# ALAS2023-2026-1495: Security update for 22 packages

ALAS2023-2026-1495, released March 16, 2026, fixes 50 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1495
- Platform: Linux
- Released: Mar 16, 2026
- Priority: Urgent (Closes CVE-2025-40350, rated Critical)
- CVEs: 50, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1495.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel-livepatch-6.12.58-82.121](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.58-82.121.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-libbpf](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-devel.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-libbpf-static](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-static.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.58-82.121.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-40350](https://patchblox.com/security/data/cve/CVE-2025-40350.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: RX, Fix generating skb from non-linea... | 9.8 | 0.0055 |  |
| [CVE-2025-40320](https://patchblox.com/security/data/cve/CVE-2025-40320.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix potential cfid UAF in smb2_quer... | 9.8 | 0.0045 |  |
| [CVE-2025-40240](https://patchblox.com/security/data/cve/CVE-2025-40240.md) | High | sctp: avoid NULL dereference when chunk data buffer is missing | 8.6 | 0.0064 |  |
| [CVE-2025-40328](https://patchblox.com/security/data/cve/CVE-2025-40328.md) | High | smb: client: fix potential UAF in smb2_close_cached_fid() | 8.8 | 0.0049 |  |
| [CVE-2025-40324](https://patchblox.com/security/data/cve/CVE-2025-40324.md) | High | NFSD: Fix crash in nfsd4_read_release() | 7.5 | 0.0049 |  |
| [CVE-2025-68321](https://patchblox.com/security/data/cve/CVE-2025-68321.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  page_pool: always add GFP_NOWARN for ATOMIC allo... | 7.5 | 0.0045 |  |
| [CVE-2025-40329](https://patchblox.com/security/data/cve/CVE-2025-40329.md) | High | drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb | 7.0 | 0.0024 |  |
| [CVE-2025-68188](https://patchblox.com/security/data/cve/CVE-2025-68188.md) | High | tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() | 7.8 | 0.0022 |  |
| [CVE-2025-68311](https://patchblox.com/security/data/cve/CVE-2025-68311.md) | High | tty: serial: ip22zilog: Use platform device for probing | 7.8 | 0.0022 |  |
| [CVE-2025-40237](https://patchblox.com/security/data/cve/CVE-2025-40237.md) | High | kernel-64kb: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809). | 7.1 | 0.0022 |  |
| [CVE-2025-40293](https://patchblox.com/security/data/cve/CVE-2025-40293.md) | High | iommufd: Don't overflow during division for dirty tracking | 7.0 | 0.0022 |  |
| [CVE-2025-68177](https://patchblox.com/security/data/cve/CVE-2025-68177.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  cpufreq/longhaul: handle NULL policy in longhaul... | n/a | 0.0021 |  |
| [CVE-2025-40211](https://patchblox.com/security/data/cve/CVE-2025-40211.md) | High | ACPI: video: Fix use-after-free in acpi_video_switch_brightness() | 7.8 | 0.0021 |  |
| [CVE-2025-40331](https://patchblox.com/security/data/cve/CVE-2025-40331.md) | High | sctp: Prevent TOCTOU out-of-bounds write | 7.8 | 0.0020 |  |
| [CVE-2025-40348](https://patchblox.com/security/data/cve/CVE-2025-40348.md) | High | kernel-uek: ELSA-2026-50006: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0020 |  |
| [CVE-2025-40357](https://patchblox.com/security/data/cve/CVE-2025-40357.md) | High | kernel-64kb: net/smc: fix general protection fault in __smc_diag_dump (bsc#1255097). | n/a | 0.0020 |  |
| [CVE-2025-68186](https://patchblox.com/security/data/cve/CVE-2025-68186.md) | High | kernel-64kb: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144). | n/a | 0.0020 |  |
| [CVE-2025-40292](https://patchblox.com/security/data/cve/CVE-2025-40292.md) | High | virtio-net: fix received length check in big packets | 8.4 | 0.0018 |  |
| [CVE-2025-40297](https://patchblox.com/security/data/cve/CVE-2025-40297.md) | High | net: bridge: fix use-after-free due to MST port state bypass | 7.8 | 0.0017 |  |
| [CVE-2025-40362](https://patchblox.com/security/data/cve/CVE-2025-40362.md) | High | ceph: fix multifs mds auth caps issue | 8.8 | 0.0016 |  |
| [CVE-2025-40307](https://patchblox.com/security/data/cve/CVE-2025-40307.md) | High | exfat: validate cluster allocation bits of the allocation bitmap | 7.8 | 0.0016 |  |
| [CVE-2025-40304](https://patchblox.com/security/data/cve/CVE-2025-40304.md) | High | fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds | 7.8 | 0.0015 |  |
| [CVE-2025-40317](https://patchblox.com/security/data/cve/CVE-2025-40317.md) | High | regmap: slimbus: fix bus_context pointer in regmap init calls | 7.8 | 0.0015 |  |
| [CVE-2025-40319](https://patchblox.com/security/data/cve/CVE-2025-40319.md) | High | bpf: Sync pending IRQ work before freeing ring buffer | 7.8 | 0.0015 |  |
| [CVE-2025-68171](https://patchblox.com/security/data/cve/CVE-2025-68171.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  x86/fpu: Ensure XFD state on signal delivery  Se... | 7.8 | 0.0015 |  |
| [CVE-2025-68183](https://patchblox.com/security/data/cve/CVE-2025-68183.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ima: don't clear IMA_DIGSIG flag when setting or... | 7.8 | 0.0015 |  |
| [CVE-2025-40322](https://patchblox.com/security/data/cve/CVE-2025-40322.md) | High | fbdev: bitblit: bound-check glyph index in bit_putcs* | 7.8 | 0.0015 |  |
| [CVE-2025-68167](https://patchblox.com/security/data/cve/CVE-2025-68167.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  gpiolib: fix invalid pointer access in debugfs... | 7.8 | 0.0015 |  |
| [CVE-2025-40302](https://patchblox.com/security/data/cve/CVE-2025-40302.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  media: videobuf2: forbid remove_bufs when legacy... | 7.8 | 0.0015 |  |
| [CVE-2025-40323](https://patchblox.com/security/data/cve/CVE-2025-40323.md) | High | fbcon: Set fb_display[i]->mode to NULL when the mode is released | 8.8 | 0.0015 |  |
| [CVE-2025-40303](https://patchblox.com/security/data/cve/CVE-2025-40303.md) | High | btrfs: ensure no dirty metadata is written back for an fs with errors | 7.8 | 0.0015 |  |
| [CVE-2025-68317](https://patchblox.com/security/data/cve/CVE-2025-68317.md) | High | io_uring/zctx: check chained notif contexts | 7.8 | 0.0014 |  |
| [CVE-2025-68313](https://patchblox.com/security/data/cve/CVE-2025-68313.md) | High | x86/CPU/AMD: Add RDSEED fix for Zen5 | 7.1 | 0.0014 |  |
| [CVE-2025-40341](https://patchblox.com/security/data/cve/CVE-2025-40341.md) | Routine | futex: Don't leak robust_list pointer on exec race | 5.5 | 0.0025 |  |
| [CVE-2025-40230](https://patchblox.com/security/data/cve/CVE-2025-40230.md) | Routine | kernel-64kb: mm: prevent poison consumption when splitting THP (bsc#1254817). | 5.9 | 0.0023 |  |
| [CVE-2025-40231](https://patchblox.com/security/data/cve/CVE-2025-40231.md) | Routine | kernel-64kb: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815). | 5.5 | 0.0022 |  |
| [CVE-2025-40238](https://patchblox.com/security/data/cve/CVE-2025-40238.md) | Routine | kernel-64kb: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871). | 4.7 | 0.0021 |  |
| [CVE-2025-40363](https://patchblox.com/security/data/cve/CVE-2025-40363.md) | Routine | kernel-64kb: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102). | 5.5 | 0.0021 |  |
| [CVE-2025-40235](https://patchblox.com/security/data/cve/CVE-2025-40235.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-68185](https://patchblox.com/security/data/cve/CVE-2025-68185.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-40346](https://patchblox.com/security/data/cve/CVE-2025-40346.md) | Routine | kernel-64kb: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (bsc#1255318). | 5.5 | 0.0021 |  |
| [CVE-2025-40360](https://patchblox.com/security/data/cve/CVE-2025-40360.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-40083](https://patchblox.com/security/data/cve/CVE-2025-40083.md) | Routine | net/sched: sch_qfq: Fix null-deref in agg_dequeue | 5.9 | 0.0021 |  |
| [CVE-2025-40313](https://patchblox.com/security/data/cve/CVE-2025-40313.md) | Routine | ntfs3: pretend $Extend records as regular files | 5.5 | 0.0021 |  |
| [CVE-2025-68191](https://patchblox.com/security/data/cve/CVE-2025-68191.md) | Routine | bpftool: udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] | 3.3 | 0.0021 |  |
| [CVE-2025-68173](https://patchblox.com/security/data/cve/CVE-2025-68173.md) | Routine | kernel-64kb: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311). | 5.5 | 0.0020 |  |
| [CVE-2025-68178](https://patchblox.com/security/data/cve/CVE-2025-68178.md) | Routine | kernel-64kb: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266). | 5.5 | 0.0020 |  |
| [CVE-2025-40359](https://patchblox.com/security/data/cve/CVE-2025-40359.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 |  |
| [CVE-2025-40353](https://patchblox.com/security/data/cve/CVE-2025-40353.md) | Routine | arm64: mte: Do not warn if the page is already tagged in copy_highpage() | 4.0 | 0.0020 |  |
| [CVE-2025-40209](https://patchblox.com/security/data/cve/CVE-2025-40209.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.4 | 0.0020 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.