVE-2026-98521.md) | Routine | drm/i915: fix incorrect RCU teardown order | 6.5 | 0.0022 |  |
| [CVE-2026-98536](https://patchblox.com/security/data/cve/CVE-2026-98536.md) | Routine | writeback: report a Tasks-RCU quiescent state per cgwb drain pass | 4.1 | 0.0022 |  |
| [CVE-2026-97925](https://patchblox.com/security/data/cve/CVE-2026-97925.md) | Routine | tick/broadcast: Plug clockevents replacement race | 6.7 | 0.0021 |  |
| [CVE-2026-98606](https://patchblox.com/security/data/cve/CVE-2026-98606.md) | Routine | drm/virtio: release the GEM object on virtio_gpu_vram_create() errors | 6.5 | 0.0021 |  |
| [CVE-2026-98588](https://patchblox.com/security/data/cve/CVE-2026-98588.md) | Routine | bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc | 5.7 | 0.0021 |  |
| [CVE-2026-98625](https://patchblox.com/security/data/cve/CVE-2026-98625.md) | Routine | netfilter: flowtable: publish HW_DEAD after worker is done | 5.7 | 0.0021 |  |
| [CVE-2026-72402](https://patchblox.com/security/data/cve/CVE-2026-72402.md) | Routine | bpf: Mask pseudo pointer values in verifier logs | 5.5 | 0.0021 |  |
| [CVE-2026-98643](https://patchblox.com/security/data/cve/CVE-2026-98643.md) | Routine | bpf: Fix out-of-bounds read of rtt_min in sock_ops | 4.4 | 0.0021 |  |
| [CVE-2026-98631](https://patchblox.com/security/data/cve/CVE-2026-98631.md) | Routine | xsk: Use a 32-bit compare in xsk_map_gen_lookup | 6.0 | 0.0021 |  |
| [CVE-2026-98644](https://patchblox.com/security/data/cve/CVE-2026-98644.md) | Routine | bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() | 4.4 | 0.0021 |  |
| [CVE-2026-98629](https://patchblox.com/security/data/cve/CVE-2026-98629.md) | Routine | net/sched: cls_u32: fix manual hash table handle IDR aliasing | 3.4 | 0.0021 |  |
| [CVE-2026-98925](https://patchblox.com/security/data/cve/CVE-2026-98925.md) | Routine | bpf, sockmap: Fix self-redirect copied_seq double-counting | 5.5 | 0.0019 |  |
| [CVE-2026-98888](https://patchblox.com/security/data/cve/CVE-2026-98888.md) | Routine | arm64: kprobes: Allow reentering kprobes while single-stepping | 5.5 | 0.0019 |  |
| [CVE-2026-98306](https://patchblox.com/security/data/cve/CVE-2026-98306.md) | Routine | seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation | 6.5 | 0.0018 |  |
| [CVE-2026-98877](https://patchblox.com/security/data/cve/CVE-2026-98877.md) | Routine | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed | 6.5 | 0.0018 |  |
| [CVE-2026-98873](https://patchblox.com/security/data/cve/CVE-2026-98873.md) | Routine | netfilter: nf_conntrack_expect: zero at allocation time | 6.1 | 0.0018 |  |
| [CVE-2026-98879](https://patchblox.com/security/data/cve/CVE-2026-98879.md) | Routine | isofs: handle set_blocksize failures | 5.5 | 0.0018 |  |
| [CVE-2026-98885](https://patchblox.com/security/data/cve/CVE-2026-98885.md) | Routine | ima: return error early if file xattr cannot be changed | 5.5 | 0.0018 |  |
| [CVE-2026-98010](https://patchblox.com/security/data/cve/CVE-2026-98010.md) | Routine | net/sched: drr: clamp quantum in change class | 6.1 | 0.0018 |  |
| [CVE-2026-98205](https://patchblox.com/security/data/cve/CVE-2026-98205.md) | Routine | Input: evdev - zero absinfo before partial copy in EVIOCSABS | 6.1 | 0.0018 |  |
| [CVE-2026-98614](https://patchblox.com/security/data/cve/CVE-2026-98614.md) | Routine | sctp: avoid livelock while updating retransmit path | 5.9 | 0.0018 |  |
| [CVE-2026-97899](https://patchblox.com/security/data/cve/CVE-2026-97899.md) | Routine | drm/i915: Fix memory leak in query_perf_config_list() | 5.5 | 0.0018 |  |
| [CVE-2026-97958](https://patchblox.com/security/data/cve/CVE-2026-97958.md) | Routine | net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). | 5.5 | 0.0018 |  |
| [CVE-2026-98012](https://patchblox.com/security/data/cve/CVE-2026-98012.md) | Routine | net/sched: sfq: clamp quantum in change path | 5.5 | 0.0018 |  |
| [CVE-2026-98022](https://patchblox.com/security/data/cve/CVE-2026-98022.md) | Routine | net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations | 5.5 | 0.0018 |  |
| [CVE-2026-98071](https://patchblox.com/security/data/cve/CVE-2026-98071.md) | Routine | net/rds: clear cp_flags bits individually in rds_conn_path_reset() | 5.5 | 0.0018 |  |
| [CVE-2026-98262](https://patchblox.com/security/data/cve/CVE-2026-98262.md) | Routine | ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY | 5.5 | 0.0018 |  |
| [CVE-2026-98299](https://patchblox.com/security/data/cve/CVE-2026-98299.md) | Routine | tcp: do not let tcp_rmem be set below 4096 | 5.5 | 0.0018 |  |
| [CVE-2026-98300](https://patchblox.com/security/data/cve/CVE-2026-98300.md) | Routine | tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). | 5.5 | 0.0018 |  |
| [CVE-2026-98344](https://patchblox.com/security/data/cve/CVE-2026-98344.md) | Routine | dmaengine: Fix device kref underflow in dma_chan_put() | 5.5 | 0.0018 |  |
| [CVE-2026-98380](https://patchblox.com/security/data/cve/CVE-2026-98380.md) | Routine | net/sched: reject IDR error pointers when deleting actions | 5.5 | 0.0018 |  |
| [CVE-2026-98608](https://patchblox.com/security/data/cve/CVE-2026-98608.md) | Routine | drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() | 5.5 | 0.0018 |  |
| [CVE-2026-98609](https://patchblox.com/security/data/cve/CVE-2026-98609.md) | Routine | drm/virtio: fix object leak when drm_gem_handle_create() fails | 5.5 | 0.0018 |  |
| [CVE-2026-98624](https://patchblox.com/security/data/cve/CVE-2026-98624.md) | Routine | netfilter: nfnetlink_queue: hold nfnl mutex in event notifier | 5.5 | 0.0018 |  |
| [CVE-2026-98636](https://patchblox.com/security/data/cve/CVE-2026-98636.md) | Routine | squashfs: Add dictionary size range check to prevent shift-out-of-bounds | 4.4 | 0.0018 |  |
| [CVE-2026-93800](https://patchblox.com/security/data/cve/CVE-2026-93800.md) | Routine | btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() | 6.7 | 0.0017 |  |
| [CVE-2026-97416](https://patchblox.com/security/data/cve/CVE-2026-97416.md) | Routine | btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() | 6.7 | 0.0017 |  |
| [CVE-2026-97476](https://patchblox.com/security/data/cve/CVE-2026-97476.md) | Routine | rds: filter RDS_INFO_* getsockopt by caller's netns | 6.5 | 0.0017 |  |
| [CVE-2026-98586](https://patchblox.com/security/data/cve/CVE-2026-98586.md) | Routine | sctp: hold asoc or transport before mod_timer() in timer handlers | 5.9 | 0.0017 |  |
| [CVE-2026-97439](https://patchblox.com/security/data/cve/CVE-2026-97439.md) | Routine | fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib | 5.7 | 0.0017 |  |
| [CVE-2026-97456](https://patchblox.com/security/data/cve/CVE-2026-97456.md) | Routine | ACPICA: Fix condition check in acpi_ps_parse_loop() | 5.6 | 0.0017 |  |
| [CVE-2026-97481](https://patchblox.com/security/data/cve/CVE-2026-97481.md) | Routine | serial: 8250: fix possible ISR soft lockup | 5.5 | 0.0017 |  |
| [CVE-2026-97483](https://patchblox.com/security/data/cve/CVE-2026-97483.md) | Routine | usb: core: hcd: fix possible deadlock in rh control transfers | 5.5 | 0.0017 |  |
| [CVE-2026-98031](https://patchblox.com/security/data/cve/CVE-2026-98031.md) | Routine | nexthop: Initialize extack in remove_nh_grp_entry() | 5.5 | 0.0017 |  |
| [CVE-2026-98647](https://patchblox.com/security/data/cve/CVE-2026-98647.md) | Routine | bpf: Fix divide-by-zero in btf_struct_walk() | 5.5 | 0.0017 |  |
| [CVE-2026-97453](https://patchblox.com/security/data/cve/CVE-2026-97453.md) | Routine | ACPICA: validate byte_count in acpi_ps_get_next_package_length() | 5.1 | 0.0017 |  |
| [CVE-2026-97484](https://patchblox.com/security/data/cve/CVE-2026-97484.md) | Routine | usbip: vhci_hcd: fix NULL deref in status_show_vhci | 5.1 | 0.0017 |  |
| [CVE-2026-93795](https://patchblox.com/security/data/cve/CVE-2026-93795.md) | Routine | blk-cgroup: fix leaks and online flag on radix_tree_insert failure | 4.7 | 0.0017 |  |
| [CVE-2026-97446](https://patchblox.com/security/data/cve/CVE-2026-97446.md) | Routine | ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() | 4.7 | 0.0017 |  |
| [CVE-2026-97420](https://patchblox.com/security/data/cve/CVE-2026-97420.md) | Routine | bpf: NUL-terminate replaced sysctl value | 4.4 | 0.0017 |  |
| [CVE-2026-97472](https://patchblox.com/security/data/cve/CVE-2026-97472.md) | Routine | ipv6: addrconf: fix temp address generation after prefix deprecation | 4.4 | 0.0017 |  |
| [CVE-2026-97449](https://patchblox.com/security/data/cve/CVE-2026-97449.md) | Routine | ACPICA: Add package limit checks in parser functions | 4.0 | 0.0017 |  |
| [CVE-2026-98607](https://patchblox.com/security/data/cve/CVE-2026-98607.md) | Routine | drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() | 3.3 | 0.0017 |  |
| [CVE-2026-98379](https://patchblox.com/security/data/cve/CVE-2026-98379.md) | Routine | netfilter: ip6t_rpfilter: reject routes without inet6_dev | 5.5 | 0.0017 |  |
| [CVE-2026-93824](https://patchblox.com/security/data/cve/CVE-2026-93824.md) | Routine | tls: reject the combination of TLS and sockmap | 6.7 | 0.0017 |  |
| [CVE-2026-93781](https://patchblox.com/security/data/cve/CVE-2026-93781.md) | Routine | scsi: core: Do not block on tag allocation in scsi_eh_lock_door() | 5.5 | 0.0017 |  |
| [CVE-2026-98354](https://patchblox.com/security/data/cve/CVE-2026-98354.md) | Routine | RDMA/mad: Fix receive buffer leak when PKey enforcement fails | 5.5 | 0.0017 |  |
| [CVE-2026-98090](https://patchblox.com/security/data/cve/CVE-2026-98090.md) | Routine | btrfs: restore active device pointers after failed sprout | 6.7 | 0.0012 |  |
| [CVE-2026-98091](https://patchblox.com/security/data/cve/CVE-2026-98091.md) | Routine | btrfs: detach failed sprout device from transaction update list | 6.7 | 0.0012 |  |
| [CVE-2026-98157](https://patchblox.com/security/data/cve/CVE-2026-98157.md) | Routine | EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation | 5.5 | 0.0012 |  |
| [CVE-2026-98123](https://patchblox.com/security/data/cve/CVE-2026-98123.md) | Routine | sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration | 6.5 | 0.0010 |  |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.