Linux · 
Amazon Linux · Security advisory · July 20, 2026
Amazon Linux · Security advisory · July 20, 2026ALAS2023-2026-1968: Security update for 18 packages
ALAS2023-2026-1968, released July 20, 2026, fixes 125 CVEs across 18 products. One of them is being exploited (CVE-2026-53266); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
125
1 rated Critical
Exploited
1
CVE-2026-53266
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0458
91st percentile
Priority of the 125 CVEs
Patch now 1
Urgent 1
High 95
Routine 28
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool6.12 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| bpftool6.12-debuginfo | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel-livepatch-6.12.94-123.174 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel6.12 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-debuginfo | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-debuginfo-common-aarch64 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-debuginfo-common-x86_64 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-devel | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-headers | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-modules-extra | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-modules-extra-common | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-tools | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-tools-debuginfo | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| kernel6.12-tools-devel | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| perf6.12 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| perf6.12-debuginfo | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| python3-perf6.12 | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
| python3-perf6.12-debuginfo | amzn 2023 | 1:6.12.94-123.174.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-53266 | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | 0.0093 | KEVExploited |
| Urgent | CVE-2026-63983 | net/sched: fix packet loop on netem when duplicate is on | 9.8 | 0.0017 | None reported |
| High | CVE-2026-46242 | kernel-default: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618). | 7.8 | 0.0458 | None reported |
| High | CVE-2026-63913 | kernel-64k-modules-core: kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check | 8.8 | 0.0097 | None reported |
| High | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 9.8 | 0.0087 | None reported |
| High | CVE-2026-63887 | kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_outp... | 9.8 | 0.0078 | None reported |
| High | CVE-2026-63888 | kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-... | 9.8 | 0.0078 | None reported |
| High | CVE-2026-63912 | kernel-default: xfrm: esp: restore combined single-frag length gate (bsc#1272836). | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63922 | kernel: kernel: ipv6: exthdrs: refresh nh after handling HAO option | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63924 | kernel: kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63886 | kernel-default: Security update for the Linux Kernel | 9.8 | 0.0071 | None reported |
| High | CVE-2026-63968 | kernel-default: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466). | 7.5 | 0.0067 | None reported |
| High | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 9.8 | 0.0066 | None reported |
| High | CVE-2026-63919 | kernel-default: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907). | 8.8 | 0.0065 | None reported |
| High | CVE-2026-46331 | net/sched: fix pedit partial COW leading to page cache corruption | 8.1 | 0.0064 | None reported |
| High | CVE-2026-53221 | ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() | 9.8 | 0.0058 | None reported |
| High | CVE-2026-53228 | ipv6: sit: reload inner IPv6 header after GSO offloads | 9.8 | 0.0058 | None reported |
| High | CVE-2026-53225 | sctp: fix uninit-value in __sctp_rcv_asconf_lookup() | 9.1 | 0.0058 | None reported |
| High | CVE-2026-53268 | netfilter: conntrack_irc: fix possible out-of-bounds read | 8.2 | 0.0052 | None reported |
| High | CVE-2026-63984 | kernel-default: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63993 | kernel: In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after s... | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63994 | kernel-default: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-64007 | kernel-default: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105). | 9.8 | 0.0051 | None reported |
| High | CVE-2026-63992 | kernel-default: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868). | 9.1 | 0.0051 | None reported |
| High | CVE-2026-53199 | hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf | 7.5 | 0.0050 | None reported |
Showing 1 to 25 of 125
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.