# ALAS2023-2026-1455: Security update for 22 packages

ALAS2023-2026-1455, released March 2, 2026, fixes 48 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1455
- Platform: Linux
- Released: Mar 2, 2026
- Priority: High (Closes CVE-2026-23003, high severity)
- CVEs: 48, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1455.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel-livepatch-6.12.68-92.122](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.68-92.122.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-libbpf](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-devel.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-libbpf-static](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-static.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.68-92.122.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-23003](https://patchblox.com/security/data/cve/CVE-2026-23003.md) | High | kernel-64kb: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246). | 8.8 | 0.0055 |  |
| [CVE-2026-23054](https://patchblox.com/security/data/cve/CVE-2026-23054.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0021 |  |
| [CVE-2026-23001](https://patchblox.com/security/data/cve/CVE-2026-23001.md) | High | kernel-64kb: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232). | 7.8 | 0.0021 |  |
| [CVE-2026-23025](https://patchblox.com/security/data/cve/CVE-2026-23025.md) | High | kernel-uek: mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] | 7.8 | 0.0021 |  |
| [CVE-2026-23050](https://patchblox.com/security/data/cve/CVE-2026-23050.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0020 |  |
| [CVE-2026-23010](https://patchblox.com/security/data/cve/CVE-2026-23010.md) | High | kernel-64kb: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332). | 7.8 | 0.0020 |  |
| [CVE-2026-23074](https://patchblox.com/security/data/cve/CVE-2026-23074.md) | High | kernel-64kb: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749). | 7.8 | 0.0019 |  |
| [CVE-2026-23002](https://patchblox.com/security/data/cve/CVE-2026-23002.md) | High | kernel-64k-debug-modules: kernel: lib/buildid: use __kernel_read() for sleepable context | 7.0 | 0.0018 |  |
| [CVE-2026-23099](https://patchblox.com/security/data/cve/CVE-2026-23099.md) | High | kernel-64kb: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816). | 7.1 | 0.0017 |  |
| [CVE-2026-23083](https://patchblox.com/security/data/cve/CVE-2026-23083.md) | High | kernel-64kb: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745). | 7.8 | 0.0016 |  |
| [CVE-2026-23144](https://patchblox.com/security/data/cve/CVE-2026-23144.md) | High | kernel-64kb: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (bsc#1258290). | 7.3 | 0.0015 |  |
| [CVE-2026-23105](https://patchblox.com/security/data/cve/CVE-2026-23105.md) | High | kernel-64kb: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (bsc#1257775). | 8.8 | 0.0015 |  |
| [CVE-2026-23103](https://patchblox.com/security/data/cve/CVE-2026-23103.md) | High | kernel: kernel: ipvlan: Make the addrs_lock be per port | 8.8 | 0.0013 |  |
| [CVE-2026-23110](https://patchblox.com/security/data/cve/CVE-2026-23110.md) | High | kernel-64k: kernel: scsi: core: Wake up the error handler when final completions race against each other | 7.8 | 0.0011 |  |
| [CVE-2026-23097](https://patchblox.com/security/data/cve/CVE-2026-23097.md) | High | kernel-64kb: migrate: correct lock ordering for hugetlb file folios (bsc#1257815). | 7.5 | 0.0011 |  |
| [CVE-2025-68365](https://patchblox.com/security/data/cve/CVE-2025-68365.md) | Routine | kernel-64kb: fs/ntfs3: Initialize allocated memory before use (bsc#1255548). | 5.5 | 0.0041 |  |
| [CVE-2026-23095](https://patchblox.com/security/data/cve/CVE-2026-23095.md) | Routine | kernel-64kb: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808). | 5.5 | 0.0031 |  |
| [CVE-2026-23038](https://patchblox.com/security/data/cve/CVE-2026-23038.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0028 |  |
| [CVE-2026-23035](https://patchblox.com/security/data/cve/CVE-2026-23035.md) | Routine | kernel-64kb: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559). | 5.1 | 0.0024 |  |
| [CVE-2026-22999](https://patchblox.com/security/data/cve/CVE-2026-22999.md) | Routine | kernel-64kb: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236). | 5.5 | 0.0024 |  |
| [CVE-2026-23032](https://patchblox.com/security/data/cve/CVE-2026-23032.md) | Routine | kernel-uek: null_blk: fix kmemleak by releasing references to fault configfs items (Nilay Shroff) [Orabug: 38914794] | 4.4 | 0.0023 |  |
| [CVE-2025-38591](https://patchblox.com/security/data/cve/CVE-2025-38591.md) | Routine | bpf: Reject narrower access to pointer ctx fields | 5.5 | 0.0022 |  |
| [CVE-2026-23005](https://patchblox.com/security/data/cve/CVE-2026-23005.md) | Routine | kernel-64kb: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245). | 5.5 | 0.0022 |  |
| [CVE-2026-22996](https://patchblox.com/security/data/cve/CVE-2026-22996.md) | Routine | kernel-64kb: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv. | 5.5 | 0.0021 |  |
| [CVE-2026-23011](https://patchblox.com/security/data/cve/CVE-2026-23011.md) | Routine | kernel-64kb: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207). | 6.6 | 0.0021 |  |
| [CVE-2026-23053](https://patchblox.com/security/data/cve/CVE-2026-23053.md) | Routine | kernel-64kb: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718). | 5.3 | 0.0020 |  |
| [CVE-2026-23057](https://patchblox.com/security/data/cve/CVE-2026-23057.md) | Routine | kernel-64kb: vsock/virtio: Coalesce only linear skb (bsc#1257740). | 5.5 | 0.0020 |  |
| [CVE-2025-68725](https://patchblox.com/security/data/cve/CVE-2025-68725.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-68358](https://patchblox.com/security/data/cve/CVE-2025-68358.md) | Routine | kernel-64kb: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531). | 5.5 | 0.0018 |  |
| [CVE-2026-23069](https://patchblox.com/security/data/cve/CVE-2026-23069.md) | Routine | kernel-64kb: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755). | 5.5 | 0.0018 |  |
| [CVE-2026-23060](https://patchblox.com/security/data/cve/CVE-2026-23060.md) | Routine | kernel-64kb: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735). | 6.5 | 0.0018 |  |
| [CVE-2026-23000](https://patchblox.com/security/data/cve/CVE-2026-23000.md) | Routine | kernel-64kb: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234). | 5.5 | 0.0018 |  |
| [CVE-2025-71194](https://patchblox.com/security/data/cve/CVE-2025-71194.md) | Routine | bpftool: In the Linux kernel, the following vulnerability has been resolved | 5.5 | 0.0018 |  |
| [CVE-2026-23128](https://patchblox.com/security/data/cve/CVE-2026-23128.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2026-23086](https://patchblox.com/security/data/cve/CVE-2026-23086.md) | Routine | kernel-64kb: vsock/virtio: cap TX credit to local buffer size (bsc#1257757). | 6.2 | 0.0017 |  |
| [CVE-2025-68351](https://patchblox.com/security/data/cve/CVE-2025-68351.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2026-23107](https://patchblox.com/security/data/cve/CVE-2026-23107.md) | Routine | kernel-64kb: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762). | 6.2 | 0.0015 |  |
| [CVE-2026-23113](https://patchblox.com/security/data/cve/CVE-2026-23113.md) | Routine | kernel-64kb: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278). | 5.5 | 0.0015 |  |
| [CVE-2026-23085](https://patchblox.com/security/data/cve/CVE-2026-23085.md) | Routine | kernel-64kb: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758). | 5.5 | 0.0015 |  |
| [CVE-2026-23141](https://patchblox.com/security/data/cve/CVE-2026-23141.md) | Routine | kernel-64kb: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377). | 5.5 | 0.0015 |  |
| [CVE-2026-23145](https://patchblox.com/security/data/cve/CVE-2026-23145.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0015 |  |
| [CVE-2026-23142](https://patchblox.com/security/data/cve/CVE-2026-23142.md) | Routine | kernel-64kb: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (bsc#1258289). | 5.5 | 0.0015 |  |
| [CVE-2026-23071](https://patchblox.com/security/data/cve/CVE-2026-23071.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0014 |  |
| [CVE-2026-23119](https://patchblox.com/security/data/cve/CVE-2026-23119.md) | Routine | kernel-64kb: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273). | 5.5 | 0.0014 |  |
| [CVE-2026-23125](https://patchblox.com/security/data/cve/CVE-2026-23125.md) | Routine | kernel-64kb: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293). | 5.5 | 0.0014 |  |
| [CVE-2026-23124](https://patchblox.com/security/data/cve/CVE-2026-23124.md) | Routine | kernel-uek: ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] | 5.9 | 0.0011 |  |
| [CVE-2025-68333](https://patchblox.com/security/data/cve/CVE-2025-68333.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0011 |  |
| [CVE-2026-23126](https://patchblox.com/security/data/cve/CVE-2026-23126.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 6.3 | 0.0010 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.