ALAS2023-2026-2045: Security update for 19 packages

ALAS2023-2026-2045, released August 3, 2026, fixes 110 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

110

1 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0065

51st percentile

Priority of the 110 CVEs

Patch now 0
                                Urgent 1
                                High 76
                                Routine 33

Fixed package versions

Product	Release	Fixed in
bpftool6.18	amzn 2023	1:6.18.39-79.141.amzn2023
bpftool6.18-debuginfo	amzn 2023	1:6.18.39-79.141.amzn2023
kernel-livepatch-6.18.39-79.141	amzn 2023	1:1.0-0.amzn2023
kernel6.18	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-debuginfo	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-debuginfo-common-aarch64	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-debuginfo-common-x86_64	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-devel	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-headers	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-modules-extra	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-modules-extra-common	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-tools	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-tools-debuginfo	amzn 2023	1:6.18.39-79.141.amzn2023
kernel6.18-tools-devel	amzn 2023	1:6.18.39-79.141.amzn2023
microvm-kernel6.18	amzn 2023	1:6.18.39-79.141.amzn2023
perf6.18	amzn 2023	1:6.18.39-79.141.amzn2023
perf6.18-debuginfo	amzn 2023	1:6.18.39-79.141.amzn2023
python3-perf6.18	amzn 2023	1:6.18.39-79.141.amzn2023
python3-perf6.18-debuginfo	amzn 2023	1:6.18.39-79.141.amzn2023

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-64459	linux: In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_...	9.8	0.0065	None reported
High	CVE-2026-64450	tipc: fix out-of-bounds read in broadcast Gap ACK blocks	9.1	0.0054	None reported
High	CVE-2026-64355	bpf: Reject fragmented frames in devmap	9.8	0.0051	None reported
High	CVE-2026-64312	linux: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parall...	7.5	0.0050	None reported
High	CVE-2026-64448	smb: client: restrict implied bcc[0] exemption to responses without data area	8.2	0.0046	None reported
High	CVE-2026-64383	smb: client: fix double-free in SMB2_flush() replay	9.8	0.0046	None reported
High	CVE-2026-64384	smb: client: fix change notify replay double-free	9.8	0.0046	None reported
High	CVE-2026-64385	smb: client: fix double-free in SMB2_ioctl() replay	9.8	0.0046	None reported
High	CVE-2026-64386	smb: client: fix query_info() replay double-free	9.8	0.0046	None reported
High	CVE-2026-64387	smb: client: fix query directory replay double-free	9.8	0.0046	None reported
High	CVE-2026-64380	smb: client: harden POSIX SID length parsing	8.2	0.0044	None reported
High	CVE-2026-64414	linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko repo...	7.8	0.0044	None reported
High	CVE-2026-64368	mm/slab: do not limit zeroing to orig_size when only red zoning is enabled	8.1	0.0042	None reported
High	CVE-2026-64374	sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT	7.5	0.0039	None reported
High	CVE-2026-64597	smb: client: fix double-free in SMB2_close() replay	9.8	0.0036	None reported
High	CVE-2026-64313	crypto: ecc - Fix carry overflow in vli multiplication	8.8	0.0036	None reported
High	CVE-2026-64364	HID: multitouch: fix out-of-bounds bit access on mt_io_flags	8.8	0.0036	None reported
High	CVE-2026-64382	smb: client: fix double-free in SMB2_open() replay	8.8	0.0035	None reported
High	CVE-2026-64435	audit: Fix data races of skb_queue_len() readers on audit_queue	8.2	0.0033	None reported
High	CVE-2026-64598	smb/client: Fix error code in smb2_aead_req_alloc()	8.8	0.0028	None reported
High	CVE-2026-64507	x86/bugs: Enable IBPB flush on BPF JIT allocation	7.8	0.0023	None reported
High	CVE-2026-64591	linux: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path Th...	n/a	0.0022	None reported
High	CVE-2026-64464	linux: In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xh...	n/a	0.0021	None reported
High	CVE-2026-64596	linux: In the Linux kernel, the following vulnerability has been resolved: libfs: set SB_I_NOEXEC and SB_I_NODEV by default...	n/a	0.0021	None reported
High	CVE-2026-64508	bpf: Support for hardening against JIT spraying	7.8	0.0019	None reported

Also fixes CVE-2026-64459

DEBIAN-CVE-2026-64459
linux on Debian 14

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-2045.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-2045">ALAS2023-2026-2045 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.