# ALAS2023-2026-1544: Security update for 22 packages

ALAS2023-2026-1544, released April 7, 2026, fixes 70 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1544
- Platform: Linux
- Released: Apr 7, 2026
- Priority: Urgent (Closes CVE-2025-71305, rated Critical)
- CVEs: 70, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1544.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-livepatch-6.1.166-197.305](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.166-197.305.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |
| [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.166-197.305.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-71305](https://patchblox.com/security/data/cve/CVE-2025-71305.md) | Urgent | drm/display/dp_mst: Add protection against 0 vcpi | 9.8 | 0.0016 |  |
| [CVE-2026-23231](https://patchblox.com/security/data/cve/CVE-2026-23231.md) | High | netfilter: nf_tables: fix use-after-free in nf_tables_addchain() | 7.8 | 0.0105 |  |
| [CVE-2026-45860](https://patchblox.com/security/data/cve/CVE-2026-45860.md) | High | kernel-64kb: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710). | 7.5 | 0.0075 |  |
| [CVE-2026-43186](https://patchblox.com/security/data/cve/CVE-2026-43186.md) | High | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0064 |  |
| [CVE-2026-43304](https://patchblox.com/security/data/cve/CVE-2026-43304.md) | High | kernel-64kb: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993). | 9.8 | 0.0061 |  |
| [CVE-2026-43194](https://patchblox.com/security/data/cve/CVE-2026-43194.md) | High | kernel-64kb: net: consume xmit errors of GSO frames (bsc#1264304). | 7.5 | 0.0053 |  |
| [CVE-2026-43226](https://patchblox.com/security/data/cve/CVE-2026-43226.md) | High | kernel-64kb: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544). | 7.5 | 0.0052 |  |
| [CVE-2026-43230](https://patchblox.com/security/data/cve/CVE-2026-43230.md) | High | kernel-64kb: net/rds: Clear reconnect pending bit (bsc#1264539). | 7.5 | 0.0052 |  |
| [CVE-2026-43158](https://patchblox.com/security/data/cve/CVE-2026-43158.md) | High | kernel-64kb: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595). | 8.8 | 0.0047 |  |
| [CVE-2026-43187](https://patchblox.com/security/data/cve/CVE-2026-43187.md) | High | kernel-64kb: xfs: delete attr leaf freemap entries when empty (bsc#1264603). | 8.8 | 0.0047 |  |
| [CVE-2026-43190](https://patchblox.com/security/data/cve/CVE-2026-43190.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length befo... | 8.2 | 0.0046 |  |
| [CVE-2026-43233](https://patchblox.com/security/data/cve/CVE-2026-43233.md) | High | kernel-64kb: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337). | 8.2 | 0.0046 |  |
| [CVE-2026-43139](https://patchblox.com/security/data/cve/CVE-2026-43139.md) | High | kernel-64kb: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294). | 8.6 | 0.0038 |  |
| [CVE-2026-45856](https://patchblox.com/security/data/cve/CVE-2026-45856.md) | High | kernel-64kb: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720). | 8.8 | 0.0019 |  |
| [CVE-2026-23243](https://patchblox.com/security/data/cve/CVE-2026-23243.md) | High | RDMA/umad: Reject negative data_len in ib_umad_write | 7.8 | 0.0018 |  |
| [CVE-2026-46253](https://patchblox.com/security/data/cve/CVE-2026-46253.md) | High | kernel-default: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635). | 7.8 | 0.0017 |  |
| [CVE-2026-45886](https://patchblox.com/security/data/cve/CVE-2026-45886.md) | High | kernel-default: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810). | 7.0 | 0.0016 |  |
| [CVE-2026-45935](https://patchblox.com/security/data/cve/CVE-2026-45935.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Fix slab-out-of-bounds read in DeleteI... | 7.8 | 0.0015 |  |
| [CVE-2026-43128](https://patchblox.com/security/data/cve/CVE-2026-43128.md) | High | kernel-64kb: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612). | 8.1 | 0.0014 |  |
| [CVE-2026-43150](https://patchblox.com/security/data/cve/CVE-2026-43150.md) | High | kernel-64kb: perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415). | 7.8 | 0.0014 |  |
| [CVE-2026-43133](https://patchblox.com/security/data/cve/CVE-2026-43133.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.1 | 0.0013 |  |
| [CVE-2026-46251](https://patchblox.com/security/data/cve/CVE-2026-46251.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix block_group_tree dirty_list corruptio... | 8.4 | 0.0013 |  |
| [CVE-2026-45862](https://patchblox.com/security/data/cve/CVE-2026-45862.md) | High | kernel-64kb: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705). | 7.8 | 0.0013 |  |
| [CVE-2026-45970](https://patchblox.com/security/data/cve/CVE-2026-45970.md) | High | kernel-livepatch-SLE15-SP6_Update_12: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206). | 8.8 | 0.0013 |  |
| [CVE-2026-45912](https://patchblox.com/security/data/cve/CVE-2026-45912.md) | High | ext4: don't cache extent during splitting extent | 7.1 | 0.0012 |  |
| [CVE-2026-45983](https://patchblox.com/security/data/cve/CVE-2026-45983.md) | High | kernel-64kb: nfsd: never defer requests during idmap lookup (bsc#1266697). | 7.0 | 0.0012 |  |
| [CVE-2026-46259](https://patchblox.com/security/data/cve/CVE-2026-46259.md) | High | kernel-64kb: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685). | 8.4 | 0.0012 |  |
| [CVE-2026-43278](https://patchblox.com/security/data/cve/CVE-2026-43278.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0012 |  |
| [CVE-2026-46328](https://patchblox.com/security/data/cve/CVE-2026-46328.md) | High | kernel-64kb: apparmor: fix rlimit for posix cpu timers (bsc#1268037). | 7.3 | 0.0011 |  |
| [CVE-2026-43211](https://patchblox.com/security/data/cve/CVE-2026-43211.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0011 |  |
| [CVE-2026-43214](https://patchblox.com/security/data/cve/CVE-2026-43214.md) | High | kernel-default: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651). | 7.8 | 0.0011 |  |
| [CVE-2026-43163](https://patchblox.com/security/data/cve/CVE-2026-43163.md) | High | kernel-64kb: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335). | 8.1 | 0.0009 |  |
| [CVE-2026-45872](https://patchblox.com/security/data/cve/CVE-2026-45872.md) | Routine | kernel-64kb: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735). | 5.5 | 0.0017 |  |
| [CVE-2025-71304](https://patchblox.com/security/data/cve/CVE-2025-71304.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  smack: /smack/doi: accept previously used values... | 5.5 | 0.0016 |  |
| [CVE-2026-45847](https://patchblox.com/security/data/cve/CVE-2026-45847.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0016 |  |
| [CVE-2026-45864](https://patchblox.com/security/data/cve/CVE-2026-45864.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: prevent infinite loops caused by the n... | 5.5 | 0.0016 |  |
| [CVE-2026-45870](https://patchblox.com/security/data/cve/CVE-2026-45870.md) | Routine | kernel-64kb: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704). | 5.5 | 0.0016 |  |
| [CVE-2026-45873](https://patchblox.com/security/data/cve/CVE-2026-45873.md) | Routine | kernel-64kb: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715). | 5.5 | 0.0016 |  |
| [CVE-2026-45915](https://patchblox.com/security/data/cve/CVE-2026-45915.md) | Routine | kernel-64kb: fat: avoid parent link count underflow in rmdir (bsc#1266896). | 5.5 | 0.0016 |  |
| [CVE-2026-45948](https://patchblox.com/security/data/cve/CVE-2026-45948.md) | Routine | kernel-64kb: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929). | 5.5 | 0.0016 |  |
| [CVE-2026-45964](https://patchblox.com/security/data/cve/CVE-2026-45964.md) | Routine | kernel-64kb: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698). | 5.5 | 0.0016 |  |
| [CVE-2026-43314](https://patchblox.com/security/data/cve/CVE-2026-43314.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0014 |  |
| [CVE-2025-71265](https://patchblox.com/security/data/cve/CVE-2025-71265.md) | Routine | fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata | 5.5 | 0.0013 |  |
| [CVE-2025-71266](https://patchblox.com/security/data/cve/CVE-2025-71266.md) | Routine | fs: ntfs3: check return value of indx_find to avoid infinite loop | 5.5 | 0.0013 |  |
| [CVE-2025-71267](https://patchblox.com/security/data/cve/CVE-2025-71267.md) | Routine | fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST | 5.5 | 0.0013 |  |
| [CVE-2026-43315](https://patchblox.com/security/data/cve/CVE-2026-43315.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0013 |  |
| [CVE-2026-45919](https://patchblox.com/security/data/cve/CVE-2026-45919.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-45968](https://patchblox.com/security/data/cve/CVE-2026-45968.md) | Routine | kernel-64kb: cpuidle: Skip governor when only one idle state is available (bsc#1267023). | 5.5 | 0.0013 |  |
| [CVE-2026-45982](https://patchblox.com/security/data/cve/CVE-2026-45982.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-43123](https://patchblox.com/security/data/cve/CVE-2026-43123.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-43124](https://patchblox.com/security/data/cve/CVE-2026-43124.md) | Routine | kernel-64kb: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545). | 5.5 | 0.0013 |  |
| [CVE-2026-43132](https://patchblox.com/security/data/cve/CVE-2026-43132.md) | Routine | kernel-64kb: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614). | 5.5 | 0.0013 |  |
| [CVE-2026-43143](https://patchblox.com/security/data/cve/CVE-2026-43143.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-43152](https://patchblox.com/security/data/cve/CVE-2026-43152.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0013 |  |
| [CVE-2026-43238](https://patchblox.com/security/data/cve/CVE-2026-43238.md) | Routine | kernel-64kb: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320). | 5.5 | 0.0013 |  |
| [CVE-2026-43261](https://patchblox.com/security/data/cve/CVE-2026-43261.md) | Routine | kernel-64kb: arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430). | 5.5 | 0.0013 |  |
| [CVE-2026-45974](https://patchblox.com/security/data/cve/CVE-2026-45974.md) | Routine | kernel-64kb: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922). | 5.5 | 0.0013 |  |
| [CVE-2025-71295](https://patchblox.com/security/data/cve/CVE-2025-71295.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0012 |  |
| [CVE-2026-43130](https://patchblox.com/security/data/cve/CVE-2026-43130.md) | Routine | kernel-64kb: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532). | 5.5 | 0.0012 |  |
| [CVE-2026-43171](https://patchblox.com/security/data/cve/CVE-2026-43171.md) | Routine | kernel-64kb: EFI/CPER: do not dump the entire memory region (bsc#1264549). | 5.5 | 0.0012 |  |
| [CVE-2026-43240](https://patchblox.com/security/data/cve/CVE-2026-43240.md) | Routine | kernel-64kb: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386). | 5.5 | 0.0012 |  |
| [CVE-2026-43287](https://patchblox.com/security/data/cve/CVE-2026-43287.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-43289](https://patchblox.com/security/data/cve/CVE-2026-43289.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0012 |  |
| [CVE-2026-43313](https://patchblox.com/security/data/cve/CVE-2026-43313.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-45890](https://patchblox.com/security/data/cve/CVE-2026-45890.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0012 |  |
| [CVE-2026-43266](https://patchblox.com/security/data/cve/CVE-2026-43266.md) | Routine | kernel-64kb: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418). | 5.5 | 0.0012 |  |
| [CVE-2026-43273](https://patchblox.com/security/data/cve/CVE-2026-43273.md) | Routine | cephfs: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446). | 5.5 | 0.0012 |  |
| [CVE-2026-43277](https://patchblox.com/security/data/cve/CVE-2026-43277.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0011 |  |
| [CVE-2026-45905](https://patchblox.com/security/data/cve/CVE-2026-45905.md) | Routine | kernel-64kb: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685). | 5.5 | 0.0011 |  |
| [CVE-2026-43147](https://patchblox.com/security/data/cve/CVE-2026-43147.md) | Routine | kernel-default: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). | 5.5 | 0.0010 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.