Linux · 
Amazon Linux · Security advisory · June 22, 2026
Amazon Linux · Security advisory · June 22, 2026ALAS2023-2026-1866: Security update for 18 packages
ALAS2023-2026-1866, released June 22, 2026, fixes 130 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
130
10 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0458
91st percentile
Priority of the 130 CVEs
Patch now 0
Urgent 10
High 63
Routine 57
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool6.18 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| bpftool6.18-debuginfo | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel-livepatch-6.18.33-63.124 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel6.18 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-debuginfo | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-debuginfo-common-aarch64 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-debuginfo-common-x86_64 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-devel | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-headers | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-modules-extra | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-modules-extra-common | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-tools | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-tools-debuginfo | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| kernel6.18-tools-devel | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| perf6.18 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| perf6.18-debuginfo | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| python3-perf6.18 | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
| python3-perf6.18-debuginfo | amzn 2023 | 1:6.18.33-63.124.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-52993 | tipc: fix double-free in tipc_buf_append() | 9.8 | 0.0040 | None reported |
| Urgent | CVE-2026-52955 | kernel-uek64k-core: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 9.8 | 0.0038 | None reported |
| Urgent | CVE-2026-53002 | netfilter: conntrack: remove sprintf usage | 9.8 | 0.0037 | None reported |
| Urgent | CVE-2026-53075 | ppp: require CAP_NET_ADMIN in target netns for unattached ioctls | 9.8 | 0.0027 | None reported |
| Urgent | CVE-2026-53009 | ice: fix double-free of tx_buf skb | 9.8 | 0.0018 | None reported |
| Urgent | CVE-2026-52991 | sched/psi: fix race between file release and pressure write | 9.8 | 0.0015 | None reported |
| Urgent | CVE-2026-53036 | bpf, arm64: Fix off-by-one in check_imm signed range check | 9.8 | 0.0014 | None reported |
| Urgent | CVE-2026-53053 | iommu/amd: Fix clone_alias() to use the original device's devid | 9.8 | 0.0013 | None reported |
| Urgent | CVE-2026-53077 | net/rds: Restrict use of RDS/IB to the initial network namespace | 9.8 | 0.0012 | None reported |
| Urgent | CVE-2026-53062 | dm cache policy smq: fix missing locks in invalidating cache blocks | 9.8 | 0.0010 | None reported |
| High | CVE-2026-46242 | kpatch-patch-5_14_0-687_10_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run... | 7.8 | 0.0458 | None reported |
| High | CVE-2026-52958 | libceph: Fix potential out-of-bounds access in osdmap_decode() | 9.1 | 0.0074 | None reported |
| High | CVE-2026-53003 | pppoe: drop PFC frames | 7.5 | 0.0072 | None reported |
| High | CVE-2026-52986 | netfilter: nf_conntrack_sip: don't use simple_strtoul | 9.8 | 0.0063 | None reported |
| High | CVE-2026-52999 | netfilter: nfnetlink_osf: fix out-of-bounds read on option matching | 9.1 | 0.0059 | None reported |
| High | CVE-2026-52998 | netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check | 7.5 | 0.0058 | None reported |
| High | CVE-2026-52981 | linux: In the Linux kernel, the following vulnerability has been resolved: neigh: let neigh_xmit take skb ownership neigh_... | 7.5 | 0.0053 | None reported |
| High | CVE-2026-52954 | libceph: handle rbtree insertion error in decode_choose_args() | 7.5 | 0.0052 | None reported |
| High | CVE-2026-52957 | libceph: Fix potential null-ptr-deref in decode_choose_args() | 7.5 | 0.0052 | None reported |
| High | CVE-2026-52974 | net: tls: fix strparser anchor skb leak on offload RX setup failure | 7.5 | 0.0050 | None reported |
| High | CVE-2026-53284 | btrfs: only release the dirty pages io tree after successful writes | 7.5 | 0.0048 | None reported |
| High | CVE-2026-53026 | kernel: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extra count in nfsd4_a... | 8.8 | 0.0043 | None reported |
| High | CVE-2026-45843 | slip: bound decode() reads against the compressed packet length | 8.2 | 0.0040 | None reported |
| High | CVE-2026-53006 | ipv6: fix possible UAF in icmpv6_rcv() | 9.8 | 0.0039 | None reported |
| High | CVE-2026-52967 | linux: In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob r... | 8.1 | 0.0039 | None reported |
Showing 1 to 25 of 130
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.