ALAS2023-2026-3251: Security update for 19 packages

ALAS2023-2026-3251, released November 7, 2026, fixes 169 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

169

4 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0076

55th percentile

Priority of the 169 CVEs

Patch now 0
                                Urgent 4
                                High 64
                                Routine 101

Fixed package versions

Product	Release	Fixed in
bpftool6.18	amzn 2023	1:6.18.56-125.164.amzn2023
bpftool6.18-debuginfo	amzn 2023	1:6.18.56-125.164.amzn2023
kernel-livepatch-6.18.56-125.164	amzn 2023	1:1.0-0.amzn2023
kernel6.18	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-debuginfo	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-debuginfo-common-aarch64	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-debuginfo-common-x86_64	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-devel	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-headers	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-modules-extra	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-modules-extra-common	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-tools	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-tools-debuginfo	amzn 2023	1:6.18.56-125.164.amzn2023
kernel6.18-tools-devel	amzn 2023	1:6.18.56-125.164.amzn2023
microvm-kernel6.18	amzn 2023	1:6.18.56-125.164.amzn2023
perf6.18	amzn 2023	1:6.18.56-125.164.amzn2023
perf6.18-debuginfo	amzn 2023	1:6.18.56-125.164.amzn2023
python3-perf6.18	amzn 2023	1:6.18.56-125.164.amzn2023
python3-perf6.18-debuginfo	amzn 2023	1:6.18.56-125.164.amzn2023

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-98794	ipvs: filter some flags received in the backup server	9.1	0.0022	None reported
Urgent	CVE-2026-98573	net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()	9.4	0.0022	None reported
Urgent	CVE-2026-98621	net: gue: reject invalid REMCSUM offsets	9.1	0.0022	None reported
Urgent	CVE-2026-68399	bpf: Fix UAF in sock clone early bailouts	9.8	0.0017	None reported
High	CVE-2026-98432	ipv4: free inet_opt and ireq_opt after an RCU grace period	9.8	0.0076	None reported
High	CVE-2026-98490	net: openvswitch: conntrack: fix helper UAF due to extensions realloc	9.8	0.0070	None reported
High	CVE-2026-98548	sctp: discard the rest of the packet on a stale-cookie error	9.8	0.0069	None reported
High	CVE-2026-98550	tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow	7.5	0.0068	None reported
High	CVE-2026-98532	ipv6: do not let ipv6_find_hdr() return an offset past the packet end	8.1	0.0061	None reported
High	CVE-2026-98549	tcp: prevent collapsing skbs across boundary in rtx queue	9.1	0.0056	None reported
High	CVE-2026-98497	net/mlx5e: fix swapped IPv6 IPsec policy masks	7.5	0.0046	None reported
High	CVE-2026-80734	linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached...	8.8	0.0042	None reported
High	CVE-2026-98451	smb: client: use finish_no_open() for non-regular inodes	8.8	0.0040	None reported
High	CVE-2026-98479	scsi: libiscsi_tcp: Check the data direction of a Data-In PDU	7.5	0.0039	None reported
High	CVE-2026-98454	smb: client: fix create context out-of-bounds reads	8.1	0.0039	None reported
High	CVE-2026-98374	tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()	8.8	0.0029	None reported
High	CVE-2026-98375	xen/netfront: drop RX packets with a short Ethernet header	7.0	0.0022	None reported
High	CVE-2026-98626	bpf: Restrict CO-RE poisoning to relocatable instructions	7.1	0.0021	None reported
High	CVE-2026-98034	bpf: Mark NULL kptr stores precise	7.1	0.0020	None reported
High	CVE-2026-98463	linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core...	n/a	0.0020	None reported
High	CVE-2026-98542	cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict	n/a	0.0020	None reported
High	CVE-2026-98552	perf/core: Fix a refcount leak in attach_perf_ctx_data()	n/a	0.0020	None reported
High	CVE-2026-98584	net/sched: fix potential stack infoleak in em_text_dump()	n/a	0.0020	None reported
High	CVE-2026-98595	udp: remove a disconnected socket from the 4-tuple hash table	n/a	0.0020	None reported
High	CVE-2026-98804	net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()	n/a	0.0020	None reported

Also fixes CVE-2026-98794

ALAS2023-2026-3335
bpftool6.12, bpftool6.12-debuginfo, kernel-livepatch-6.12.113-138.209 and 15 more on amzn 2023
DEBIAN-CVE-2026-98794
linux, linux-6.12 on Debian 12.15 (bookworm), Debian 13.5 (trixie), Debian 14

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-3251.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-3251">ALAS2023-2026-3251 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.