# ALAS2023-2024-696: Security update for 21 packages ALAS2023-2024-696, released August 1, 2024, fixes 64 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2024-696 - Platform: Linux - Released: Aug 1, 2024 - Priority: High (Closes CVE-2024-36031, high severity) - CVEs: 64, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2024-696.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-livepatch-6.1.84-99.169](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.84-99.169.md) | amzn 2023 | 1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 6.1.84-99.169.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-36031](https://patchblox.com/security/data/cve/CVE-2024-36031.md) | High | dtb-aarch64: Security update for the Linux Kernel | 9.8 | 0.0075 | | | [CVE-2024-26584](https://patchblox.com/security/data/cve/CVE-2024-26584.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0075 | | | [CVE-2024-26880](https://patchblox.com/security/data/cve/CVE-2024-26880.md) | High | kernel-debug: dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] | 7.8 | 0.0072 | | | [CVE-2024-26882](https://patchblox.com/security/data/cve/CVE-2024-26882.md) | High | dtb-aarch64: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034). | 7.8 | 0.0070 | | | [CVE-2024-26864](https://patchblox.com/security/data/cve/CVE-2024-26864.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix refcnt handling in __inet_hash_connect() | 7.8 | 0.0061 | | | [CVE-2024-26585](https://patchblox.com/security/data/cve/CVE-2024-26585.md) | High | bpftool: tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584 CVE-2024-26583 | 7.0 | 0.0059 | | | [CVE-2024-23307](https://patchblox.com/security/data/cve/CVE-2024-23307.md) | High | kernel: md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] | 7.8 | 0.0059 | | | [CVE-2024-26898](https://patchblox.com/security/data/cve/CVE-2024-26898.md) | High | kernel-azure: Security update for the Linux Kernel | 7.8 | 0.0031 | | | [CVE-2024-26976](https://patchblox.com/security/data/cve/CVE-2024-26976.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU... | 7.8 | 0.0026 | | | [CVE-2024-27065](https://patchblox.com/security/data/cve/CVE-2024-27065.md) | High | kernel-rt: RHSA-2024:5102: kernel-rt security update (Important) | 7.8 | 0.0026 | | | [CVE-2024-26894](https://patchblox.com/security/data/cve/CVE-2024-26894.md) | High | kernel-core: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] | 7.8 | 0.0025 | | | [CVE-2024-26883](https://patchblox.com/security/data/cve/CVE-2024-26883.md) | High | dtb-aarch64: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035). | 7.8 | 0.0025 | | | [CVE-2024-26906](https://patchblox.com/security/data/cve/CVE-2024-26906.md) | High | python3-perf: kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() | 7.0 | 0.0025 | | | [CVE-2024-26958](https://patchblox.com/security/data/cve/CVE-2024-26958.md) | High | kernel-debug-core: Important: kernel security update | 7.8 | 0.0025 | | | [CVE-2024-26950](https://patchblox.com/security/data/cve/CVE-2024-26950.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx in... | 7.8 | 0.0024 | | | [CVE-2024-35791](https://patchblox.com/security/data/cve/CVE-2024-35791.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2024-26951](https://patchblox.com/security/data/cve/CVE-2024-26951.md) | High | dtb-aarch64: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660). | 7.8 | 0.0023 | | | [CVE-2024-26865](https://patchblox.com/security/data/cve/CVE-2024-26865.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_tim... | 7.8 | 0.0023 | | | [CVE-2024-26810](https://patchblox.com/security/data/cve/CVE-2024-26810.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask o... | 7.8 | 0.0020 | | | [CVE-2024-35809](https://patchblox.com/security/data/cve/CVE-2024-35809.md) | High | kernel-source-azure: Security update for the Linux Kernel | 7.8 | 0.0020 | | | [CVE-2024-26934](https://patchblox.com/security/data/cve/CVE-2024-26934.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0019 | | | [CVE-2024-25742](https://patchblox.com/security/data/cve/CVE-2024-25742.md) | High | kernel-tools: RHSA-2024:3138: kernel security, bug fix, and enhancement update (Moderate) | 8.0 | 0.0018 | | | [CVE-2024-26960](https://patchblox.com/security/data/cve/CVE-2024-26960.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache()... | 7.0 | 0.0018 | | | [CVE-2024-26933](https://patchblox.com/security/data/cve/CVE-2024-26933.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0018 | | | [CVE-2023-53151](https://patchblox.com/security/data/cve/CVE-2023-53151.md) | High | dtb-aarch64: Security update for the Linux Kernel | 8.0 | 0.0012 | | | [CVE-2024-27388](https://patchblox.com/security/data/cve/CVE-2024-27388.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0096 | | | [CVE-2024-35823](https://patchblox.com/security/data/cve/CVE-2024-35823.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0092 | | | [CVE-2024-26901](https://patchblox.com/security/data/cve/CVE-2024-26901.md) | Routine | kernel-debug-core: kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872) * kernel: usb: ulp... | 5.5 | 0.0083 | | | [CVE-2024-26868](https://patchblox.com/security/data/cve/CVE-2024-26868.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0061 | | | [CVE-2024-27435](https://patchblox.com/security/data/cve/CVE-2024-27435.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0040 | | | [CVE-2023-52656](https://patchblox.com/security/data/cve/CVE-2023-52656.md) | Routine | kernel-docs: Dropped any code related to SCM_RIGHTS (bsc#1224187). | 5.5 | 0.0031 | | | [CVE-2024-26816](https://patchblox.com/security/data/cve/CVE-2024-26816.md) | Routine | dtb-aarch64: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624). | 5.5 | 0.0031 | | | [CVE-2024-26809](https://patchblox.com/security/data/cve/CVE-2024-26809.md) | Routine | dtb-aarch64: netfilter: nft_set_pipapo: release elements in clone only from destroy path (bsc#1222633). | 5.5 | 0.0029 | | | [CVE-2024-27038](https://patchblox.com/security/data/cve/CVE-2024-27038.md) | Routine | bpftool: ELSA-2024-9315: kernel security update (MODERATE) | 5.5 | 0.0029 | | | [CVE-2024-27025](https://patchblox.com/security/data/cve/CVE-2024-27025.md) | Routine | kernel-rt: (CVE-2021-47548) * (CVE-2023-52619) | 5.5 | 0.0029 | | | [CVE-2024-26815](https://patchblox.com/security/data/cve/CVE-2024-26815.md) | Routine | dtb-aarch64: Fixed improper TCA_TAPRIO_TC_ENTRY_INDEX check (bsc#1222635). | 5.5 | 0.0029 | | | [CVE-2024-26870](https://patchblox.com/security/data/cve/CVE-2024-26870.md) | Routine | kernel-rt: kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 | 5.5 | 0.0028 | | | [CVE-2024-27047](https://patchblox.com/security/data/cve/CVE-2024-27047.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing a... | 5.5 | 0.0028 | | | [CVE-2024-26937](https://patchblox.com/security/data/cve/CVE-2024-26937.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0027 | | | [CVE-2024-26642](https://patchblox.com/security/data/cve/CVE-2024-26642.md) | Routine | dtb-aarch64: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830). | 5.5 | 0.0027 | | | [CVE-2024-26973](https://patchblox.com/security/data/cve/CVE-2024-26973.md) | Routine | kernel-zfcpdump-core: kernel: fat: fix uninitialized field in nostale filehandles | 5.5 | 0.0026 | | | [CVE-2024-26812](https://patchblox.com/security/data/cve/CVE-2024-26812.md) | Routine | dtb-aarch64: kABI: vfio: struct virqfd kABI workaround (bsc#1222808). | 5.5 | 0.0025 | | | [CVE-2024-26863](https://patchblox.com/security/data/cve/CVE-2024-26863.md) | Routine | dtb-aarch64: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021). | 5.5 | 0.0025 | | | [CVE-2024-35815](https://patchblox.com/security/data/cve/CVE-2024-35815.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0025 | | | [CVE-2024-26935](https://patchblox.com/security/data/cve/CVE-2024-26935.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2024-26946](https://patchblox.com/security/data/cve/CVE-2024-26946.md) | Routine | dtb-aarch64: Fixed copy_from_kernel_nofault() to read from unsafe address (bsc#1223669). | 5.5 | 0.0024 | | | [CVE-2024-27437](https://patchblox.com/security/data/cve/CVE-2024-27437.md) | Routine | kernel-64kb: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625). | 5.5 | 0.0024 | | | [CVE-2024-27389](https://patchblox.com/security/data/cve/CVE-2024-27389.md) | Routine | kernel-uek64k: pstore: inode: Only d_invalidate() is needed (Kees Cook) [Orabug: 36598300] | 5.5 | 0.0024 | | | [CVE-2024-35804](https://patchblox.com/security/data/cve/CVE-2024-35804.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2024-35801](https://patchblox.com/security/data/cve/CVE-2024-35801.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2024-26891](https://patchblox.com/security/data/cve/CVE-2024-26891.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request... | 5.5 | 0.0023 | | | [CVE-2024-26964](https://patchblox.com/security/data/cve/CVE-2024-26964.md) | Routine | bpftool: kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma | 5.5 | 0.0023 | | | [CVE-2024-35800](https://patchblox.com/security/data/cve/CVE-2024-35800.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2024-26977](https://patchblox.com/security/data/cve/CVE-2024-26977.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak The #ifdef... | 5.5 | 0.0023 | | | [CVE-2024-27390](https://patchblox.com/security/data/cve/CVE-2024-27390.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrie... | 5.5 | 0.0022 | | | [CVE-2024-26860](https://patchblox.com/security/data/cve/CVE-2024-26860.md) | Routine | kernel-64kb: Fixed a memory leak when rechecking the data (bsc#1223077). | 5.5 | 0.0022 | | | [CVE-2024-26938](https://patchblox.com/security/data/cve/CVE-2024-26938.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2024-35827](https://patchblox.com/security/data/cve/CVE-2024-35827.md) | Routine | dtb-aarch64: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (bsc#1224606). | 5.5 | 0.0022 | | | [CVE-2024-35826](https://patchblox.com/security/data/cve/CVE-2024-35826.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2024-26862](https://patchblox.com/security/data/cve/CVE-2024-26862.md) | Routine | dtb-aarch64: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111). | 4.7 | 0.0021 | | | [CVE-2024-26643](https://patchblox.com/security/data/cve/CVE-2024-26643.md) | Routine | dtb-aarch64: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829). | 5.5 | 0.0020 | | | [CVE-2024-26878](https://patchblox.com/security/data/cve/CVE-2024-26878.md) | Routine | kernel-rt-modules-extra: kernel: quota: Fix potential NULL pointer dereference | 5.5 | 0.0019 | | | [CVE-2024-35805](https://patchblox.com/security/data/cve/CVE-2024-35805.md) | Routine | dtb-aarch64: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743). | 5.5 | 0.0018 | | | [CVE-2024-26861](https://patchblox.com/security/data/cve/CVE-2024-26861.md) | Routine | dtb-aarch64: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076). | 4.7 | 0.0018 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.