Linux · 
Amazon Linux · Security advisory · March 16, 2026
Amazon Linux · Security advisory · March 16, 2026ALAS2023-2026-1491: Security update for 22 packages
ALAS2023-2026-1491, released March 16, 2026, fixes 21 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
21
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0038
32nd percentile
Priority of the 21 CVEs
Patch now 0
Urgent 1
High 7
Routine 13
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-libbpf | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-livepatch-6.1.164-196.303 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| perf | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.164-196.303.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2025-40251 | devlink: rate: Unset parent pointer in devl_rate_nodes_destroy | 9.8 | 0.0017 | None reported |
| High | CVE-2025-71236 | scsi: qla2xxx: Validate sp before freeing associated memory | 7.8 | 0.0038 | None reported |
| High | CVE-2026-52945 | linux: In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI"... | 7.5 | 0.0032 | None reported |
| High | CVE-2026-23230 | smb: client: split cached_fid bitfields to avoid shared-byte RMW races | 8.4 | 0.0028 | None reported |
| High | CVE-2025-71238 | scsi: qla2xxx: Fix bsg_done() causing double free | 7.8 | 0.0022 | None reported |
| High | CVE-2026-23221 | bus: fsl-mc: fix use-after-free in driver_override_show() | 7.8 | 0.0014 | None reported |
| High | CVE-2025-71233 | PCI: endpoint: Avoid creating sub-groups asynchronously | 8.4 | 0.0014 | None reported |
| High | CVE-2026-23273 | linux: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_... | 7.8 | 0.0014 | None reported |
| Routine | CVE-2026-23238 | romfs: check sb_set_blocksize() return value | 5.5 | 0.0022 | None reported |
| Routine | CVE-2025-38643 | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | 5.5 | 0.0019 | None reported |
| Routine | CVE-2025-71232 | scsi: qla2xxx: Free sp in error path to fix system crash | 5.5 | 0.0018 | None reported |
| Routine | CVE-2025-68358 | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_sp... | 5.5 | 0.0018 | None reported |
| Routine | CVE-2025-39763 | ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered | 5.5 | 0.0016 | None reported |
| Routine | CVE-2026-23222 | crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly | 5.5 | 0.0015 | None reported |
| Routine | CVE-2023-53424 | clk: mediatek: fix of_iomap memory leak | 5.5 | 0.0015 | None reported |
| Routine | CVE-2026-23169 | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit(... | 5.6 | 0.0014 | None reported |
| Routine | CVE-2025-71235 | scsi: qla2xxx: Delay module unload while fabric scan in progress | 5.5 | 0.0014 | None reported |
| Routine | CVE-2026-23229 | crypto: virtio - Add spinlock protection with virtqueue notification | 5.5 | 0.0014 | None reported |
| Routine | CVE-2026-23228 | smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() | 6.5 | 0.0014 | None reported |
| Routine | CVE-2025-71237 | nilfs2: Fix potential block overflow that cause system hang | 5.5 | 0.0014 | None reported |
| Routine | CVE-2025-71144 | linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() Aft... | 5.5 | 0.0014 | None reported |
Showing 1 to 21 of 21
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.