ALAS2023-2026-2071: CVEs fixed (Amazon Linux)

ALAS2023-2026-2071 fixes 27 tracked CVEs. Affected systems and fixed versions.

• CVE-2026-72366 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to ha
• CVE-2026-72084 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID pa
• CVE-2026-72083 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-af
• CVE-2026-72041 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix
• CVE-2026-72020 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_
• CVE-2026-72014 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-
• CVE-2026-68477 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 tra
• CVE-2026-64530 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUME
• CVE-2026-74361 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The f
• CVE-2026-74267 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_t
• CVE-2026-72472 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal
• CVE-2026-72466 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounde
• CVE-2026-72436 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in
• CVE-2026-72421 CRITICAL 10.0 In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in lo
• CVE-2026-72351 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option leng
• CVE-2026-72322 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD del
• CVE-2026-72319 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors
• CVE-2026-72317 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS
• CVE-2026-72251 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: reload possible st
• CVE-2026-72222 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchron
• CVE-2026-72221 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake
• CVE-2026-72194 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_bu
• CVE-2026-72192 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to_move in indx_insert_into_
• CVE-2026-72451 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race
• CVE-2026-72220 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq_procinfo lifecycle to p
• CVE-2026-72217 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() sto
• CVE-2026-72139 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig_info kfree past RCU gra

Applies to

• Amazon Linux 2023

← Back to latest CVEs