ALAS2023-2026-1881: Security update for 19 packages

ALAS2023-2026-1881, released June 22, 2026, fixes 164 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

164

19 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0097

62nd percentile

Priority of the 164 CVEs

Patch now 0
                                Urgent 19
                                High 101
                                Routine 44

Fixed package versions

Product	Release	Fixed in
bpftool6.18	amzn 2023	1:6.18.35-68.127.amzn2023
bpftool6.18-debuginfo	amzn 2023	1:6.18.35-68.127.amzn2023
kernel-livepatch-6.18.35-68.127	amzn 2023	1:1.0-0.amzn2023
kernel6.18	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-debuginfo	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-debuginfo-common-aarch64	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-debuginfo-common-x86_64	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-devel	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-headers	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-modules-extra	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-modules-extra-common	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-tools	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-tools-debuginfo	amzn 2023	1:6.18.35-68.127.amzn2023
kernel6.18-tools-devel	amzn 2023	1:6.18.35-68.127.amzn2023
microvm-kernel6.18	amzn 2023	1:6.18.35-68.127.amzn2023
perf6.18	amzn 2023	1:6.18.35-68.127.amzn2023
perf6.18-debuginfo	amzn 2023	1:6.18.35-68.127.amzn2023
python3-perf6.18	amzn 2023	1:6.18.35-68.127.amzn2023
python3-perf6.18-debuginfo	amzn 2023	1:6.18.35-68.127.amzn2023

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-64066	linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on...	9.8	0.0065	None reported
Urgent	CVE-2026-64069	linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read...	9.8	0.0065	None reported
Urgent	CVE-2026-64150	linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release local_lock before...	9.8	0.0065	None reported
Urgent	CVE-2026-64122	linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_report...	9.8	0.0063	None reported
Urgent	CVE-2026-63984	kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1...	9.8	0.0051	None reported
Urgent	CVE-2026-64046	kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1...	9.8	0.0051	None reported
Urgent	CVE-2026-64047	bpftool: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1...	9.8	0.0051	None reported
Urgent	CVE-2026-64061	linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read...	9.8	0.0047	None reported
Urgent	CVE-2026-64216	linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandon...	9.8	0.0046	None reported
Urgent	CVE-2026-64232	linux: In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_in...	9.8	0.0043	None reported
Urgent	CVE-2026-64025	linux: In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing wit...	9.8	0.0037	None reported
Urgent	CVE-2026-46316	linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache...	9.3	0.0034	None reported
Urgent	CVE-2026-63939	linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the...	9.3	0.0020	None reported
Urgent	CVE-2026-64080	linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks u...	9.3	0.0020	None reported
Urgent	CVE-2026-63938	linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the...	9.3	0.0020	None reported
Urgent	CVE-2026-64106	linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with o...	9.0	0.0015	None reported
Urgent	CVE-2026-64076	netfilter: bridge: eb_tables: close module init race	9.8	0.0014	None reported
Urgent	CVE-2026-64078	netfilter: x_tables: add and use xtables_unregister_table_exit	9.8	0.0013	None reported
Urgent	CVE-2026-63999	ethtool: rss: fix indir_table and hkey leak on get_rxfh failure	9.8	0.0012	None reported
High	CVE-2026-63913	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s...	8.8	0.0097	None reported
High	CVE-2026-63887	kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_outp...	9.8	0.0078	None reported
High	CVE-2026-63888	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n...	9.8	0.0078	None reported
High	CVE-2026-63912	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system	9.8	0.0071	None reported
High	CVE-2026-63922	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t...	9.8	0.0071	None reported
High	CVE-2026-63924	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t...	9.8	0.0071	None reported

Also fixes CVE-2026-64150

DEBIAN-CVE-2026-64150
linux on Debian 14

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-1881.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-1881">ALAS2023-2026-1881 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.