# ALAS2023-2026-1468: Security update for 22 packages

ALAS2023-2026-1468, released March 2, 2026, fixes 52 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1468
- Platform: Linux
- Released: Mar 2, 2026
- Priority: High (Closes CVE-2026-23111, high severity)
- CVEs: 52, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1468.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-livepatch-6.1.163-186.299](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.163-186.299.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |
| [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.163-186.299.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-23111](https://patchblox.com/security/data/cve/CVE-2026-23111.md) | High | kernel-64kb: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (bsc#1258181). | 7.8 | 0.0113 |  |
| [CVE-2026-23003](https://patchblox.com/security/data/cve/CVE-2026-23003.md) | High | kernel-64kb: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246). | 8.8 | 0.0055 |  |
| [CVE-2025-40328](https://patchblox.com/security/data/cve/CVE-2025-40328.md) | High | smb: client: fix potential UAF in smb2_close_cached_fid() | 8.8 | 0.0049 |  |
| [CVE-2026-23193](https://patchblox.com/security/data/cve/CVE-2026-23193.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414). | 7.8 | 0.0036 |  |
| [CVE-2026-23054](https://patchblox.com/security/data/cve/CVE-2026-23054.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0021 |  |
| [CVE-2026-23001](https://patchblox.com/security/data/cve/CVE-2026-23001.md) | High | kernel-64kb: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232). | 7.8 | 0.0021 |  |
| [CVE-2026-23025](https://patchblox.com/security/data/cve/CVE-2026-23025.md) | High | kernel-uek: mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] | 7.8 | 0.0021 |  |
| [CVE-2026-23010](https://patchblox.com/security/data/cve/CVE-2026-23010.md) | High | kernel-64kb: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332). | 7.8 | 0.0020 |  |
| [CVE-2026-23074](https://patchblox.com/security/data/cve/CVE-2026-23074.md) | High | kernel-64kb: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749). | 7.8 | 0.0019 |  |
| [CVE-2023-54285](https://patchblox.com/security/data/cve/CVE-2023-54285.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_8: Security update for the Linux Kernel | 7.8 | 0.0018 |  |
| [CVE-2026-23209](https://patchblox.com/security/data/cve/CVE-2026-23209.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 |  |
| [CVE-2026-23099](https://patchblox.com/security/data/cve/CVE-2026-23099.md) | High | kernel-64kb: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816). | 7.1 | 0.0017 |  |
| [CVE-2025-38718](https://patchblox.com/security/data/cve/CVE-2025-38718.md) | High | sctp: linearize cloned gso packets in sctp_rcv | 7.8 | 0.0017 |  |
| [CVE-2025-71089](https://patchblox.com/security/data/cve/CVE-2025-71089.md) | High | iommu: disable SVA when CONFIG_X86 is set | 7.8 | 0.0016 |  |
| [CVE-2026-23083](https://patchblox.com/security/data/cve/CVE-2026-23083.md) | High | kernel-64kb: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745). | 7.8 | 0.0016 |  |
| [CVE-2025-68340](https://patchblox.com/security/data/cve/CVE-2025-68340.md) | High | kernel-64kb: team: Move team device type change at the end of team_port_add (bsc#1255507). | 7.0 | 0.0015 |  |
| [CVE-2026-23144](https://patchblox.com/security/data/cve/CVE-2026-23144.md) | High | kernel-64kb: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (bsc#1258290). | 7.3 | 0.0015 |  |
| [CVE-2026-23105](https://patchblox.com/security/data/cve/CVE-2026-23105.md) | High | kernel-64kb: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (bsc#1257775). | 8.8 | 0.0015 |  |
| [CVE-2026-23156](https://patchblox.com/security/data/cve/CVE-2026-23156.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0014 |  |
| [CVE-2026-23216](https://patchblox.com/security/data/cve/CVE-2026-23216.md) | High | scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() | 8.8 | 0.0014 |  |
| [CVE-2026-23102](https://patchblox.com/security/data/cve/CVE-2026-23102.md) | High | kernel-64kb: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772). | 7.1 | 0.0014 |  |
| [CVE-2026-23168](https://patchblox.com/security/data/cve/CVE-2026-23168.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq... | 7.8 | 0.0014 |  |
| [CVE-2026-23103](https://patchblox.com/security/data/cve/CVE-2026-23103.md) | High | kernel: kernel: ipvlan: Make the addrs_lock be per port | 8.8 | 0.0013 |  |
| [CVE-2026-23110](https://patchblox.com/security/data/cve/CVE-2026-23110.md) | High | kernel-64k: kernel: scsi: core: Wake up the error handler when final completions race against each other | 7.8 | 0.0011 |  |
| [CVE-2026-23097](https://patchblox.com/security/data/cve/CVE-2026-23097.md) | High | kernel-64kb: migrate: correct lock ordering for hugetlb file folios (bsc#1257815). | 7.5 | 0.0011 |  |
| [CVE-2025-68365](https://patchblox.com/security/data/cve/CVE-2025-68365.md) | Routine | kernel-64kb: fs/ntfs3: Initialize allocated memory before use (bsc#1255548). | 5.5 | 0.0041 |  |
| [CVE-2025-71268](https://patchblox.com/security/data/cve/CVE-2025-71268.md) | Routine | kernel-livepatch-SLE15-SP7-RT_Update_11: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865). | 5.5 | 0.0033 |  |
| [CVE-2026-23095](https://patchblox.com/security/data/cve/CVE-2026-23095.md) | Routine | kernel-64kb: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808). | 5.5 | 0.0031 |  |
| [CVE-2026-23038](https://patchblox.com/security/data/cve/CVE-2026-23038.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0028 |  |
| [CVE-2026-22999](https://patchblox.com/security/data/cve/CVE-2026-22999.md) | Routine | kernel-64kb: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236). | 5.5 | 0.0024 |  |
| [CVE-2025-38591](https://patchblox.com/security/data/cve/CVE-2025-38591.md) | Routine | bpf: Reject narrower access to pointer ctx fields | 5.5 | 0.0022 |  |
| [CVE-2026-23005](https://patchblox.com/security/data/cve/CVE-2026-23005.md) | Routine | kernel-64kb: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245). | 5.5 | 0.0022 |  |
| [CVE-2026-23011](https://patchblox.com/security/data/cve/CVE-2026-23011.md) | Routine | kernel-64kb: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207). | 6.6 | 0.0021 |  |
| [CVE-2025-68725](https://patchblox.com/security/data/cve/CVE-2025-68725.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2026-23069](https://patchblox.com/security/data/cve/CVE-2026-23069.md) | Routine | kernel-64kb: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755). | 5.5 | 0.0018 |  |
| [CVE-2026-23060](https://patchblox.com/security/data/cve/CVE-2026-23060.md) | Routine | kernel-64kb: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735). | 6.5 | 0.0018 |  |
| [CVE-2025-71194](https://patchblox.com/security/data/cve/CVE-2025-71194.md) | Routine | bpftool: In the Linux kernel, the following vulnerability has been resolved | 5.5 | 0.0018 |  |
| [CVE-2026-23128](https://patchblox.com/security/data/cve/CVE-2026-23128.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2026-23086](https://patchblox.com/security/data/cve/CVE-2026-23086.md) | Routine | kernel-64kb: vsock/virtio: cap TX credit to local buffer size (bsc#1257757). | 6.2 | 0.0017 |  |
| [CVE-2023-53421](https://patchblox.com/security/data/cve/CVE-2023-53421.md) | Routine | blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() | 5.5 | 0.0017 |  |
| [CVE-2026-23107](https://patchblox.com/security/data/cve/CVE-2026-23107.md) | Routine | kernel-64kb: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762). | 6.2 | 0.0015 |  |
| [CVE-2026-23198](https://patchblox.com/security/data/cve/CVE-2026-23198.md) | Routine | kernel-64kb: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321). | 5.5 | 0.0015 |  |
| [CVE-2026-23085](https://patchblox.com/security/data/cve/CVE-2026-23085.md) | Routine | kernel-64kb: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758). | 5.5 | 0.0015 |  |
| [CVE-2026-23145](https://patchblox.com/security/data/cve/CVE-2026-23145.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0015 |  |
| [CVE-2026-23142](https://patchblox.com/security/data/cve/CVE-2026-23142.md) | Routine | kernel-64kb: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (bsc#1258289). | 5.5 | 0.0015 |  |
| [CVE-2026-23071](https://patchblox.com/security/data/cve/CVE-2026-23071.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0014 |  |
| [CVE-2026-23119](https://patchblox.com/security/data/cve/CVE-2026-23119.md) | Routine | kernel-64kb: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273). | 5.5 | 0.0014 |  |
| [CVE-2026-23125](https://patchblox.com/security/data/cve/CVE-2026-23125.md) | Routine | kernel-64kb: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293). | 5.5 | 0.0014 |  |
| [CVE-2026-23205](https://patchblox.com/security/data/cve/CVE-2026-23205.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0014 |  |
| [CVE-2026-23124](https://patchblox.com/security/data/cve/CVE-2026-23124.md) | Routine | kernel-uek: ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] | 5.9 | 0.0011 |  |
| [CVE-2026-23212](https://patchblox.com/security/data/cve/CVE-2026-23212.md) | Routine | bonding: annotate data-races around slave->last_rx | 5.5 | 0.0010 |  |
| [CVE-2026-23126](https://patchblox.com/security/data/cve/CVE-2026-23126.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 6.3 | 0.0010 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.