Linux · 
Amazon Linux · Security advisory · March 16, 2026
Amazon Linux · Security advisory · March 16, 2026ALAS2023-2026-1494: Security update for 22 packages
ALAS2023-2026-1494, released March 16, 2026, fixes 67 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
67
2 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0071
54th percentile
Priority of the 67 CVEs
Patch now 0
Urgent 2
High 32
Routine 33
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-libbpf | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-livepatch-6.1.161-183.298 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| perf | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.161-183.298.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2025-68814 | io_uring: fix filename leak in __io_openat_prep() | 9.8 | 0.0022 | None reported |
| Urgent | CVE-2025-71098 | ip6_gre: make ip6gre_header() robust | 9.8 | 0.0014 | None reported |
| High | CVE-2025-68349 | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_m... | 7.5 | 0.0071 | None reported |
| High | CVE-2025-68782 | scsi: target: Reset t_task_cdb pointer in error case | 8.6 | 0.0069 | None reported |
| High | CVE-2025-68261 | ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() | 7.5 | 0.0055 | None reported |
| High | CVE-2025-68337 | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_ac... | 7.5 | 0.0055 | None reported |
| High | CVE-2025-71120 | SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf | 7.5 | 0.0053 | None reported |
| High | CVE-2025-71116 | libceph: make decode_pool() more resilient against corrupted osdmaps | 8.1 | 0.0046 | None reported |
| High | CVE-2025-68803 | NFSD: NFSv4 file creation neglects setting ACL | 8.0 | 0.0045 | None reported |
| High | CVE-2026-22984 | kernel-64kb: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217). | 8.8 | 0.0041 | None reported |
| High | CVE-2026-22990 | kernel: In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_app... | 8.8 | 0.0040 | None reported |
| High | CVE-2025-71085 | kernel-64kb: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623). | 7.8 | 0.0031 | None reported |
| High | CVE-2025-71093 | e1000: fix OOB in e1000_tbi_should_accept() | 7.1 | 0.0029 | None reported |
| High | CVE-2025-38129 | page_pool: Fix use-after-free in page_pool_recycle_in_ring | 7.8 | 0.0020 | None reported |
| High | CVE-2025-68366 | kernel-64kb: nbd: defer config unlock in nbd_genl_connect (bsc#1255622). | 8.8 | 0.0020 | None reported |
| High | CVE-2025-68371 | kernel-64kb: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572). | 7.0 | 0.0020 | None reported |
| High | CVE-2025-68325 | kernel-64kb: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417). | n/a | 0.0020 | None reported |
| High | CVE-2026-22977 | kernel-64kb: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053). | 9.8 | 0.0019 | None reported |
| High | CVE-2025-68727 | kernel-64kb: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568). | n/a | 0.0019 | None reported |
| High | CVE-2025-68728 | kernel-64kb: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539). | n/a | 0.0019 | None reported |
| High | CVE-2025-40149 | tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). | 8.8 | 0.0017 | None reported |
| High | CVE-2025-68795 | linux: In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on s... | 7.8 | 0.0017 | None reported |
| High | CVE-2025-71123 | kernel-64kb: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757). | 7.8 | 0.0017 | None reported |
| High | CVE-2025-68764 | NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags | 7.8 | 0.0017 | None reported |
| High | CVE-2025-68785 | net: openvswitch: fix middle attribute validation in push_nsh() action | 7.1 | 0.0016 | None reported |
Showing 1 to 25 of 67
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.