Linux · Amazon Linux · Security advisory · July 20, 2026

ALAS2023-2026-1968: Security update for 18 packages

ALAS2023-2026-1968, released July 20, 2026, fixes 125 CVEs across 18 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
125
4 rated Critical
Exploited
1
CVE-2026-53266
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0458
91st percentile

Priority of the 125 CVEs

Patch now 1 Urgent 4 High 92 Routine 28

Fixed package versions

ProductReleaseFixed in
bpftool6.12amzn 20231:6.12.94-123.174.amzn2023
bpftool6.12-debuginfoamzn 20231:6.12.94-123.174.amzn2023
kernel-livepatch-6.12.94-123.174amzn 20231:1.0-0.amzn2023
kernel6.12amzn 20231:6.12.94-123.174.amzn2023
kernel6.12-debuginfoamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-debuginfo-common-aarch64amzn 20231:6.12.94-123.174.amzn2023
kernel6.12-debuginfo-common-x86_64amzn 20231:6.12.94-123.174.amzn2023
kernel6.12-develamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-headersamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-modules-extraamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-modules-extra-commonamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-toolsamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-tools-debuginfoamzn 20231:6.12.94-123.174.amzn2023
kernel6.12-tools-develamzn 20231:6.12.94-123.174.amzn2023
perf6.12amzn 20231:6.12.94-123.174.amzn2023
perf6.12-debuginfoamzn 20231:6.12.94-123.174.amzn2023
python3-perf6.12amzn 20231:6.12.94-123.174.amzn2023
python3-perf6.12-debuginfoamzn 20231:6.12.94-123.174.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2026-53266 netfilter: bridge: make ebt_snat ARP rewrite writable8.8 0.0093 KEVExploited
Urgent CVE-2026-63984 kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1...9.8 0.0051 None reported
Urgent CVE-2026-63939 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the...9.3 0.0020 None reported
Urgent CVE-2026-63938 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the...9.3 0.0020 None reported
Urgent CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on9.8 0.0017 None reported
High CVE-2026-46242 kpatch-patch-5_14_0-687_10_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run...7.8 0.0458 None reported
High CVE-2026-63913 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s...8.8 0.0097 None reported
High CVE-2026-52929 sctp: stream: fully roll back denied add-stream state9.8 0.0087 None reported
High CVE-2026-63887 kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_outp...9.8 0.0078 None reported
High CVE-2026-63888 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n...9.8 0.0078 None reported
High CVE-2026-63912 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system9.8 0.0071 None reported
High CVE-2026-63922 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t...9.8 0.0071 None reported
High CVE-2026-63924 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t...9.8 0.0071 None reported
High CVE-2026-63886 bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s...9.8 0.0071 None reported
High CVE-2026-63968 linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_...7.5 0.0067 None reported
High CVE-2026-52924 sctp: purge outqueue on stale COOKIE-ECHO handling9.8 0.0066 None reported
High CVE-2026-63919 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system8.8 0.0065 None reported
High CVE-2026-46331 net/sched: fix pedit partial COW leading to page cache corruption8.1 0.0064 None reported
High CVE-2026-53221 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()9.8 0.0058 None reported
High CVE-2026-53228 ipv6: sit: reload inner IPv6 header after GSO offloads9.8 0.0058 None reported
High CVE-2026-53225 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()9.1 0.0058 None reported
High CVE-2026-53268 netfilter: conntrack_irc: fix possible out-of-bounds read8.2 0.0052 None reported
High CVE-2026-63993 kernel: In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after s...9.8 0.0051 None reported
High CVE-2026-63994 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system9.8 0.0051 None reported
High CVE-2026-64007 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n...9.8 0.0051 None reported
Showing 1 to 25 of 125 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.