Linux · 
Amazon Linux · Security advisory · July 6, 2026
Amazon Linux · Security advisory · July 6, 2026ALAS2023-2026-1924: Security update for 18 packages
ALAS2023-2026-1924, released July 6, 2026, fixes 100 CVEs across 18 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
100
None rated Critical
Exploited
1
CVE-2026-53266
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0097
62nd percentile
Priority of the 100 CVEs
Patch now 1
Urgent 0
High 78
Routine 21
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-livepatch-6.1.176-220.358 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| perf | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.176-220.358.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-53266 | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | KEVExploited |
| High | CVE-2026-63913 | kernel-64k-modules-core: kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check | 8.8 | 0.0097 | None reported |
| High | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 9.8 | 0.0087 | None reported |
| High | CVE-2026-63887 | kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_outp... | 9.8 | 0.0078 | None reported |
| High | CVE-2026-63888 | kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-... | 9.8 | 0.0078 | None reported |
| High | CVE-2026-63912 | kernel-default: xfrm: esp: restore combined single-frag length gate (bsc#1272836). | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63922 | kernel: kernel: ipv6: exthdrs: refresh nh after handling HAO option | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63924 | kernel: kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63886 | kernel-default: Security update for the Linux Kernel | 9.8 | 0.0071 | None reported |
| High | CVE-2026-46195 | smb: client: validate dacloffset before building DACL pointers | 9.8 | 0.0068 | None reported |
| High | CVE-2026-63968 | kernel-default: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466). | 7.5 | 0.0067 | None reported |
| High | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 | None reported |
| High | CVE-2026-63919 | kernel-default: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907). | 8.8 | 0.0065 | None reported |
| High | CVE-2026-53221 | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 | 0.0058 | None reported |
| High | CVE-2026-53228 | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 | 0.0058 | None reported |
| High | CVE-2026-53225 | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() | 9.1 | 0.0058 | None reported |
| High | CVE-2026-53268 | netfilter: conntrack_irc: fix possible out-of-bounds read | 8.2 | 0.0052 | None reported |
| High | CVE-2026-63984 | kernel-default: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63993 | kernel: In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after s... | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63994 | kernel-default: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-64007 | kernel-default: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63992 | kernel-default: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868). | 9.1 | 0.0051 | None reported |
| High | CVE-2026-64116 | kernel-64kb: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751). | 7.5 | 0.0051 | None reported |
| High | CVE-2026-46052 | ceph: only d_add() negative dentries when they are unhashed | 7.5 | 0.0050 | None reported |
| High | CVE-2026-53199 | hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf | 7.5 | 0.0050 | None reported |
Showing 1 to 25 of 100
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.