# ALAS2023-2026-1925: Security update for 19 packages

ALAS2023-2026-1925, released July 6, 2026, fixes 84 CVEs across 19 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-1925
- Platform: Linux
- Released: Jul 6, 2026
- Priority: Patch now (Closes CVE-2026-53266, exploited (CISA KEV))
- CVEs: 84, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-1925.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.18](https://patchblox.com/security/data/product/linux/bpftool6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [bpftool6.18-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel-livepatch-6.18.36-69.134](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.18.36-69.134.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.18](https://patchblox.com/security/data/product/linux/kernel6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.18-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-devel](https://patchblox.com/security/data/product/linux/kernel6.18-devel.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-headers](https://patchblox.com/security/data/product/linux/kernel6.18-headers.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.18-modules-extra-common.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools](https://patchblox.com/security/data/product/linux/kernel6.18-tools.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.18-tools-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [kernel6.18-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.18-tools-devel.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [microvm-kernel6.18](https://patchblox.com/security/data/product/linux/microvm-kernel6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [perf6.18](https://patchblox.com/security/data/product/linux/perf6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [python3-perf6.18](https://patchblox.com/security/data/product/linux/python3-perf6.18.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |
| [python3-perf6.18-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.18-debuginfo.md) | amzn 2023 | 1:6.18.36-69.134.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53266](https://patchblox.com/security/data/cve/CVE-2026-53266.md) | Patch now | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | CISA KEV |
| [CVE-2026-53224](https://patchblox.com/security/data/cve/CVE-2026-53224.md) | Urgent | kernel-default: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). | 9.1 | 0.0057 |  |
| [CVE-2026-52929](https://patchblox.com/security/data/cve/CVE-2026-52929.md) | High | sctp: stream: fully roll back denied add-stream state | 9.8 | 0.0087 |  |
| [CVE-2026-52924](https://patchblox.com/security/data/cve/CVE-2026-52924.md) | High | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 |  |
| [CVE-2026-46331](https://patchblox.com/security/data/cve/CVE-2026-46331.md) | High | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 |  |
| [CVE-2026-53221](https://patchblox.com/security/data/cve/CVE-2026-53221.md) | High | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 | 0.0058 |  |
| [CVE-2026-53228](https://patchblox.com/security/data/cve/CVE-2026-53228.md) | High | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 | 0.0058 |  |
| [CVE-2026-53225](https://patchblox.com/security/data/cve/CVE-2026-53225.md) | High | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() | 9.1 | 0.0058 |  |
| [CVE-2026-53268](https://patchblox.com/security/data/cve/CVE-2026-53268.md) | High | netfilter: conntrack_irc: fix possible out-of-bounds read | 8.2 | 0.0052 |  |
| [CVE-2026-53183](https://patchblox.com/security/data/cve/CVE-2026-53183.md) | High | mptcp: allow subflow rcv wnd to shrink | 7.5 | 0.0049 |  |
| [CVE-2026-53184](https://patchblox.com/security/data/cve/CVE-2026-53184.md) | High | udp: clear skb->dev before running a sockmap verdict | 7.5 | 0.0049 |  |
| [CVE-2026-53264](https://patchblox.com/security/data/cve/CVE-2026-53264.md) | High | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 7.8 | 0.0049 |  |
| [CVE-2026-53229](https://patchblox.com/security/data/cve/CVE-2026-53229.md) | High | kernel-64kb: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure (bsc#1269691). | 7.5 | 0.0048 |  |
| [CVE-2026-52946](https://patchblox.com/security/data/cve/CVE-2026-52946.md) | High | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling | 7.5 | 0.0047 |  |
| [CVE-2026-53246](https://patchblox.com/security/data/cve/CVE-2026-53246.md) | High | sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing | 9.8 | 0.0044 |  |
| [CVE-2026-53235](https://patchblox.com/security/data/cve/CVE-2026-53235.md) | High | kernel-uek64k-modules-usb: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0044 |  |
| [CVE-2026-53131](https://patchblox.com/security/data/cve/CVE-2026-53131.md) | High | netfilter: require Ethernet MAC header before using eth_hdr() | 9.4 | 0.0044 |  |
| [CVE-2026-53180](https://patchblox.com/security/data/cve/CVE-2026-53180.md) | High | kernel-64kb: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888). | 7.5 | 0.0034 |  |
| [CVE-2026-53175](https://patchblox.com/security/data/cve/CVE-2026-53175.md) | High | kernel-64kb: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714). | 9.8 | 0.0031 |  |
| [CVE-2026-63867](https://patchblox.com/security/data/cve/CVE-2026-63867.md) | High | kernel-uek64k: mptcp: close TOCTOU race while computing rcv_wnd (Paolo Abeni) [Orabug: 39754146] | 8.2 | 0.0027 |  |
| [CVE-2026-53275](https://patchblox.com/security/data/cve/CVE-2026-53275.md) | High | ipv6: mcast: Fix use-after-free when processing MLD queries | 8.8 | 0.0026 |  |
| [CVE-2026-53232](https://patchblox.com/security/data/cve/CVE-2026-53232.md) | High | net: phy: clean the sfp upstream if phy probing fails | 8.8 | 0.0026 |  |
| [CVE-2026-46320](https://patchblox.com/security/data/cve/CVE-2026-46320.md) | High | tap: free page on error paths in tap_get_user_xdp() | 7.4 | 0.0025 |  |
| [CVE-2026-53212](https://patchblox.com/security/data/cve/CVE-2026-53212.md) | High | netfilter: nft_tunnel: fix use-after-free on object destroy | 7.8 | 0.0019 |  |
| [CVE-2026-53191](https://patchblox.com/security/data/cve/CVE-2026-53191.md) | High | kernel-uek64k-modules-wireless: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 |  |
| [CVE-2026-53233](https://patchblox.com/security/data/cve/CVE-2026-53233.md) | High | kernel-uek64k-modules-usb: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 |  |
| [CVE-2026-53162](https://patchblox.com/security/data/cve/CVE-2026-53162.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  memcg: use round-robin victim selection in refil... | 7.8 | 0.0017 |  |
| [CVE-2026-45850](https://patchblox.com/security/data/cve/CVE-2026-45850.md) | High | ipvs: skip ipv6 extension headers for csum checks | 7.5 | 0.0016 |  |
| [CVE-2026-53187](https://patchblox.com/security/data/cve/CVE-2026-53187.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Validate cpu_id against nr_cpu_ids in... | 7.1 | 0.0016 |  |
| [CVE-2026-53270](https://patchblox.com/security/data/cve/CVE-2026-53270.md) | High | ipvs: clear the svc scheduler ptr early on edit | 9.8 | 0.0016 |  |
| [CVE-2026-53188](https://patchblox.com/security/data/cve/CVE-2026-53188.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Validate the passed in fops for ib_ge... | 8.8 | 0.0016 |  |
| [CVE-2026-52910](https://patchblox.com/security/data/cve/CVE-2026-52910.md) | High | bpf: Free reuseport cBPF prog after RCU grace period. | 7.8 | 0.0014 |  |
| [CVE-2026-53132](https://patchblox.com/security/data/cve/CVE-2026-53132.md) | High | vsock/virtio: fix potential unbounded skb queue | 7.1 | 0.0014 |  |
| [CVE-2026-53223](https://patchblox.com/security/data/cve/CVE-2026-53223.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue sk... | 8.1 | 0.0014 |  |
| [CVE-2026-53145](https://patchblox.com/security/data/cve/CVE-2026-53145.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/gem: Try to fix change_handle ioctl, attempt... | 7.8 | 0.0014 |  |
| [CVE-2026-53356](https://patchblox.com/security/data/cve/CVE-2026-53356.md) | High | drm/i915/gem: Fix phys BO pread/pwrite with offset | 7.8 | 0.0013 |  |
| [CVE-2026-52942](https://patchblox.com/security/data/cve/CVE-2026-52942.md) | High | netfilter: nf_log: validate MAC header was set before dumping it | 7.1 | 0.0013 |  |
| [CVE-2026-53189](https://patchblox.com/security/data/cve/CVE-2026-53189.md) | High | bpftool: kernel: mm/huge_memory: update file PMD counter before folio_put() | 8.8 | 0.0013 |  |
| [CVE-2026-53133](https://patchblox.com/security/data/cve/CVE-2026-53133.md) | High | RDMA/umem: Fix truncation for block sizes >= 4G | 7.8 | 0.0013 |  |
| [CVE-2026-53167](https://patchblox.com/security/data/cve/CVE-2026-53167.md) | High | fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios | 7.0 | 0.0013 |  |
| [CVE-2026-53218](https://patchblox.com/security/data/cve/CVE-2026-53218.md) | High | netfilter: nft_exthdr: fix register tracking for F_PRESENT flag | 7.0 | 0.0013 |  |
| [CVE-2026-53249](https://patchblox.com/security/data/cve/CVE-2026-53249.md) | High | ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options | 7.0 | 0.0013 |  |
| [CVE-2026-53341](https://patchblox.com/security/data/cve/CVE-2026-53341.md) | High | kernel-64k-debug-modules: kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() | 8.8 | 0.0013 |  |
| [CVE-2026-53230](https://patchblox.com/security/data/cve/CVE-2026-53230.md) | High | net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list | 8.8 | 0.0013 |  |
| [CVE-2026-53236](https://patchblox.com/security/data/cve/CVE-2026-53236.md) | High | tcp: restrict SO_ATTACH_FILTER to priv users | 8.8 | 0.0013 |  |
| [CVE-2026-53156](https://patchblox.com/security/data/cve/CVE-2026-53156.md) | High | nvmem: core: fix use-after-free bugs in error paths | 7.8 | 0.0013 |  |
| [CVE-2026-53168](https://patchblox.com/security/data/cve/CVE-2026-53168.md) | High | fuse: reject fuse_notify() pagecache ops on directories | 7.0 | 0.0013 |  |
| [CVE-2026-46054](https://patchblox.com/security/data/cve/CVE-2026-46054.md) | High | selinux: fix overlayfs mmap() and mprotect() access checks | 8.8 | 0.0012 |  |
| [CVE-2026-53267](https://patchblox.com/security/data/cve/CVE-2026-53267.md) | High | netfilter: nft_ct: bail out on template ct in get eval | 7.8 | 0.0012 |  |
| [CVE-2026-52908](https://patchblox.com/security/data/cve/CVE-2026-52908.md) | High | RDMA: During rereg_mr ensure that REREG_ACCESS is compatible | 7.8 | 0.0012 |  |
| [CVE-2026-53272](https://patchblox.com/security/data/cve/CVE-2026-53272.md) | High | kernel-64kb: erofs: fix use-after-free on sbi->sync_decompress (bsc#1269809). | 7.8 | 0.0012 |  |
| [CVE-2026-53259](https://patchblox.com/security/data/cve/CVE-2026-53259.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under... | 7.8 | 0.0012 |  |
| [CVE-2026-52909](https://patchblox.com/security/data/cve/CVE-2026-52909.md) | High | ip6_vti: set netns_immutable on the fallback device. | 7.8 | 0.0011 |  |
| [CVE-2026-53250](https://patchblox.com/security/data/cve/CVE-2026-53250.md) | High | kernel-default: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). | 7.8 | 0.0011 |  |
| [CVE-2026-53354](https://patchblox.com/security/data/cve/CVE-2026-53354.md) | High | arm64: errata: Mitigate TLBI errata on various Arm CPUs | 8.8 | 0.0010 |  |
| [CVE-2026-53239](https://patchblox.com/security/data/cve/CVE-2026-53239.md) | High | xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() | 8.8 | 0.0010 |  |
| [CVE-2026-53153](https://patchblox.com/security/data/cve/CVE-2026-53153.md) | High | kernel-rt-64k: kernel: mm/list_lru: drain before clearing xarray entry on reparent | 8.8 | 0.0010 |  |
| [CVE-2026-53265](https://patchblox.com/security/data/cve/CVE-2026-53265.md) | High | dm cache policy smq: check allocation under invalidate lock | 7.8 | 0.0010 |  |
| [CVE-2026-53334](https://patchblox.com/security/data/cve/CVE-2026-53334.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/reclaim: handle ctx allocation failure... | 5.5 | 0.0017 |  |
| [CVE-2026-53335](https://patchblox.com/security/data/cve/CVE-2026-53335.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/lru_sort: handle ctx allocation failure... | 5.5 | 0.0017 |  |
| [CVE-2026-53328](https://patchblox.com/security/data/cve/CVE-2026-53328.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Don't warn on NULL cgrp_moving_from i... | 5.5 | 0.0016 |  |
| [CVE-2026-52940](https://patchblox.com/security/data/cve/CVE-2026-52940.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  tun: zero the whole vnet header in tun_put_user(... | 5.5 | 0.0016 |  |
| [CVE-2026-53164](https://patchblox.com/security/data/cve/CVE-2026-53164.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/dma: Do not try to iommu_map a 0 length re... | 5.5 | 0.0016 |  |
| [CVE-2026-53333](https://patchblox.com/security/data/cve/CVE-2026-53333.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/mincore: handle non-swap entries before !CONF... | 5.5 | 0.0016 |  |
| [CVE-2026-53342](https://patchblox.com/security/data/cve/CVE-2026-53342.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  arm64: mm: call pagetable dtor when freeing hot-... | 5.5 | 0.0016 |  |
| [CVE-2026-53227](https://patchblox.com/security/data/cve/CVE-2026-53227.md) | Routine | net: openvswitch: fix possible kfree_skb of ERR_PTR | 5.5 | 0.0013 |  |
| [CVE-2026-53134](https://patchblox.com/security/data/cve/CVE-2026-53134.md) | Routine | kernel-64kb: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819). | 5.5 | 0.0013 |  |
| [CVE-2026-53245](https://patchblox.com/security/data/cve/CVE-2026-53245.md) | Routine | net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr | 5.5 | 0.0013 |  |
| [CVE-2026-53163](https://patchblox.com/security/data/cve/CVE-2026-53163.md) | Routine | locking/rtmutex: Skip remove_waiter() when waiter is not enqueued | 5.5 | 0.0012 |  |
| [CVE-2026-53220](https://patchblox.com/security/data/cve/CVE-2026-53220.md) | Routine | kernel-64kb: netfilter: revalidate bridge ports (bsc#1269381). | 5.5 | 0.0012 |  |
| [CVE-2026-53238](https://patchblox.com/security/data/cve/CVE-2026-53238.md) | Routine | netlabel: validate unlabeled address and mask attribute lengths | 5.5 | 0.0012 |  |
| [CVE-2026-53337](https://patchblox.com/security/data/cve/CVE-2026-53337.md) | Routine | net: bonding: fix NULL pointer dereference in bond_do_ioctl() | 5.5 | 0.0012 |  |
| [CVE-2026-53154](https://patchblox.com/security/data/cve/CVE-2026-53154.md) | Routine | mm/hugetlb: restore reservation on error in hugetlb folio copy paths | 5.5 | 0.0012 |  |
| [CVE-2026-53190](https://patchblox.com/security/data/cve/CVE-2026-53190.md) | Routine | drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() | 5.5 | 0.0012 |  |
| [CVE-2026-53214](https://patchblox.com/security/data/cve/CVE-2026-53214.md) | Routine | ipv6: Fix a potential NPD in cleanup_prefix_route() | 5.5 | 0.0012 |  |
| [CVE-2026-63868](https://patchblox.com/security/data/cve/CVE-2026-63868.md) | Routine | kernel-64kb: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497). | 5.5 | 0.0012 |  |
| [CVE-2026-53345](https://patchblox.com/security/data/cve/CVE-2026-53345.md) | Routine | KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying | 6.5 | 0.0012 |  |
| [CVE-2026-52930](https://patchblox.com/security/data/cve/CVE-2026-52930.md) | Routine | ipc/shm: serialize orphan cleanup with shm_nattch updates | 5.5 | 0.0012 |  |
| [CVE-2026-53269](https://patchblox.com/security/data/cve/CVE-2026-53269.md) | Routine | kernel-64kb: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579). | 5.5 | 0.0012 |  |
| [CVE-2026-53347](https://patchblox.com/security/data/cve/CVE-2026-53347.md) | Routine | drm/virtio: Fix driver removal with disabled KMS | 5.5 | 0.0012 |  |
| [CVE-2026-53349](https://patchblox.com/security/data/cve/CVE-2026-53349.md) | Routine | netfilter: nf_conntrack: destroy stale expectfn expectations on unregister | 5.5 | 0.0012 |  |
| [CVE-2026-53261](https://patchblox.com/security/data/cve/CVE-2026-53261.md) | Routine | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0011 |  |
| [CVE-2026-53207](https://patchblox.com/security/data/cve/CVE-2026-53207.md) | Routine | mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison | 5.5 | 0.0010 |  |
| [CVE-2026-53352](https://patchblox.com/security/data/cve/CVE-2026-53352.md) | Routine | signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() | 5.5 | 0.0010 |  |

---

Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.