Linux · Amazon Linux · Security advisory · August 31, 2026

ALAS2023-2026-2071: Security update for 19 packages

ALAS2023-2026-2071, released August 31, 2026, fixes 293 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
293
18 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0080
57th percentile

Priority of the 293 CVEs

Patch now 0 Urgent 18 High 217 Routine 58

Fixed package versions

ProductReleaseFixed in
bpftool6.18amzn 20231:6.18.41-94.142.amzn2023
bpftool6.18-debuginfoamzn 20231:6.18.41-94.142.amzn2023
kernel-livepatch-6.18.41-94.142amzn 20231:1.0-0.amzn2023
kernel6.18amzn 20231:6.18.41-94.142.amzn2023
kernel6.18-debuginfoamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-debuginfo-common-aarch64amzn 20231:6.18.41-94.142.amzn2023
kernel6.18-debuginfo-common-x86_64amzn 20231:6.18.41-94.142.amzn2023
kernel6.18-develamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-headersamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-modules-extraamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-modules-extra-commonamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-toolsamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-tools-debuginfoamzn 20231:6.18.41-94.142.amzn2023
kernel6.18-tools-develamzn 20231:6.18.41-94.142.amzn2023
microvm-kernel6.18amzn 20231:6.18.41-94.142.amzn2023
perf6.18amzn 20231:6.18.41-94.142.amzn2023
perf6.18-debuginfoamzn 20231:6.18.41-94.142.amzn2023
python3-perf6.18amzn 20231:6.18.41-94.142.amzn2023
python3-perf6.18-debuginfoamzn 20231:6.18.41-94.142.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-72194 linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to...9.8 0.0080 None reported
Urgent CVE-2026-72192 linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to_move in indx_insert_into_root be...9.8 0.0074 None reported
Urgent CVE-2026-72296 linux: In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife...9.1 0.0074 None reported
Urgent CVE-2026-72041 linux: In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial...9.8 0.0071 None reported
Urgent CVE-2026-72191 linux: In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indx_inser...9.8 0.0070 None reported
Urgent CVE-2026-72366 linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle as...9.8 0.0066 None reported
Urgent CVE-2026-74361 linux: In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx...9.8 0.0065 None reported
Urgent CVE-2026-72139 linux: In the Linux kernel, the following vulnerability has been resolved: tcp: defer md5sig_info kfree past RCU grace peri...9.8 0.0063 None reported
Urgent CVE-2026-72220 linux: In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rq_procinfo lifecycle to prevent...9.8 0.0063 None reported
Urgent CVE-2026-80637 netfilter: synproxy: fix unaligned memory access in timestamp adjustment9.8 0.0059 None reported
Urgent CVE-2026-64551 linux: In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before...9.1 0.0051 None reported
Urgent CVE-2026-64068 kernel-64kb: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).9.8 0.0035 None reported
Urgent CVE-2026-72277 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't n...9.3 0.0019 None reported
Urgent CVE-2026-72278 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecti...9.3 0.0019 None reported
Urgent CVE-2026-72279 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mappi...9.0 0.0019 None reported
Urgent CVE-2026-72288 linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt...9.3 0.0019 None reported
Urgent CVE-2026-80607 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg9.8 0.0017 None reported
Urgent CVE-2026-80671 linux: In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy,...9.3 0.0016 None reported
High CVE-2026-72398 sctp: add INIT verification after cookie unpacking9.8 0.0080 None reported
High CVE-2026-80630 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0076 None reported
High CVE-2026-72084 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0075 None reported
High CVE-2026-72299 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0075 None reported
High CVE-2026-72319 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0075 None reported
High CVE-2026-72351 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0075 None reported
High CVE-2026-72466 bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)9.8 0.0074 None reported
Showing 1 to 25 of 293 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.