# ALAS2023-2026-1681: Security update for 22 packages

ALAS2023-2026-1681, released May 11, 2026, fixes 174 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1681
- Platform: Linux
- Released: May 11, 2026
- Priority: Urgent (Closes CVE-2025-68206, rated Critical)
- CVEs: 174, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1681.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-livepatch-6.1.168-202.320](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.168-202.320.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |
| [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.168-202.320.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-68206](https://patchblox.com/security/data/cve/CVE-2025-68206.md) | Urgent | netfilter: nft_ct: add seqadj extension for natted connections | 9.1 | 0.0071 |  |
| [CVE-2026-45899](https://patchblox.com/security/data/cve/CVE-2026-45899.md) | Urgent | ext4: drop extent cache when splitting extent fails | 9.8 | 0.0016 |  |
| [CVE-2026-23455](https://patchblox.com/security/data/cve/CVE-2026-23455.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero leng... | 9.1 | 0.0159 |  |
| [CVE-2026-31402](https://patchblox.com/security/data/cve/CVE-2026-31402.md) | High | kernel-64kb: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638). | 9.8 | 0.0122 |  |
| [CVE-2025-40135](https://patchblox.com/security/data/cve/CVE-2025-40135.md) | High | ipv6: use RCU in ip6_xmit() | 8.4 | 0.0071 |  |
| [CVE-2026-43037](https://patchblox.com/security/data/cve/CVE-2026-43037.md) | High | ip6_tunnel: clear skb2->cb[] in ip4ip6_err() | 9.8 | 0.0069 |  |
| [CVE-2026-43407](https://patchblox.com/security/data/cve/CVE-2026-43407.md) | High | kernel-64kb: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020). | 9.1 | 0.0066 |  |
| [CVE-2026-31682](https://patchblox.com/security/data/cve/CVE-2026-31682.md) | High | bridge: br_nd_send: linearize skb before parsing ND options | 9.1 | 0.0064 |  |
| [CVE-2026-43406](https://patchblox.com/security/data/cve/CVE-2026-43406.md) | High | kernel-64kb: libceph: prevent potential out-of-bounds reads in process_message_header() (bsc#1265073). | 9.1 | 0.0061 |  |
| [CVE-2026-43405](https://patchblox.com/security/data/cve/CVE-2026-43405.md) | High | kernel-64kb: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741). | 7.5 | 0.0060 |  |
| [CVE-2026-43441](https://patchblox.com/security/data/cve/CVE-2026-43441.md) | High | kernel-64kb: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674). | 7.5 | 0.0059 |  |
| [CVE-2026-31414](https://patchblox.com/security/data/cve/CVE-2026-31414.md) | High | netfilter: nf_conntrack_expect: use expect->helper | 9.8 | 0.0058 |  |
| [CVE-2026-23456](https://patchblox.com/security/data/cve/CVE-2026-23456.md) | High | kernel-64kb: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703). | 8.2 | 0.0054 |  |
| [CVE-2026-43383](https://patchblox.com/security/data/cve/CVE-2026-43383.md) | High | kernel-64kb: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744). | 9.4 | 0.0054 |  |
| [CVE-2026-43452](https://patchblox.com/security/data/cve/CVE-2026-43452.md) | High | kernel-64kb: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142). | 8.2 | 0.0054 |  |
| [CVE-2026-43341](https://patchblox.com/security/data/cve/CVE-2026-43341.md) | High | kernel-64kb: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044). | 9.8 | 0.0051 |  |
| [CVE-2026-43365](https://patchblox.com/security/data/cve/CVE-2026-43365.md) | High | kernel-64kb: xfs: fix undersized l_iclog_roundoff values (bsc#1265119). | 8.2 | 0.0051 |  |
| [CVE-2026-31448](https://patchblox.com/security/data/cve/CVE-2026-31448.md) | High | ext4: avoid infinite loops caused by residual data | 9.4 | 0.0050 |  |
| [CVE-2026-23457](https://patchblox.com/security/data/cve/CVE-2026-23457.md) | High | kernel-64kb: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686). | 8.6 | 0.0045 |  |
| [CVE-2026-43057](https://patchblox.com/security/data/cve/CVE-2026-43057.md) | High | kernel-64kb: net: mpls: error out if inner headers are not set (bsc#1264056). | 7.5 | 0.0044 |  |
| [CVE-2026-31450](https://patchblox.com/security/data/cve/CVE-2026-31450.md) | High | ext4: publish jinode after initialization | 8.8 | 0.0041 |  |
| [CVE-2026-43466](https://patchblox.com/security/data/cve/CVE-2026-43466.md) | High | kernel-64kb: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790). | 8.2 | 0.0041 |  |
| [CVE-2026-31467](https://patchblox.com/security/data/cve/CVE-2026-31467.md) | High | erofs: add GFP_NOIO in the bio completion if needed | 8.8 | 0.0038 |  |
| [CVE-2026-31570](https://patchblox.com/security/data/cve/CVE-2026-31570.md) | High | can: gw: fix OOB heap access in cgw_csum_crc8_rel() | 8.8 | 0.0026 |  |
| [CVE-2026-43038](https://patchblox.com/security/data/cve/CVE-2026-43038.md) | High | kpatch-patch-4_18_0-553_125_1: kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() | 9.8 | 0.0026 |  |
| [CVE-2025-38192](https://patchblox.com/security/data/cve/CVE-2025-38192.md) | High | net: clear the dst when changing skb protocol | 7.0 | 0.0021 |  |
| [CVE-2025-71067](https://patchblox.com/security/data/cve/CVE-2025-71067.md) | High | ntfs: set dummy blocksize to read boot_block when mounting | 7.1 | 0.0020 |  |
| [CVE-2026-31788](https://patchblox.com/security/data/cve/CVE-2026-31788.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707). | 8.2 | 0.0020 |  |
| [CVE-2026-23401](https://patchblox.com/security/data/cve/CVE-2026-23401.md) | High | KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE | 8.8 | 0.0019 |  |
| [CVE-2025-38704](https://patchblox.com/security/data/cve/CVE-2025-38704.md) | High | rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access | 7.8 | 0.0019 |  |
| [CVE-2026-23274](https://patchblox.com/security/data/cve/CVE-2026-23274.md) | High | netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels | 7.8 | 0.0018 |  |
| [CVE-2026-43329](https://patchblox.com/security/data/cve/CVE-2026-43329.md) | High | kernel-64kb: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085). | 7.8 | 0.0018 |  |
| [CVE-2026-23392](https://patchblox.com/security/data/cve/CVE-2026-23392.md) | High | netfilter: nf_tables: release flowtable after rcu grace period on error | 8.8 | 0.0017 |  |
| [CVE-2026-31674](https://patchblox.com/security/data/cve/CVE-2026-31674.md) | High | netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() | 7.1 | 0.0017 |  |
| [CVE-2026-31680](https://patchblox.com/security/data/cve/CVE-2026-31680.md) | High | net: ipv6: flowlabel: defer exclusive option free until RCU teardown | 7.8 | 0.0016 |  |
| [CVE-2026-31679](https://patchblox.com/security/data/cve/CVE-2026-31679.md) | High | openvswitch: validate MPLS set/set_masked payload length | 7.1 | 0.0016 |  |
| [CVE-2026-45892](https://patchblox.com/security/data/cve/CVE-2026-45892.md) | High | ext4: drop extent cache after doing PARTIAL_VALID1 zeroout | 7.0 | 0.0016 |  |
| [CVE-2026-43339](https://patchblox.com/security/data/cve/CVE-2026-43339.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_... | 8.1 | 0.0016 |  |
| [CVE-2025-68265](https://patchblox.com/security/data/cve/CVE-2025-68265.md) | High | nvme: fix admin request_queue lifetime | 7.8 | 0.0016 |  |
| [CVE-2026-23204](https://patchblox.com/security/data/cve/CVE-2026-23204.md) | High | kernel-64kb: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340). | 8.1 | 0.0016 |  |
| [CVE-2026-31426](https://patchblox.com/security/data/cve/CVE-2026-31426.md) | High | ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() | 7.0 | 0.0015 |  |
| [CVE-2026-45920](https://patchblox.com/security/data/cve/CVE-2026-45920.md) | High | kernel-64kb: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893). | 7.8 | 0.0015 |  |
| [CVE-2026-23343](https://patchblox.com/security/data/cve/CVE-2026-23343.md) | High | xdp: produce a warning when calculated tailroom is negative | 7.8 | 0.0014 |  |
| [CVE-2026-23359](https://patchblox.com/security/data/cve/CVE-2026-23359.md) | High | bpf: Fix stack-out-of-bounds write in devmap | 7.8 | 0.0014 |  |
| [CVE-2026-31447](https://patchblox.com/security/data/cve/CVE-2026-31447.md) | High | ext4: reject mount if bigalloc with s_first_data_block != 0 | 7.8 | 0.0014 |  |
| [CVE-2026-23317](https://patchblox.com/security/data/cve/CVE-2026-23317.md) | High | drm/vmwgfx: Return the correct value in vmw_translate_ptr functions | 7.8 | 0.0014 |  |
| [CVE-2026-23319](https://patchblox.com/security/data/cve/CVE-2026-23319.md) | High | bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim | 7.8 | 0.0014 |  |
| [CVE-2026-31446](https://patchblox.com/security/data/cve/CVE-2026-31446.md) | High | ext4: fix use-after-free in update_super_work when racing with umount | 7.8 | 0.0014 |  |
| [CVE-2026-23270](https://patchblox.com/security/data/cve/CVE-2026-23270.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_11: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886). | 8.1 | 0.0014 |  |
| [CVE-2026-23351](https://patchblox.com/security/data/cve/CVE-2026-23351.md) | High | netfilter: nft_set_pipapo: split gc into unlink and reclaim phase | 7.8 | 0.0014 |  |
| [CVE-2026-23449](https://patchblox.com/security/data/cve/CVE-2026-23449.md) | High | kernel-default: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779). | 7.8 | 0.0014 |  |
| [CVE-2026-23458](https://patchblox.com/security/data/cve/CVE-2026-23458.md) | High | kernel-64kb: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781). | 7.8 | 0.0014 |  |
| [CVE-2026-23293](https://patchblox.com/security/data/cve/CVE-2026-23293.md) | High | net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled | 7.5 | 0.0014 |  |
| [CVE-2026-23300](https://patchblox.com/security/data/cve/CVE-2026-23300.md) | High | net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop | 7.5 | 0.0014 |  |
| [CVE-2026-23352](https://patchblox.com/security/data/cve/CVE-2026-23352.md) | High | x86/efi: defer freeing of boot services memory | 7.1 | 0.0014 |  |
| [CVE-2026-31452](https://patchblox.com/security/data/cve/CVE-2026-31452.md) | High | ext4: convert inline data to extents when truncate exceeds inline size | 7.8 | 0.0014 |  |
| [CVE-2026-31469](https://patchblox.com/security/data/cve/CVE-2026-31469.md) | High | virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false | 7.8 | 0.0014 |  |
| [CVE-2026-43030](https://patchblox.com/security/data/cve/CVE-2026-43030.md) | High | kernel-64kb: bpf: Fix regsafe() for pointers to packet (bsc#1264000). | 7.8 | 0.0014 |  |
| [CVE-2026-23391](https://patchblox.com/security/data/cve/CVE-2026-23391.md) | High | netfilter: xt_CT: drop pending enqueued packets on template removal | 7.8 | 0.0013 |  |
| [CVE-2026-31678](https://patchblox.com/security/data/cve/CVE-2026-31678.md) | High | openvswitch: defer tunnel netdev_put to RCU release | 8.8 | 0.0013 |  |
| [CVE-2026-43450](https://patchblox.com/security/data/cve/CVE-2026-43450.md) | High | kernel-rt-64k-modules-core: kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() | 8.8 | 0.0013 |  |
| [CVE-2026-43028](https://patchblox.com/security/data/cve/CVE-2026-43028.md) | High | kernel-64kb: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934). | 7.1 | 0.0013 |  |
| [CVE-2026-43427](https://patchblox.com/security/data/cve/CVE-2026-43427.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0013 |  |
| [CVE-2026-31403](https://patchblox.com/security/data/cve/CVE-2026-31403.md) | High | kernel-64kb: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796). | 7.8 | 0.0013 |  |
| [CVE-2026-43027](https://patchblox.com/security/data/cve/CVE-2026-43027.md) | High | kernel-default: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933). | 7.8 | 0.0013 |  |
| [CVE-2026-31453](https://patchblox.com/security/data/cve/CVE-2026-31453.md) | High | xfs: avoid dereferencing log items after push callbacks | 7.8 | 0.0013 |  |
| [CVE-2026-23296](https://patchblox.com/security/data/cve/CVE-2026-23296.md) | High | scsi: core: Fix refcount leak for tagset_refcnt | 7.1 | 0.0013 |  |
| [CVE-2026-31759](https://patchblox.com/security/data/cve/CVE-2026-31759.md) | High | kernel-default: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076). | 7.8 | 0.0013 |  |
| [CVE-2026-43328](https://patchblox.com/security/data/cve/CVE-2026-43328.md) | High | kernel-64kb: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832). | 7.8 | 0.0013 |  |
| [CVE-2026-31518](https://patchblox.com/security/data/cve/CVE-2026-31518.md) | High | esp: fix skb leak with espintcp and async crypto | 7.1 | 0.0013 |  |
| [CVE-2026-43040](https://patchblox.com/security/data/cve/CVE-2026-43040.md) | High | kernel-64kb: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info- | 7.1 | 0.0013 |  |
| [CVE-2026-31515](https://patchblox.com/security/data/cve/CVE-2026-31515.md) | High | af_key: validate families in pfkey_send_migrate() | 7.0 | 0.0013 |  |
| [CVE-2026-31521](https://patchblox.com/security/data/cve/CVE-2026-31521.md) | High | module: Fix kernel panic when a symbol st_shndx is out of bounds | 7.0 | 0.0013 |  |
| [CVE-2026-31555](https://patchblox.com/security/data/cve/CVE-2026-31555.md) | High | futex: Clear stale exiting pointer in futex_lock_pi() retry path | 7.0 | 0.0013 |  |
| [CVE-2026-43025](https://patchblox.com/security/data/cve/CVE-2026-43025.md) | High | kernel-default: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931). | 7.3 | 0.0013 |  |
| [CVE-2026-43366](https://patchblox.com/security/data/cve/CVE-2026-43366.md) | High | kernel-docs: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116). | 7.8 | 0.0013 |  |
| [CVE-2026-23388](https://patchblox.com/security/data/cve/CVE-2026-23388.md) | High | Squashfs: check metadata block offset is within range | 7.1 | 0.0013 |  |
| [CVE-2026-23397](https://patchblox.com/security/data/cve/CVE-2026-23397.md) | High | nfnetlink_osf: validate individual option lengths in fingerprints | 7.1 | 0.0013 |  |
| [CVE-2026-31454](https://patchblox.com/security/data/cve/CVE-2026-31454.md) | High | xfs: save ailp before dropping the AIL lock in push callbacks | 7.8 | 0.0013 |  |
| [CVE-2026-31455](https://patchblox.com/security/data/cve/CVE-2026-31455.md) | High | xfs: stop reclaim before pushing AIL during unmount | 7.8 | 0.0013 |  |
| [CVE-2026-31695](https://patchblox.com/security/data/cve/CVE-2026-31695.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: virt_wifi: remove SET_NETDEV_DEV to avoid... | 7.8 | 0.0013 |  |
| [CVE-2026-43449](https://patchblox.com/security/data/cve/CVE-2026-43449.md) | High | kernel-64kb: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023). | 7.1 | 0.0013 |  |
| [CVE-2026-43453](https://patchblox.com/security/data/cve/CVE-2026-43453.md) | High | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0013 |  |
| [CVE-2026-31416](https://patchblox.com/security/data/cve/CVE-2026-31416.md) | High | netfilter: nfnetlink_log: account for netlink header size | 8.1 | 0.0013 |  |
| [CVE-2026-31418](https://patchblox.com/security/data/cve/CVE-2026-31418.md) | High | netfilter: ipset: drop logically empty buckets in mtype_del | 8.1 | 0.0013 |  |
| [CVE-2026-31427](https://patchblox.com/security/data/cve/CVE-2026-31427.md) | High | netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp | 7.8 | 0.0013 |  |
| [CVE-2026-31503](https://patchblox.com/security/data/cve/CVE-2026-31503.md) | High | udp: Fix wildcard bind conflict check when using hash2 | 7.8 | 0.0013 |  |
| [CVE-2026-31492](https://patchblox.com/security/data/cve/CVE-2026-31492.md) | High | RDMA/irdma: Initialize free_qp completion before using it | 7.1 | 0.0012 |  |
| [CVE-2026-31519](https://patchblox.com/security/data/cve/CVE-2026-31519.md) | High | btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create | 7.1 | 0.0012 |  |
| [CVE-2026-31399](https://patchblox.com/security/data/cve/CVE-2026-31399.md) | High | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0012 |  |
| [CVE-2026-31392](https://patchblox.com/security/data/cve/CVE-2026-31392.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.1 | 0.0012 |  |
| [CVE-2026-43047](https://patchblox.com/security/data/cve/CVE-2026-43047.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0012 |  |
| [CVE-2026-43060](https://patchblox.com/security/data/cve/CVE-2026-43060.md) | High | kernel-64kb: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183). | 7.8 | 0.0012 |  |
| [CVE-2026-23340](https://patchblox.com/security/data/cve/CVE-2026-23340.md) | High | net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs | 7.8 | 0.0012 |  |
| [CVE-2026-43281](https://patchblox.com/security/data/cve/CVE-2026-43281.md) | High | kernel-64kb: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534). | 7.1 | 0.0012 |  |
| [CVE-2026-23271](https://patchblox.com/security/data/cve/CVE-2026-23271.md) | High | perf: Fix __perf_event_overflow() vs perf_remove_from_context() race | 7.8 | 0.0011 |  |
| [CVE-2026-31508](https://patchblox.com/security/data/cve/CVE-2026-31508.md) | High | net: openvswitch: Avoid releasing netdev before teardown completes | 8.8 | 0.0011 |  |
| [CVE-2026-31504](https://patchblox.com/security/data/cve/CVE-2026-31504.md) | High | net: fix fanout UAF in packet_release() via NETDEV_UP race | 7.8 | 0.0011 |  |
| [CVE-2026-31473](https://patchblox.com/security/data/cve/CVE-2026-31473.md) | High | media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex | 7.8 | 0.0010 |  |
| [CVE-2026-31523](https://patchblox.com/security/data/cve/CVE-2026-31523.md) | High | nvme-pci: ensure we're polling a polled queue | 7.1 | 0.0009 |  |
| [CVE-2025-71161](https://patchblox.com/security/data/cve/CVE-2025-71161.md) | Routine | dm-verity: disable recursive forward error correction | 5.5 | 0.0047 |  |
| [CVE-2026-23414](https://patchblox.com/security/data/cve/CVE-2026-23414.md) | Routine | tls: Purge async_hold in tls_decrypt_async_wait() | 5.5 | 0.0037 |  |
| [CVE-2025-71269](https://patchblox.com/security/data/cve/CVE-2025-71269.md) | Routine | btrfs: do not free data reservation in fallback from inline due to -ENOSPC | 5.5 | 0.0023 |  |
| [CVE-2025-68239](https://patchblox.com/security/data/cve/CVE-2025-68239.md) | Routine | binfmt_misc: restore write access before closing files opened by open_exec() | 6.2 | 0.0020 |  |
| [CVE-2026-23154](https://patchblox.com/security/data/cve/CVE-2026-23154.md) | Routine | kernel-64kb: net: fix segmentation of forwarding fraglist GRO (bsc#1258286). | 5.5 | 0.0018 |  |
| [CVE-2025-39748](https://patchblox.com/security/data/cve/CVE-2025-39748.md) | Routine | bpf: Forget ranges when refining tnum after JSET | 5.5 | 0.0018 |  |
| [CVE-2025-39764](https://patchblox.com/security/data/cve/CVE-2025-39764.md) | Routine | netfilter: ctnetlink: remove refcounting in expectation dumpers | 5.5 | 0.0018 |  |
| [CVE-2026-43360](https://patchblox.com/security/data/cve/CVE-2026-43360.md) | Routine | kernel-64kb: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720). | 5.5 | 0.0016 |  |
| [CVE-2026-45858](https://patchblox.com/security/data/cve/CVE-2026-45858.md) | Routine | ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 | 5.5 | 0.0016 |  |
| [CVE-2026-23113](https://patchblox.com/security/data/cve/CVE-2026-23113.md) | Routine | kernel-64kb: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278). | 5.5 | 0.0015 |  |
| [CVE-2026-23100](https://patchblox.com/security/data/cve/CVE-2026-23100.md) | Routine | kernel-uek: ELSA-2026-50232: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0015 |  |
| [CVE-2026-23141](https://patchblox.com/security/data/cve/CVE-2026-23141.md) | Routine | kernel-64kb: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377). | 5.5 | 0.0015 |  |
| [CVE-2026-23356](https://patchblox.com/security/data/cve/CVE-2026-23356.md) | Routine | drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() | 6.3 | 0.0014 |  |
| [CVE-2026-23157](https://patchblox.com/security/data/cve/CVE-2026-23157.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0014 |  |
| [CVE-2026-23304](https://patchblox.com/security/data/cve/CVE-2026-23304.md) | Routine | ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() | 5.5 | 0.0014 |  |
| [CVE-2026-23321](https://patchblox.com/security/data/cve/CVE-2026-23321.md) | Routine | kernel-64kb: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505). | 5.5 | 0.0014 |  |
| [CVE-2026-31428](https://patchblox.com/security/data/cve/CVE-2026-31428.md) | Routine | netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD | 5.5 | 0.0014 |  |
| [CVE-2026-23439](https://patchblox.com/security/data/cve/CVE-2026-23439.md) | Routine | udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n | 5.5 | 0.0013 |  |
| [CVE-2026-23303](https://patchblox.com/security/data/cve/CVE-2026-23303.md) | Routine | smb: client: Don't log plaintext credentials in cifs_set_cifscreds | 5.5 | 0.0013 |  |
| [CVE-2026-23292](https://patchblox.com/security/data/cve/CVE-2026-23292.md) | Routine | scsi: target: Fix recursive locking in __configfs_open_file() | 5.5 | 0.0013 |  |
| [CVE-2026-23398](https://patchblox.com/security/data/cve/CVE-2026-23398.md) | Routine | icmp: fix NULL pointer dereference in icmp_tag_validation() | 6.5 | 0.0013 |  |
| [CVE-2026-43026](https://patchblox.com/security/data/cve/CVE-2026-43026.md) | Routine | kernel-64kb: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932). | 6.1 | 0.0013 |  |
| [CVE-2026-31495](https://patchblox.com/security/data/cve/CVE-2026-31495.md) | Routine | netfilter: ctnetlink: use netlink policy range checks | 5.5 | 0.0013 |  |
| [CVE-2026-31546](https://patchblox.com/security/data/cve/CVE-2026-31546.md) | Routine | net: bonding: fix NULL deref in bond_debug_rlb_hash_show | 5.5 | 0.0013 |  |
| [CVE-2026-31752](https://patchblox.com/security/data/cve/CVE-2026-31752.md) | Routine | kernel-64kb: bridge: br_nd_send: validate ND option lengths (bsc#1264045). | 5.5 | 0.0013 |  |
| [CVE-2026-43024](https://patchblox.com/security/data/cve/CVE-2026-43024.md) | Routine | kernel-64kb: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930). | 5.5 | 0.0013 |  |
| [CVE-2026-43035](https://patchblox.com/security/data/cve/CVE-2026-43035.md) | Routine | kernel-64kb: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996). | 5.5 | 0.0013 |  |
| [CVE-2026-23277](https://patchblox.com/security/data/cve/CVE-2026-23277.md) | Routine | net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit | 5.9 | 0.0013 |  |
| [CVE-2026-23381](https://patchblox.com/security/data/cve/CVE-2026-23381.md) | Routine | net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled | 5.5 | 0.0013 |  |
| [CVE-2026-31422](https://patchblox.com/security/data/cve/CVE-2026-31422.md) | Routine | net/sched: cls_flow: fix NULL pointer dereference on shared blocks | 5.5 | 0.0013 |  |
| [CVE-2026-31424](https://patchblox.com/security/data/cve/CVE-2026-31424.md) | Routine | netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP | 5.5 | 0.0013 |  |
| [CVE-2026-31421](https://patchblox.com/security/data/cve/CVE-2026-31421.md) | Routine | net/sched: cls_fw: fix NULL pointer dereference on shared blocks | 5.5 | 0.0013 |  |
| [CVE-2026-31423](https://patchblox.com/security/data/cve/CVE-2026-31423.md) | Routine | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 5.5 | 0.0013 |  |
| [CVE-2026-31496](https://patchblox.com/security/data/cve/CVE-2026-31496.md) | Routine | netfilter: nf_conntrack_expect: skip expectations in other netns via proc | 5.5 | 0.0013 |  |
| [CVE-2026-23443](https://patchblox.com/security/data/cve/CVE-2026-23443.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-31434](https://patchblox.com/security/data/cve/CVE-2026-31434.md) | Routine | kernel-uek: ELSA-2026-50372: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0012 |  |
| [CVE-2026-31524](https://patchblox.com/security/data/cve/CVE-2026-31524.md) | Routine | HID: asus: avoid memory leak in asus_report_fixup() | 5.5 | 0.0012 |  |
| [CVE-2026-31540](https://patchblox.com/security/data/cve/CVE-2026-31540.md) | Routine | drm/i915/gt: Check set_default_submission() before deferencing | 5.5 | 0.0012 |  |
| [CVE-2026-31738](https://patchblox.com/security/data/cve/CVE-2026-31738.md) | Routine | kernel-source: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059). | 5.5 | 0.0012 |  |
| [CVE-2026-31781](https://patchblox.com/security/data/cve/CVE-2026-31781.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-43013](https://patchblox.com/security/data/cve/CVE-2026-43013.md) | Routine | kernel-64kb: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011). | 5.5 | 0.0012 |  |
| [CVE-2026-43333](https://patchblox.com/security/data/cve/CVE-2026-43333.md) | Routine | kernel-64kb: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726). | 5.5 | 0.0012 |  |
| [CVE-2026-43359](https://patchblox.com/security/data/cve/CVE-2026-43359.md) | Routine | kernel-64kb: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719). | 5.5 | 0.0012 |  |
| [CVE-2026-43361](https://patchblox.com/security/data/cve/CVE-2026-43361.md) | Routine | kernel-64kb: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722). | 5.5 | 0.0012 |  |
| [CVE-2026-43363](https://patchblox.com/security/data/cve/CVE-2026-43363.md) | Routine | kernel-64kb: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068). | 5.5 | 0.0012 |  |
| [CVE-2026-43411](https://patchblox.com/security/data/cve/CVE-2026-43411.md) | Routine | kernel-64kb: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672). | 5.5 | 0.0012 |  |
| [CVE-2026-43428](https://patchblox.com/security/data/cve/CVE-2026-43428.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-43432](https://patchblox.com/security/data/cve/CVE-2026-43432.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0012 |  |
| [CVE-2026-43445](https://patchblox.com/security/data/cve/CVE-2026-43445.md) | Routine | kernel-64kb: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041). | 5.5 | 0.0012 |  |
| [CVE-2026-43451](https://patchblox.com/security/data/cve/CVE-2026-43451.md) | Routine | kernel-64kb: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009). | 5.5 | 0.0012 |  |
| [CVE-2026-31458](https://patchblox.com/security/data/cve/CVE-2026-31458.md) | Routine | mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] | 5.5 | 0.0012 |  |
| [CVE-2026-31400](https://patchblox.com/security/data/cve/CVE-2026-31400.md) | Routine | kernel-64kb: sunrpc: fix cache_request leak in cache_release (bsc#1261645). | 5.5 | 0.0012 |  |
| [CVE-2026-43265](https://patchblox.com/security/data/cve/CVE-2026-43265.md) | Routine | kernel-64kb: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427). | 5.5 | 0.0012 |  |
| [CVE-2026-31415](https://patchblox.com/security/data/cve/CVE-2026-31415.md) | Routine | kernel-64kb: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099). | 5.5 | 0.0012 |  |
| [CVE-2026-43065](https://patchblox.com/security/data/cve/CVE-2026-43065.md) | Routine | kernel-64kb: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243). | 5.5 | 0.0012 |  |
| [CVE-2026-43066](https://patchblox.com/security/data/cve/CVE-2026-43066.md) | Routine | kernel-64kb: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245). | 5.5 | 0.0012 |  |
| [CVE-2026-43068](https://patchblox.com/security/data/cve/CVE-2026-43068.md) | Routine | kernel-64kb: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255). | 5.5 | 0.0012 |  |
| [CVE-2026-43043](https://patchblox.com/security/data/cve/CVE-2026-43043.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0011 |  |
| [CVE-2026-43046](https://patchblox.com/security/data/cve/CVE-2026-43046.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0011 |  |
| [CVE-2026-43054](https://patchblox.com/security/data/cve/CVE-2026-43054.md) | Routine | kernel-64kb: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063). | 5.5 | 0.0011 |  |
| [CVE-2026-43472](https://patchblox.com/security/data/cve/CVE-2026-43472.md) | Routine | kernel-64kb: unshare: fix unshare_fs() handling (bsc#1264748). | 5.5 | 0.0011 |  |
| [CVE-2026-43475](https://patchblox.com/security/data/cve/CVE-2026-43475.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0011 |  |
| [CVE-2026-43483](https://patchblox.com/security/data/cve/CVE-2026-43483.md) | Routine | kernel-64kb: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (bsc#1265240). | 5.5 | 0.0011 |  |
| [CVE-2026-23368](https://patchblox.com/security/data/cve/CVE-2026-23368.md) | Routine | kernel-source: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530). | 5.5 | 0.0011 |  |
| [CVE-2026-23362](https://patchblox.com/security/data/cve/CVE-2026-23362.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0010 |  |
| [CVE-2026-23452](https://patchblox.com/security/data/cve/CVE-2026-23452.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0010 |  |
| [CVE-2026-31480](https://patchblox.com/security/data/cve/CVE-2026-31480.md) | Routine | tracing: Fix potential deadlock in cpu hotplug with osnoise | 5.5 | 0.0010 |  |
| [CVE-2026-43252](https://patchblox.com/security/data/cve/CVE-2026-43252.md) | Routine | kernel-64kb: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300). | 5.5 | 0.0010 |  |
| [CVE-2026-31466](https://patchblox.com/security/data/cve/CVE-2026-31466.md) | Routine | kernel-64kb: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825). | 5.5 | 0.0009 |  |
| [CVE-2026-43420](https://patchblox.com/security/data/cve/CVE-2026-43420.md) | Routine | cephfs: ceph: fix i_nlink underrun during async unlink (bsc#1264814). | 5.5 | 0.0009 |  |
| [CVE-2026-43061](https://patchblox.com/security/data/cve/CVE-2026-43061.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0009 |  |
| [CVE-2026-43468](https://patchblox.com/security/data/cve/CVE-2026-43468.md) | Routine | kernel-64kb: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978). | 5.5 | 0.0009 |  |
| [CVE-2026-43439](https://patchblox.com/security/data/cve/CVE-2026-43439.md) | Routine | kernel-64kb: cgroup: fix race between task migration and iteration (bsc#1265141). | 4.7 | 0.0009 |  |
| [CVE-2026-43448](https://patchblox.com/security/data/cve/CVE-2026-43448.md) | Routine | kernel-64kb: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807). | 4.7 | 0.0009 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.