# ALAS2023-2026-3402: Security update for 18 packages ALAS2023-2026-3402, released November 10, 2026, fixes 166 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3402 - Platform: Linux - Released: Nov 10, 2026 - Priority: Urgent (Closes CVE-2026-72366, rated Critical) - CVEs: 166, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3402.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel-livepatch-6.12.114-139.210](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.114-139.210.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.114-139.210.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-72366](https://patchblox.com/security/data/cve/CVE-2026-72366.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle as... | 9.8 | 0.0066 | | | [CVE-2026-89654](https://patchblox.com/security/data/cve/CVE-2026-89654.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session free... | 9.8 | 0.0064 | | | [CVE-2026-89631](https://patchblox.com/security/data/cve/CVE-2026-89631.md) | Urgent | smb: client: reject a tree connect response whose byte count is too small | 9.1 | 0.0049 | | | [CVE-2026-80607](https://patchblox.com/security/data/cve/CVE-2026-80607.md) | Urgent | tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg | 9.8 | 0.0017 | | | [CVE-2026-64076](https://patchblox.com/security/data/cve/CVE-2026-64076.md) | Urgent | netfilter: bridge: eb_tables: close module init race | 9.8 | 0.0014 | | | [CVE-2026-63999](https://patchblox.com/security/data/cve/CVE-2026-63999.md) | Urgent | ethtool: rss: fix indir_table and hkey leak on get_rxfh failure | 9.8 | 0.0012 | | | [CVE-2026-90104](https://patchblox.com/security/data/cve/CVE-2026-90104.md) | High | NFSv4.1: zero referring call lists before decoding | 9.8 | 0.0073 | | | [CVE-2026-89537](https://patchblox.com/security/data/cve/CVE-2026-89537.md) | High | SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 | 9.1 | 0.0073 | | | [CVE-2026-90234](https://patchblox.com/security/data/cve/CVE-2026-90234.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to rec... | 7.5 | 0.0068 | | | [CVE-2026-90149](https://patchblox.com/security/data/cve/CVE-2026-90149.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.... | 7.5 | 0.0067 | | | [CVE-2026-74374](https://patchblox.com/security/data/cve/CVE-2026-74374.md) | High | md/raid1,raid10: fix error-path detection with md_cloned_bio() | 7.5 | 0.0063 | | | [CVE-2026-72367](https://patchblox.com/security/data/cve/CVE-2026-72367.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iomap: guard io_size EOF trim against concurrent... | 8.8 | 0.0060 | | | [CVE-2026-80634](https://patchblox.com/security/data/cve/CVE-2026-80634.md) | High | netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag | 9.8 | 0.0060 | | | [CVE-2026-80668](https://patchblox.com/security/data/cve/CVE-2026-80668.md) | High | netfilter: nf_conntrack_expect: use conntrack GC to reap expectations | 9.8 | 0.0060 | | | [CVE-2026-89682](https://patchblox.com/security/data/cve/CVE-2026-89682.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispos... | 8.1 | 0.0053 | | | [CVE-2026-89709](https://patchblox.com/security/data/cve/CVE-2026-89709.md) | High | lockd, nfsd: RCU-protect nlmsvc_ops dispatch | 8.1 | 0.0053 | | | [CVE-2026-74752](https://patchblox.com/security/data/cve/CVE-2026-74752.md) | High | sctp: validate cookie AUTH state before use | 9.8 | 0.0052 | | | [CVE-2026-68426](https://patchblox.com/security/data/cve/CVE-2026-68426.md) | High | xfrm: fix stale skb->prev after async crypto steals a GSO segment | 9.8 | 0.0050 | | | [CVE-2026-72440](https://patchblox.com/security/data/cve/CVE-2026-72440.md) | High | md/raid1: fix writes_pending and barrier reference leaks on write failures | 7.1 | 0.0050 | | | [CVE-2026-74611](https://patchblox.com/security/data/cve/CVE-2026-74611.md) | High | tls: rx: restore msg_iter before TLS 1.3 optimistic retry | 9.8 | 0.0049 | | | [CVE-2026-74723](https://patchblox.com/security/data/cve/CVE-2026-74723.md) | High | btrfs: lzo: reject inline extents without valid headers | 9.8 | 0.0049 | | | [CVE-2026-74695](https://patchblox.com/security/data/cve/CVE-2026-74695.md) | High | netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() | 7.5 | 0.0048 | | | [CVE-2026-80631](https://patchblox.com/security/data/cve/CVE-2026-80631.md) | High | btrfs: lzo: reject compressed segment that overflows the compressed input | 7.5 | 0.0048 | | | [CVE-2026-93221](https://patchblox.com/security/data/cve/CVE-2026-93221.md) | High | nfsd: convert nfsd_net boolean flags to unsigned long flags word | 8.1 | 0.0042 | | | [CVE-2026-90106](https://patchblox.com/security/data/cve/CVE-2026-90106.md) | High | net: bridge: arp/nd proxy: fix reading neigh ha | 7.1 | 0.0023 | | | [CVE-2026-98047](https://patchblox.com/security/data/cve/CVE-2026-98047.md) | High | bpf: Check ancestor frames for rbtree callbacks | n/a | 0.0022 | | | [CVE-2026-90061](https://patchblox.com/security/data/cve/CVE-2026-90061.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip double clone set expr... | n/a | 0.0022 | | | [CVE-2026-90099](https://patchblox.com/security/data/cve/CVE-2026-90099.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations... | n/a | 0.0022 | | | [CVE-2026-90105](https://patchblox.com/security/data/cve/CVE-2026-90105.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neigh... | n/a | 0.0022 | | | [CVE-2026-90247](https://patchblox.com/security/data/cve/CVE-2026-90247.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmap_lock leak in irq_work path stack_... | n/a | 0.0022 | | | [CVE-2026-90335](https://patchblox.com/security/data/cve/CVE-2026-90335.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tty: skip cdev_del() when no cdev is registered... | n/a | 0.0022 | | | [CVE-2026-90336](https://patchblox.com/security/data/cve/CVE-2026-90336.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uart_regis... | n/a | 0.0022 | | | [CVE-2026-90337](https://patchblox.com/security/data/cve/CVE-2026-90337.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the... | n/a | 0.0022 | | | [CVE-2026-93146](https://patchblox.com/security/data/cve/CVE-2026-93146.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in pro... | n/a | 0.0022 | | | [CVE-2026-98038](https://patchblox.com/security/data/cve/CVE-2026-98038.md) | High | bpf: Keep refcount_acquire nullable for borrowed RCU kptrs | n/a | 0.0022 | | | [CVE-2026-97554](https://patchblox.com/security/data/cve/CVE-2026-97554.md) | High | smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() | 7.1 | 0.0021 | | | [CVE-2026-90097](https://patchblox.com/security/data/cve/CVE-2026-90097.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup fo... | n/a | 0.0021 | | | [CVE-2026-90259](https://patchblox.com/security/data/cve/CVE-2026-90259.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in... | n/a | 0.0021 | | | [CVE-2026-72031](https://patchblox.com/security/data/cve/CVE-2026-72031.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900... | n/a | 0.0021 | | | [CVE-2026-90086](https://patchblox.com/security/data/cve/CVE-2026-90086.md) | High | xsk: honor XDP_TX_METADATA in zero-copy path | n/a | 0.0021 | | | [CVE-2026-90144](https://patchblox.com/security/data/cve/CVE-2026-90144.md) | High | dpll: fix NULL deref in dpll_device_ops() during teardown race | n/a | 0.0021 | | | [CVE-2026-90263](https://patchblox.com/security/data/cve/CVE-2026-90263.md) | High | btrfs: check if root is readonly when setting posix acl | 7.8 | 0.0021 | | | [CVE-2026-80786](https://patchblox.com/security/data/cve/CVE-2026-80786.md) | High | fbdev: Wrap user-invoked calls to fb_set_var() in helper | 7.1 | 0.0021 | | | [CVE-2026-90300](https://patchblox.com/security/data/cve/CVE-2026-90300.md) | High | bpf: Clear buf on error in __bpf_get_task_stack | 7.1 | 0.0021 | | | [CVE-2026-90421](https://patchblox.com/security/data/cve/CVE-2026-90421.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn I... | n/a | 0.0021 | | | [CVE-2026-93181](https://patchblox.com/security/data/cve/CVE-2026-93181.md) | High | perf/x86/intel/uncore: Fix uncore_box ref/unref ordering | n/a | 0.0021 | | | [CVE-2026-90359](https://patchblox.com/security/data/cve/CVE-2026-90359.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject >8 byte return values on return-read... | n/a | 0.0020 | | | [CVE-2026-98033](https://patchblox.com/security/data/cve/CVE-2026-98033.md) | High | bpf: Preserve inner map identity in callback frames | 7.8 | 0.0020 | | | [CVE-2026-98715](https://patchblox.com/security/data/cve/CVE-2026-98715.md) | High | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN | 7.8 | 0.0020 | | | [CVE-2026-97563](https://patchblox.com/security/data/cve/CVE-2026-97563.md) | High | smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() | 7.3 | 0.0020 | | | [CVE-2026-68421](https://patchblox.com/security/data/cve/CVE-2026-68421.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on core-sched forced idle... | n/a | 0.0019 | | | [CVE-2026-89913](https://patchblox.com/security/data/cve/CVE-2026-89913.md) | High | KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables | 8.8 | 0.0019 | | | [CVE-2026-74338](https://patchblox.com/security/data/cve/CVE-2026-74338.md) | High | bpf: Reject sleepable BPF_LSM_CGROUP programs at load time | 7.8 | 0.0019 | | | [CVE-2026-93144](https://patchblox.com/security/data/cve/CVE-2026-93144.md) | High | bpf: Reject writes through untrusted BTF pointers | 7.8 | 0.0018 | | | [CVE-2026-99098](https://patchblox.com/security/data/cve/CVE-2026-99098.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode... | n/a | 0.0018 | | | [CVE-2026-64513](https://patchblox.com/security/data/cve/CVE-2026-64513.md) | High | KVM: x86: Unconditionally recompute CR8 intercept on PPR update | 8.4 | 0.0018 | | | [CVE-2026-74264](https://patchblox.com/security/data/cve/CVE-2026-74264.md) | High | net: watchdog: fix refcount tracking races | 7.8 | 0.0018 | | | [CVE-2026-93105](https://patchblox.com/security/data/cve/CVE-2026-93105.md) | High | esp: do not unref managed frag pages in esp_ssg_unref() | 7.8 | 0.0018 | | | [CVE-2026-98993](https://patchblox.com/security/data/cve/CVE-2026-98993.md) | High | namespace: don't inherit MNT_UMOUNT in clone_mnt() | 7.8 | 0.0018 | | | [CVE-2026-90161](https://patchblox.com/security/data/cve/CVE-2026-90161.md) | High | erofs: fix interlaced ztailpacking pclusters | 7.1 | 0.0018 | | | [CVE-2026-90217](https://patchblox.com/security/data/cve/CVE-2026-90217.md) | High | bpf: Compare iterator types during state pruning | 7.8 | 0.0018 | | | [CVE-2026-93148](https://patchblox.com/security/data/cve/CVE-2026-93148.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEM_ALLOC BTF accesses past object b... | 7.8 | 0.0018 | | | [CVE-2026-90427](https://patchblox.com/security/data/cve/CVE-2026-90427.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed... | 7.4 | 0.0017 | | | [CVE-2026-90267](https://patchblox.com/security/data/cve/CVE-2026-90267.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix special_vec mempool leak when scsi... | n/a | 0.0017 | | | [CVE-2026-90111](https://patchblox.com/security/data/cve/CVE-2026-90111.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mr_cache_report()... | 7.8 | 0.0017 | | | [CVE-2026-90326](https://patchblox.com/security/data/cve/CVE-2026-90326.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation a... | 7.8 | 0.0017 | | | [CVE-2026-80738](https://patchblox.com/security/data/cve/CVE-2026-80738.md) | High | bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie | 7.3 | 0.0017 | | | [CVE-2026-74728](https://patchblox.com/security/data/cve/CVE-2026-74728.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xf... | n/a | 0.0017 | | | [CVE-2026-90317](https://patchblox.com/security/data/cve/CVE-2026-90317.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin un... | 7.8 | 0.0017 | | | [CVE-2026-97962](https://patchblox.com/security/data/cve/CVE-2026-97962.md) | High | net/mlx5e: Move representor vnic reporter to eswitch devlink port | 7.1 | 0.0017 | | | [CVE-2026-97997](https://patchblox.com/security/data/cve/CVE-2026-97997.md) | High | virtio_ring: fix stale descriptor flags after a failed packed add | 7.1 | 0.0017 | | | [CVE-2026-98044](https://patchblox.com/security/data/cve/CVE-2026-98044.md) | High | bpf: Reject legacy packet loads from callbacks | 7.1 | 0.0017 | | | [CVE-2026-74542](https://patchblox.com/security/data/cve/CVE-2026-74542.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by ad... | n/a | 0.0017 | | | [CVE-2026-90424](https://patchblox.com/security/data/cve/CVE-2026-90424.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the ini... | n/a | 0.0017 | | | [CVE-2026-93230](https://patchblox.com/security/data/cve/CVE-2026-93230.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage... | n/a | 0.0017 | | | [CVE-2026-98032](https://patchblox.com/security/data/cve/CVE-2026-98032.md) | High | tracing: Fix subbuf resize races with trace_pipe_raw readers | n/a | 0.0017 | | | [CVE-2026-98048](https://patchblox.com/security/data/cve/CVE-2026-98048.md) | High | bpf: don't rewrite bpf_fastcall patterns entered by a jump | n/a | 0.0017 | | | [CVE-2026-99044](https://patchblox.com/security/data/cve/CVE-2026-99044.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup... | n/a | 0.0017 | | | [CVE-2026-72423](https://patchblox.com/security/data/cve/CVE-2026-72423.md) | High | bpf: Guard conntrack opts error writes | 8.8 | 0.0017 | | | [CVE-2026-92485](https://patchblox.com/security/data/cve/CVE-2026-92485.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release Th... | 7.8 | 0.0017 | | | [CVE-2026-90240](https://patchblox.com/security/data/cve/CVE-2026-90240.md) | High | iommu/vt-d: Flush context cache with correct SID when tearing down aliases | 8.8 | 0.0016 | | | [CVE-2026-98981](https://patchblox.com/security/data/cve/CVE-2026-98981.md) | High | namespace: unhash a dentry before detaching the mounts on it | 8.8 | 0.0016 | | | [CVE-2026-72383](https://patchblox.com/security/data/cve/CVE-2026-72383.md) | High | sctp: fix addr_wq_timer race in sctp_free_addr_wq() | 7.8 | 0.0016 | | | [CVE-2026-72404](https://patchblox.com/security/data/cve/CVE-2026-72404.md) | High | tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() | 7.8 | 0.0016 | | | [CVE-2026-90142](https://patchblox.com/security/data/cve/CVE-2026-90142.md) | High | virtio_net: Fix resize of the RX ring | 7.8 | 0.0016 | | | [CVE-2026-90177](https://patchblox.com/security/data/cve/CVE-2026-90177.md) | High | bpf: Check pointer type for all atomic RMW paths | 7.8 | 0.0016 | | | [CVE-2026-99002](https://patchblox.com/security/data/cve/CVE-2026-99002.md) | High | drm/vmwgfx: validate pitch coming from userspace | 7.8 | 0.0016 | | | [CVE-2026-99085](https://patchblox.com/security/data/cve/CVE-2026-99085.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU... | n/a | 0.0016 | | | [CVE-2026-98974](https://patchblox.com/security/data/cve/CVE-2026-98974.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchang... | 8.8 | 0.0016 | | | [CVE-2026-98975](https://patchblox.com/security/data/cve/CVE-2026-98975.md) | High | xfs: stop exchanging reflink flags when exchanging mappings | 7.8 | 0.0016 | | | [CVE-2026-90347](https://patchblox.com/security/data/cve/CVE-2026-90347.md) | High | arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry | 8.4 | 0.0016 | | | [CVE-2026-68448](https://patchblox.com/security/data/cve/CVE-2026-68448.md) | High | ovl: check access to copy_file_range source with src mounter creds | 7.8 | 0.0016 | | | [CVE-2026-89705](https://patchblox.com/security/data/cve/CVE-2026-89705.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all n... | 7.1 | 0.0016 | | | [CVE-2026-90260](https://patchblox.com/security/data/cve/CVE-2026-90260.md) | High | btrfs: zoned: don't clobber the extent buffer when zeroing it out | 7.1 | 0.0016 | | | [CVE-2026-99082](https://patchblox.com/security/data/cve/CVE-2026-99082.md) | High | KVM: x86: Use active memslots for the per-vCPU MMIO cache | 8.8 | 0.0016 | | | [CVE-2026-100072](https://patchblox.com/security/data/cve/CVE-2026-100072.md) | High | ACPI: platform: Use acpi_bus_get_primary_device() | 7.8 | 0.0016 | | | [CVE-2026-98156](https://patchblox.com/security/data/cve/CVE-2026-98156.md) | High | drm/virtio: use the DMA API for resource backing on Xen | 7.8 | 0.0014 | | | [CVE-2026-74747](https://patchblox.com/security/data/cve/CVE-2026-74747.md) | High | ipvs: revalidate ihl to prevent out-of-bounds access | 7.8 | 0.0014 | | | [CVE-2026-68401](https://patchblox.com/security/data/cve/CVE-2026-68401.md) | High | firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() | 7.8 | 0.0014 | | | [CVE-2026-64388](https://patchblox.com/security/data/cve/CVE-2026-64388.md) | High | smb/client: fix chown/chgrp with SMB3 POSIX Extensions | 7.8 | 0.0013 | | | [CVE-2026-64036](https://patchblox.com/security/data/cve/CVE-2026-64036.md) | High | cgroup/rstat: validate cpu before css_rstat_cpu() access | 7.8 | 0.0013 | | | [CVE-2026-74544](https://patchblox.com/security/data/cve/CVE-2026-74544.md) | High | net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds | 7.8 | 0.0013 | | | [CVE-2026-74317](https://patchblox.com/security/data/cve/CVE-2026-74317.md) | High | ixgbe: do not configure xps for XDP queues | 7.8 | 0.0013 | | | [CVE-2026-74605](https://patchblox.com/security/data/cve/CVE-2026-74605.md) | High | eventfs: Use children field for rcu head and add memory barriers | 7.8 | 0.0013 | | | [CVE-2026-74715](https://patchblox.com/security/data/cve/CVE-2026-74715.md) | High | bpf: Fix netns reference imbalance in conntrack kfuncs | 7.8 | 0.0013 | | | [CVE-2026-68400](https://patchblox.com/security/data/cve/CVE-2026-68400.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access De... | 7.8 | 0.0013 | | | [CVE-2026-64146](https://patchblox.com/security/data/cve/CVE-2026-64146.md) | High | erofs: fix metabuf leak in inode xattr initialization | 7.1 | 0.0013 | | | [CVE-2026-74257](https://patchblox.com/security/data/cve/CVE-2026-74257.md) | High | sockmap: Fix use-after-free in udp_bpf_recvmsg() | 7.8 | 0.0013 | | | [CVE-2026-98058](https://patchblox.com/security/data/cve/CVE-2026-98058.md) | High | bpf: Mark syscall helpers as sleepable | 7.1 | 0.0012 | | | [CVE-2026-68323](https://patchblox.com/security/data/cve/CVE-2026-68323.md) | High | tipc: serialize udp bearer replicast list updates | 7.8 | 0.0010 | | | [CVE-2026-98099](https://patchblox.com/security/data/cve/CVE-2026-98099.md) | High | ipv6: mcast: use rcu_assign_pointer() for __rcu list updates | 7.1 | 0.0009 | | | [CVE-2026-72341](https://patchblox.com/security/data/cve/CVE-2026-72341.md) | Routine | net/mlx5e: Fix publication race for priv->channel_stats[] | 4.7 | 0.0022 | | | [CVE-2026-72321](https://patchblox.com/security/data/cve/CVE-2026-72321.md) | Routine | ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() | 3.1 | 0.0022 | | | [CVE-2026-98977](https://patchblox.com/security/data/cve/CVE-2026-98977.md) | Routine | namespace: handle mount locking for automounts correctly | 4.2 | 0.0022 | | | [CVE-2026-92503](https://patchblox.com/security/data/cve/CVE-2026-92503.md) | Routine | ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() | 5.5 | 0.0022 | | | [CVE-2026-89987](https://patchblox.com/security/data/cve/CVE-2026-89987.md) | Routine | mm/huge_memory: transfer the pmd dirty bit to the folio on zap | 5.5 | 0.0022 | | | [CVE-2026-93251](https://patchblox.com/security/data/cve/CVE-2026-93251.md) | Routine | ACPI: bus: Introduce acpi_bus_get_primary_device() | 5.2 | 0.0021 | | | [CVE-2026-97561](https://patchblox.com/security/data/cve/CVE-2026-97561.md) | Routine | smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid | 6.5 | 0.0021 | | | [CVE-2026-90265](https://patchblox.com/security/data/cve/CVE-2026-90265.md) | Routine | btrfs: defrag: fix deadlock between defrag and delalloc space reservation | 5.5 | 0.0021 | | | [CVE-2026-68242](https://patchblox.com/security/data/cve/CVE-2026-68242.md) | Routine | drm/i915/gt: Fix NULL deref on sched_engine alloc failure | 5.5 | 0.0021 | | | [CVE-2026-68241](https://patchblox.com/security/data/cve/CVE-2026-68241.md) | Routine | drm/i915/mst: limit DP MST ESI service loop | 4.6 | 0.0021 | | | [CVE-2026-89757](https://patchblox.com/security/data/cve/CVE-2026-89757.md) | Routine | mm/mglru: fix and remove redundant unevictable folio handling | 3.6 | 0.0021 | | | [CVE-2026-90182](https://patchblox.com/security/data/cve/CVE-2026-90182.md) | Routine | blk-iocost: clear delay state when freeing policy data | 5.5 | 0.0021 | | | [CVE-2026-90264](https://patchblox.com/security/data/cve/CVE-2026-90264.md) | Routine | btrfs: always wait for ordered extents to avoid OE races | 5.5 | 0.0021 | | | [CVE-2026-68312](https://patchblox.com/security/data/cve/CVE-2026-68312.md) | Routine | cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths | 3.3 | 0.0021 | | | [CVE-2026-74754](https://patchblox.com/security/data/cve/CVE-2026-74754.md) | Routine | scsi: core: pair EH runtime PM get and put | 2.5 | 0.0021 | | | [CVE-2026-80905](https://patchblox.com/security/data/cve/CVE-2026-80905.md) | Routine | net: tap: fix wrong transport_header when sending VLAN-tagged frame | 5.5 | 0.0020 | | | [CVE-2026-74571](https://patchblox.com/security/data/cve/CVE-2026-74571.md) | Routine | btrfs: skip global block reserve accounting for rescue mounts | 4.1 | 0.0020 | | | [CVE-2026-98043](https://patchblox.com/security/data/cve/CVE-2026-98043.md) | Routine | bpf: Don't infer non-NULL from a pointer with an unbounded offset | 5.5 | 0.0020 | | | [CVE-2026-98079](https://patchblox.com/security/data/cve/CVE-2026-98079.md) | Routine | btrfs: zstd: fix lost wakeup when waiting for a workspace | 5.5 | 0.0020 | | | [CVE-2026-98085](https://patchblox.com/security/data/cve/CVE-2026-98085.md) | Routine | bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge | 5.5 | 0.0020 | | | [CVE-2026-68081](https://patchblox.com/security/data/cve/CVE-2026-68081.md) | Routine | KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state | 6.0 | 0.0020 | | | [CVE-2026-80866](https://patchblox.com/security/data/cve/CVE-2026-80866.md) | Routine | tipc: avoid busy looping in tipc_exit_net() | 4.1 | 0.0020 | | | [CVE-2026-72439](https://patchblox.com/security/data/cve/CVE-2026-72439.md) | Routine | md/raid10: fix writes_pending leak on write request failures | 1.9 | 0.0019 | | | [CVE-2026-99027](https://patchblox.com/security/data/cve/CVE-2026-99027.md) | Routine | net: team: stop reusing skb after queue override | 6.0 | 0.0019 | | | [CVE-2026-99019](https://patchblox.com/security/data/cve/CVE-2026-99019.md) | Routine | scsi: ch: Do not keep references to data transfer element devices | 2.3 | 0.0019 | | | [CVE-2026-92520](https://patchblox.com/security/data/cve/CVE-2026-92520.md) | Routine | bpf: Zero queue and stack outputs on lock failure | 5.5 | 0.0018 | | | [CVE-2026-98985](https://patchblox.com/security/data/cve/CVE-2026-98985.md) | Routine | namespace: check the mounts before reading their parents in pivot_root() | 4.7 | 0.0018 | | | [CVE-2026-90333](https://patchblox.com/security/data/cve/CVE-2026-90333.md) | Routine | dm-integrity: replace forgeable discard filler with a keyed sector marker | 5.5 | 0.0017 | | | [CVE-2026-97480](https://patchblox.com/security/data/cve/CVE-2026-97480.md) | Routine | tty: serial: 8250: protect against NULL uart->port.dev in register | 4.4 | 0.0017 | | | [CVE-2026-97477](https://patchblox.com/security/data/cve/CVE-2026-97477.md) | Routine | RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() | 3.6 | 0.0017 | | | [CVE-2026-99041](https://patchblox.com/security/data/cve/CVE-2026-99041.md) | Routine | ip6_gre: remove obsolete ERSPAN PMTU update | 5.5 | 0.0017 | | | [CVE-2026-89642](https://patchblox.com/security/data/cve/CVE-2026-89642.md) | Routine | cifs: call pagecache_isize_extended() in cifs_setsize() when extending | 4.7 | 0.0017 | | | [CVE-2026-97960](https://patchblox.com/security/data/cve/CVE-2026-97960.md) | Routine | perf/x86/intel: Prevent drain_pebs() reentry | 5.5 | 0.0017 | | | [CVE-2026-97988](https://patchblox.com/security/data/cve/CVE-2026-97988.md) | Routine | vhost: invalidate vring access on IOTLB transitions | 5.5 | 0.0017 | | | [CVE-2026-98003](https://patchblox.com/security/data/cve/CVE-2026-98003.md) | Routine | iommu/amd: Do not reallocate GA log buffers on resume | 5.5 | 0.0017 | | | [CVE-2026-98019](https://patchblox.com/security/data/cve/CVE-2026-98019.md) | Routine | bpf: mark a NULL call argument precise | 5.5 | 0.0017 | | | [CVE-2026-98067](https://patchblox.com/security/data/cve/CVE-2026-98067.md) | Routine | erofs: disable LZ4 rolling decompression for now | 5.5 | 0.0017 | | | [CVE-2026-74375](https://patchblox.com/security/data/cve/CVE-2026-74375.md) | Routine | md/raid1,raid10: fix deadlock in read error recovery path | 4.1 | 0.0017 | | | [CVE-2026-74559](https://patchblox.com/security/data/cve/CVE-2026-74559.md) | Routine | xsk: drain continuation descs after overflow in xsk_build_skb() | 3.3 | 0.0017 | | | [CVE-2026-74373](https://patchblox.com/security/data/cve/CVE-2026-74373.md) | Routine | md/raid1,raid10: fix bio accounting for split md cloned bios | 1.9 | 0.0017 | | | [CVE-2026-97479](https://patchblox.com/security/data/cve/CVE-2026-97479.md) | Routine | driver core: Avoid warning when removing a device while its supplier is unbinding | 1.9 | 0.0017 | | | [CVE-2026-80920](https://patchblox.com/security/data/cve/CVE-2026-80920.md) | Routine | io_uring: defer eventfd signaling when queued from a wakeup handler | 3.3 | 0.0017 | | | [CVE-2026-68441](https://patchblox.com/security/data/cve/CVE-2026-68441.md) | Routine | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains | 4.4 | 0.0017 | | | [CVE-2026-64159](https://patchblox.com/security/data/cve/CVE-2026-64159.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where i_size > remot... | 5.5 | 0.0016 | | | [CVE-2026-97503](https://patchblox.com/security/data/cve/CVE-2026-97503.md) | Routine | genirq/proc: Size interrupt directory names for 10-digit interrupt numbers | 6.4 | 0.0016 | | | [CVE-2026-74558](https://patchblox.com/security/data/cve/CVE-2026-74558.md) | Routine | xsk: reclaim invalid Tx descriptors in ZC batch path | 3.3 | 0.0016 | | | [CVE-2026-100074](https://patchblox.com/security/data/cve/CVE-2026-100074.md) | Routine | bpf: Mark bpf_refcount field as unique | 5.5 | 0.0016 | | | [CVE-2026-98049](https://patchblox.com/security/data/cve/CVE-2026-98049.md) | Routine | bpf: zero extend the result of an arena 32-bit cmpxchg | 5.5 | 0.0016 | | | [CVE-2026-98062](https://patchblox.com/security/data/cve/CVE-2026-98062.md) | Routine | bpf: Mark signal tracepoint siginfo arguments as scalar | 5.5 | 0.0016 | | | [CVE-2026-98134](https://patchblox.com/security/data/cve/CVE-2026-98134.md) | Routine | bpf: check_cond_jmp_op(): properly infer if register is null | 5.5 | 0.0016 | | | [CVE-2026-64006](https://patchblox.com/security/data/cve/CVE-2026-64006.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same... | 5.5 | 0.0013 | | | [CVE-2026-63998](https://patchblox.com/security/data/cve/CVE-2026-63998.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ethtool: module: call ethnl_ops_complete() on mo... | 5.5 | 0.0012 | | | [CVE-2026-64060](https://patchblox.com/security/data/cve/CVE-2026-64060.md) | Routine | netfs: Fix leak of request in netfs_write_begin() error handling | 5.5 | 0.0012 | | | [CVE-2026-64190](https://patchblox.com/security/data/cve/CVE-2026-64190.md) | Routine | net: team: fix NULL pointer dereference in team_xmit during mode change | 5.5 | 0.0012 | | | [CVE-2026-98147](https://patchblox.com/security/data/cve/CVE-2026-98147.md) | Routine | printk: Don't WARN on kthread_run failure. | 5.5 | 0.0011 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.