Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3197.
##

include('compat.inc');

if (description)
{
  script_id(365220);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-63858",
    "CVE-2026-64025",
    "CVE-2026-64078",
    "CVE-2026-64079",
    "CVE-2026-64210",
    "CVE-2026-68476",
    "CVE-2026-72323",
    "CVE-2026-74268",
    "CVE-2026-74334",
    "CVE-2026-74474",
    "CVE-2026-80671",
    "CVE-2026-80784",
    "CVE-2026-80806",
    "CVE-2026-80824",
    "CVE-2026-80830",
    "CVE-2026-80840",
    "CVE-2026-80842",
    "CVE-2026-80843",
    "CVE-2026-80852",
    "CVE-2026-80855",
    "CVE-2026-80856",
    "CVE-2026-80912",
    "CVE-2026-80932",
    "CVE-2026-80963",
    "CVE-2026-80976",
    "CVE-2026-80977",
    "CVE-2026-80978",
    "CVE-2026-80994",
    "CVE-2026-81002",
    "CVE-2026-81005",
    "CVE-2026-89476",
    "CVE-2026-89477",
    "CVE-2026-89478",
    "CVE-2026-89479",
    "CVE-2026-89480",
    "CVE-2026-89481",
    "CVE-2026-89482",
    "CVE-2026-89483",
    "CVE-2026-89485",
    "CVE-2026-89487",
    "CVE-2026-89488",
    "CVE-2026-89508",
    "CVE-2026-89515",
    "CVE-2026-89525",
    "CVE-2026-89538",
    "CVE-2026-89540",
    "CVE-2026-89541",
    "CVE-2026-89542",
    "CVE-2026-89548",
    "CVE-2026-89549",
    "CVE-2026-89551",
    "CVE-2026-89554",
    "CVE-2026-89555",
    "CVE-2026-89557",
    "CVE-2026-89559",
    "CVE-2026-89560",
    "CVE-2026-89562",
    "CVE-2026-89563",
    "CVE-2026-89565",
    "CVE-2026-89573",
    "CVE-2026-89575",
    "CVE-2026-89579",
    "CVE-2026-89586",
    "CVE-2026-89595",
    "CVE-2026-89603",
    "CVE-2026-89604",
    "CVE-2026-89615",
    "CVE-2026-89616",
    "CVE-2026-89617",
    "CVE-2026-89634",
    "CVE-2026-89636",
    "CVE-2026-89640",
    "CVE-2026-89643",
    "CVE-2026-89649",
    "CVE-2026-89650",
    "CVE-2026-89653",
    "CVE-2026-89655",
    "CVE-2026-89656",
    "CVE-2026-89662",
    "CVE-2026-89663",
    "CVE-2026-89669",
    "CVE-2026-89684",
    "CVE-2026-89694",
    "CVE-2026-89696",
    "CVE-2026-89699",
    "CVE-2026-89704",
    "CVE-2026-89706",
    "CVE-2026-89710",
    "CVE-2026-89711",
    "CVE-2026-89712",
    "CVE-2026-89726",
    "CVE-2026-89741",
    "CVE-2026-89744",
    "CVE-2026-89752",
    "CVE-2026-89753",
    "CVE-2026-89756",
    "CVE-2026-89776",
    "CVE-2026-89777",
    "CVE-2026-89778",
    "CVE-2026-89779",
    "CVE-2026-89781",
    "CVE-2026-89782",
    "CVE-2026-89783",
    "CVE-2026-89784",
    "CVE-2026-89785",
    "CVE-2026-89786",
    "CVE-2026-89816",
    "CVE-2026-89822",
    "CVE-2026-89823",
    "CVE-2026-89927",
    "CVE-2026-89930",
    "CVE-2026-89932",
    "CVE-2026-89965",
    "CVE-2026-89973",
    "CVE-2026-89983",
    "CVE-2026-89984",
    "CVE-2026-89988",
    "CVE-2026-89989",
    "CVE-2026-89992",
    "CVE-2026-89997",
    "CVE-2026-89998",
    "CVE-2026-90011",
    "CVE-2026-90015",
    "CVE-2026-90049",
    "CVE-2026-90053",
    "CVE-2026-90054",
    "CVE-2026-90058",
    "CVE-2026-90062",
    "CVE-2026-90063",
    "CVE-2026-90067",
    "CVE-2026-90071",
    "CVE-2026-90072",
    "CVE-2026-90073",
    "CVE-2026-90075",
    "CVE-2026-90081",
    "CVE-2026-90102",
    "CVE-2026-90103",
    "CVE-2026-90110",
    "CVE-2026-90114",
    "CVE-2026-90140",
    "CVE-2026-90141",
    "CVE-2026-90151",
    "CVE-2026-90157",
    "CVE-2026-90160",
    "CVE-2026-90184",
    "CVE-2026-90185",
    "CVE-2026-90186",
    "CVE-2026-90188",
    "CVE-2026-90189",
    "CVE-2026-90190",
    "CVE-2026-90194",
    "CVE-2026-90202",
    "CVE-2026-90203",
    "CVE-2026-90218",
    "CVE-2026-90248",
    "CVE-2026-90283",
    "CVE-2026-90284",
    "CVE-2026-90290",
    "CVE-2026-90318",
    "CVE-2026-90329",
    "CVE-2026-90334",
    "CVE-2026-90388",
    "CVE-2026-90393",
    "CVE-2026-90416",
    "CVE-2026-90434",
    "CVE-2026-90435",
    "CVE-2026-92494",
    "CVE-2026-92501",
    "CVE-2026-92507",
    "CVE-2026-92508",
    "CVE-2026-92509",
    "CVE-2026-92510",
    "CVE-2026-92511",
    "CVE-2026-92512",
    "CVE-2026-92521",
    "CVE-2026-92522",
    "CVE-2026-92523",
    "CVE-2026-92524",
    "CVE-2026-93046",
    "CVE-2026-93054",
    "CVE-2026-93055",
    "CVE-2026-93073",
    "CVE-2026-93109",
    "CVE-2026-93110",
    "CVE-2026-93117",
    "CVE-2026-93137",
    "CVE-2026-93138",
    "CVE-2026-93182",
    "CVE-2026-93189",
    "CVE-2026-93206",
    "CVE-2026-93210",
    "CVE-2026-93213",
    "CVE-2026-93222",
    "CVE-2026-93226",
    "CVE-2026-93256",
    "CVE-2026-93262",
    "CVE-2026-93268",
    "CVE-2026-97557",
    "CVE-2026-98164",
    "CVE-2026-100070"
  );

  script_name(english:"Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3197 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (CVE-2026-100070)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: add hook transactions for device deletions (CVE-2026-63858)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

    sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() anddefers to psock->saved_data_ready when a
    TLS RX context is present,avoiding a conflict with the TLS strparser's ownership of the receivequeue
    (commit e91de6afa81c, bpf: Fix running sk_skb program typeswith ktls).

    sk_psock_verdict_data_ready() has no equivalent guard.  When a socketis inserted into a sockmap
    (BPF_SK_SKB_VERDICT) before TLS RX isconfigured, tls_sw_strparser_arm() saves
    sk_psock_verdict_data_readyas rx_ctx->saved_data_ready.  On data arrival:

    tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready-> saved_data_ready() =
    sk_psock_verdict_data_ready()-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()without calling
    tcp_eat_skb(), so copied_seq is not advanced.

    tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), callstcp_recv_skb() on the now-empty queue,
    hits WARN_ON_ONCE(!first), andreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-
    owned(potentially freed) skb.  tls_decrypt_sg() subsequently walks thatfrag_list: use-after-free.

    Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX contextis present, call
    psock->saved_data_ready (sock_def_readable) to wakerecv() waiters and return immediately, leaving the
    receive queueuntouched.  TLS retains sole ownership of the queue and decrypts therecord normally through
    tls_sw_recvmsg(). (CVE-2026-64025)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: add and use xtables_unregister_table_exit

    Previous change added xtables_unregister_table_pre_exit to detach thetable from the packetpath and to
    unlink it from the active table list.In case of rmmod, userspace that is doing set/getsockopt for this
    tablewill not be able to re-instantiate the table:1. The larval table has been removed already2. existing
    instantiated table is no longer on the xt pernet table list.

    This adds the second stage helper:

    unlink the table from the dying list, free the hook ops (if any) and dothe audit notification.  It
    replaces xt_unregister_table(). (CVE-2026-64078)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: allocate hook ops while under mutex

    arp/ip(6)t_register_table() add the table to the per-netns list viaxt_register_table() before allocating
    the per-netns hook ops copyvia kmemdup_array().  This leaves a window where the table isvisible in the
    list with ops=NULL.

    If the pernet exit happens runs concurrently the pre_exit callback findsthe table via xt_find_table() and
    passes the NULL ops pointer tonf_unregister_net_hooks(), causing a NULL dereference:

    general protection fault in nf_unregister_net_hooks+0xbc/0x150RIP: nf_unregister_net_hooks
    (net/netfilter/core.c:613)Call
    Trace:ipt_unregister_table_pre_exitiptable_mangle_net_pre_exitops_pre_exit_listcleanup_net

    Fix by moving the ops allocation into the xtables core so the table isnever in the list without valid ops.
    Also ensure the table is no longerprocessing packets before its torn down on error
    unwind.nf_register_net_hooks might have published at least one hook; callsynchronize_rcu() if there was an
    error.

    audit log register message gets deferred until all operations havepassed, this avoids need to emit another
    ureg message in case oferror unwinding.

    Based on earlier patch by Tristan Madani. (CVE-2026-64079)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: reload ip header after head reallocation (CVE-2026-68476)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474)

    In the Linux kernel, the following vulnerability has been resolved:

    perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (CVE-2026-80671)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: fix memory leak from alloc-during-teardown race (CVE-2026-80784)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't enable DAX on new encrypted files (CVE-2026-80806)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CVE-2026-80842)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix xfrm_state_construct() auth-trunc leak (CVE-2026-80843)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: device: fix out-of-bounds write in tls_append_frag() (CVE-2026-80852)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix invalidate lock leak on open O_TRUNC DAX failure (CVE-2026-80855)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix invalidate lock leak on setattr writeback failure (CVE-2026-80856)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: reject an unclaimed class value in security_get_classes() (CVE-2026-80912)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: flush works in dependency order (CVE-2026-80932)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)

    In the Linux kernel, the following vulnerability has been resolved:

    net: cap advertised IP tunnel headroom (CVE-2026-80978)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)

    In the Linux kernel, the following vulnerability has been resolved:

    xdp: fix zero-copy frame layout (CVE-2026-81002)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

    A cached RECONF chunk may contain more than one request parameter.  Aduplicate response can therefore find
    and process the same ADD_OUT requestagain while another parameter is still outstanding, rolling back
    outcnttwice and possibly underflowing it.

    Track outstanding request types as bits and clear each bit after its firstresponse.  Later responses for
    the same request are then ignored. (CVE-2026-89476)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: drop a chunk if its transport was removed (CVE-2026-89478)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: reject a read that transferred too few bytes

    nvme_tcp_recv_data() completes a request once the current C2HData PDUhas been consumed. Nothing compares
    the total bytes received againstthe length the command asked for: struct nvme_tcp_request has noreceive-
    side counter, queue->data_remaining is per queue, andblk_mq_end_request() completes for blk_rq_bytes(rq)
    unconditionallywith no residual concept anywhere above.

    A controller can therefore answer a 4096-byte read with 512 bytes andhave it reported as a complete read;
    user space then gets 4096 bytes ofwhich 3584 are whatever was already in the page. I reproduced that witha
    test target.

    Count the bytes received and refuse to complete a successful read whosecount does not match, at the two
    NVME_TCP_F_DATA_SUCCESS paths and innvme_tcp_process_nvme_cqe(). The success test shifts req->status
    rightby one, because the driver keeps the wire value there and shifts it oncompletion, so the check must
    see what the completion path will see.Only REQ_OP_READ is checked, because there the length comes from
    thesectors the request covers; a passthrough command is built by itssubmitter, which picks both command
    and buffer, so the kernel hasnothing to compare against. (CVE-2026-89480)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: zero the discard fallback page (CVE-2026-89483)

    In the Linux kernel, the following vulnerability has been resolved:

    lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: only skb_tx_error() a packet we are about to drop (CVE-2026-89487)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (CVE-2026-89515)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: reject VAT indexes equal to the entry count (CVE-2026-89525)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: route to a populated pool in svc_pool_for_cpu() (CVE-2026-89549)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)

    In the Linux kernel, the following vulnerability has been resolved:

    mpls: reload header after pskb_may_pull()

    mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthopwhen an MPLS route has multiple
    nexthops.  While walking the MPLS labelstack, the hash routine caches hdr for the current label.  After
    findingthe bottom-of-stack label, it calls pskb_may_pull() before reading theinner IP header.

    If an skb is constructed with the inner IP header in nonlinear data andinsufficient tailroom in the linear
    head, pskb_may_pull() callspskb_expand_head() to replace the skb head and free the old one.  Thisleaves
    hdr pointing to freed memory.  The IPv6 path can invalidate hdragain when it performs a second pull for
    the larger header.

    The issue was found through static analysis.  A reproducer sending a legalGeneve packet through a
    bareudp/MPLS multipath setup triggered the sameKASAN report in 2 of 2 unpatched runs:

    BUG: KASAN: slab-use-after-free in mpls_select_multipathRead of size 1 at addr ffff88800ecc6e20 by task
    ksoftirqd/1/23

    Call Trace:mpls_select_multipathmpls_forward__netif_receive_skb_list_corenetif_receive_skb_list_internalna
    pi_complete_donegro_cell_poll__napi_pollnet_rx_action

    Freed by task 23:kfreepskb_expand_head__pskb_pull_tailmpls_select_multipath

    Reload hdr from the current skb head after each successful pull beforederiving the inner IPv4 or IPv6
    header pointer. (CVE-2026-89555)

    In the Linux kernel, the following vulnerability has been resolved:

    md: do overflow check for sb->bblog_shift in super_1_load() (CVE-2026-89557)

    In the Linux kernel, the following vulnerability has been resolved:

    libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (CVE-2026-89559)

    In the Linux kernel, the following vulnerability has been resolved:

    landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

    Whiteout objects are used in the upper layer of an OverlayFS toindicate that the file with this name does
    not exist in the unifiedview, even if it is present in one of the lower layer file systems.

    For the userspace implementations of OverlayFS (fuse-overlayfs),whiteout objects can be created from
    userspace as well:

    * mknod(2) with S_IFCHR and makedev(0, 0)* renameat2(2) with RENAME_WHITEOUT,creating the whiteout in the
    old place of the moved file.

    This commit guards whiteout creation in both of these cases withLANDLOCK_ACCESS_FS_MAKE_REG.  Whiteout
    objects are *not* consideredcharacter devices and are not bound to a driver.

    LANDLOCK_ACCESS_FS_MAKE_REG describes the same permission class as awhiteout object: creating one is the
    only S_IFCHR creation that the VFSexempts from CAP_MKNOD, so it is as unprivileged as creating a
    regularfile, while LANDLOCK_ACCESS_FS_MAKE_CHAR andLANDLOCK_ACCESS_FS_MAKE_BLOCK keep meaning the creation
    of devices thatexpose a kernel interface [1].

    For the mknod(2) case, introduce a Landlock erratum.  The creation ofwhiteout objects through mknod(2) was
    previously guarded usingLANDLOCK_ACCESS_FS_MAKE_CHAR, and it is now guarded
    usingLANDLOCK_ACCESS_FS_MAKE_REG.

    For the renameat2(2) case, fix a bug: Before this commit, renameat2(2)with RENAME_WHITEOUT would create a
    directory entry even when allLANDLOCK_ACCESS_FS_MAKE_* rights were denied.

    This does not affect normal renames within layered OverlayFS mounts:When doing a regular rename() on a
    mounted fuse-overlayfs, it is thefuse-overlayfs daemon that exercises renameat2() with RENAME_WHITEOUT,and
    only the Landlock domain of that daemon is checked there.

    Depends-on: 49c9e09d9610 (landlock: Fix handling of disconnected directories)Depends-on: fe72ce6710cb
    (landlock: Add errata documentation section)[mic: Record why LANDLOCK_ACCESS_FS_MAKE_REG is the matching
    right, andadd link(2) to the user doc] (CVE-2026-89560)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: fix hardware header length for NBMA tunnels (CVE-2026-89562)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (CVE-2026-89563)

    In the Linux kernel, the following vulnerability has been resolved:

    ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (CVE-2026-89565)

    In the Linux kernel, the following vulnerability has been resolved:

    dm array: reject an array block whose value size is not the caller's (CVE-2026-89573)

    In the Linux kernel, the following vulnerability has been resolved:

    dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVE-2026-89579)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: Fix stale object mask after concurrent mark updates (CVE-2026-89595)

    In the Linux kernel, the following vulnerability has been resolved:

    entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Rate limit statfs() handler (CVE-2026-89604)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: avoid dropping live tree ref on fsnotify rule autoremove

    audit_del_rule() is used for both netlink deletion templates and internalfsnotify autoremove.  The former
    passes a parsed template which owns atemporary tree reference; the latter passes the installed entry
    itself.

    The unconditional audit_put_tree() at the end of audit_del_rule() assumesthe template case.  For mixed
    AUDIT_DIR plus AUDIT_EXE rules, an fsnotifyautoremove event therefore drops the installed rule's live tree
    reference.Repeating this across rules sharing the same tree can free the tree whileanother rule still
    references it, and a later autoremove dereferences thefreed pathname while comparing rules.

    Move the temporary-tree put to audit_rule_change(), the caller that ownsdeletion templates.  Keep it in
    the AUDIT_DEL_RULE cleanup so bothsuccessful deletion and -ENOENT still release the parser-owned tree.
    (CVE-2026-89643)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix cpntf publish race in nfs4_init_cp_state

    nfs4_alloc_init_cpntf_state() published the new cpntf entry into thes2s_cp_stateids IDR (with cs_type set)
    in one s2s_cp_lock section, thentook the lock again to list_add() it onto p_stid->sc_cp_list. In the
    gapthe entry is reachable by so_id but cp_list is still {NULL,NULL} fromkzalloc. A racing OFFLOAD_CANCEL
    (so_id is echoed to the client ascnr_stateid, so any NFSv4.2 client can drive it)
    reachesmanage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() onthe zeroed list_head,
    oopsing the server.

    Fold the cs_type assignment and the list_add() into the same criticalsection as idr_alloc_cyclic(), so a
    concurrent lookup either misses theentry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry
    afterallocation and switch _free_cpntf_state_locked() to list_del_init() so astale unlink is a no-op.
    nfs4_init_copy_state() passes NULL p_stid andskips the list_add, preserving NFS4_COPY_STID semantics.
    (CVE-2026-89684)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (CVE-2026-89711)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert media: v4l2-dev: fix error handling in __video_register_device() (CVE-2026-89741)

    In the Linux kernel, the following vulnerability has been resolved:

    device property: fix infinite loop in fwnode_for_each_child_node() (CVE-2026-89744)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (CVE-2026-89776)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: fix out-of-bounds page array access on empty zisofs block (CVE-2026-89778)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate ef->size covers the record's name and value (CVE-2026-89779)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (CVE-2026-89781)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: reject restart table growth beyond U16_MAX entries (CVE-2026-89782)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (CVE-2026-89783)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (CVE-2026-89785)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix out-of-bounds read in ext4_read_inline_dir() (CVE-2026-89786)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (CVE-2026-89816)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Guard against NULL driver_data in i915_pci_probe() (CVE-2026-89822)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: fix race between partial drm_dev_register() failure and ioctl (CVE-2026-89823)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (CVE-2026-89927)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm/btt: reject an arena whose nfree is below the lane count (CVE-2026-89965)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: check the data direction of a C2HData PDU (CVE-2026-89973)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix debugfs UAF on adapter removal (CVE-2026-89983)

    In the Linux kernel, the following vulnerability has been resol ...

  Please note that the description has been truncated due to length. Please refer to vendor advisory for the full
description.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3197.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-100070.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63858.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64025.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64078.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64079.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64210.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-68476.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-72323.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-74268.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-74334.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-74474.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80671.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80784.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80806.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80824.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80830.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80840.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80842.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80843.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80852.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80855.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80856.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80912.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80963.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80976.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80977.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80978.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-80994.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81002.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-81005.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89476.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89477.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89478.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89479.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89480.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89481.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89482.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89483.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89485.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89487.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89488.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89508.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89515.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89525.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89538.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89540.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89541.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89542.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89548.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89549.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89551.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89554.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89555.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89557.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89559.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89560.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89562.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89563.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89565.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89573.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89575.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89579.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89586.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89595.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89603.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89604.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89615.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89616.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89617.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89634.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89636.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89640.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89643.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89649.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89650.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89653.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89655.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89656.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89662.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89663.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89669.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89684.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89694.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89696.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89699.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89704.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89706.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89710.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89711.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89712.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89726.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89741.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89744.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89752.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89753.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89756.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89776.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89777.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89778.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89779.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89781.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89782.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89783.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89784.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89785.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89786.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89816.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89822.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89823.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89927.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89930.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89965.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89973.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89983.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89984.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89988.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89989.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89992.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89997.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89998.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90011.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90015.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90049.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90053.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90054.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90058.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90062.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90063.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90067.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90071.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90072.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90073.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90075.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90081.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90102.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90103.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90110.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90114.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90140.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90141.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90151.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90157.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90160.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90184.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90185.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90186.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90188.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90189.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90190.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90194.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90202.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90203.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90218.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90248.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90283.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90284.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90290.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90318.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90329.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90334.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90388.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90393.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90416.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90434.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-90435.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92494.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92501.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92507.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92508.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92509.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92510.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92511.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92512.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92521.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92522.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92523.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-92524.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93046.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93054.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93055.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93073.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93109.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93110.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93117.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93137.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93138.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93182.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93189.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93206.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93210.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93213.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93222.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93226.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93256.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93262.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-93268.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-97557.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-98164.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update kernel --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3197 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-98164");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo-common-aarch64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-livepatch-6.1.188-233.385");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-modules-extra-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-tools-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "kpatch.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");
include("hotfixes.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (get_one_kb_item("Host/kpatch/kernel-cves"))
{
  var cve_list = make_list("CVE-2026-63858", "CVE-2026-64025", "CVE-2026-64078", "CVE-2026-64079", "CVE-2026-64210", "CVE-2026-68476", "CVE-2026-72323", "CVE-2026-74268", "CVE-2026-74334", "CVE-2026-74474", "CVE-2026-80671", "CVE-2026-80784", "CVE-2026-80806", "CVE-2026-80824", "CVE-2026-80830", "CVE-2026-80840", "CVE-2026-80842", "CVE-2026-80843", "CVE-2026-80852", "CVE-2026-80855", "CVE-2026-80856", "CVE-2026-80912", "CVE-2026-80932", "CVE-2026-80963", "CVE-2026-80976", "CVE-2026-80977", "CVE-2026-80978", "CVE-2026-80994", "CVE-2026-81002", "CVE-2026-81005", "CVE-2026-89476", "CVE-2026-89477", "CVE-2026-89478", "CVE-2026-89479", "CVE-2026-89480", "CVE-2026-89481", "CVE-2026-89482", "CVE-2026-89483", "CVE-2026-89485", "CVE-2026-89487", "CVE-2026-89488", "CVE-2026-89508", "CVE-2026-89515", "CVE-2026-89525", "CVE-2026-89538", "CVE-2026-89540", "CVE-2026-89541", "CVE-2026-89542", "CVE-2026-89548", "CVE-2026-89549", "CVE-2026-89551", "CVE-2026-89554", "CVE-2026-89555", "CVE-2026-89557", "CVE-2026-89559", "CVE-2026-89560", "CVE-2026-89562", "CVE-2026-89563", "CVE-2026-89565", "CVE-2026-89573", "CVE-2026-89575", "CVE-2026-89579", "CVE-2026-89586", "CVE-2026-89595", "CVE-2026-89603", "CVE-2026-89604", "CVE-2026-89615", "CVE-2026-89616", "CVE-2026-89617", "CVE-2026-89634", "CVE-2026-89636", "CVE-2026-89640", "CVE-2026-89643", "CVE-2026-89649", "CVE-2026-89650", "CVE-2026-89653", "CVE-2026-89655", "CVE-2026-89656", "CVE-2026-89662", "CVE-2026-89663", "CVE-2026-89669", "CVE-2026-89684", "CVE-2026-89694", "CVE-2026-89696", "CVE-2026-89699", "CVE-2026-89704", "CVE-2026-89706", "CVE-2026-89710", "CVE-2026-89711", "CVE-2026-89712", "CVE-2026-89726", "CVE-2026-89741", "CVE-2026-89744", "CVE-2026-89752", "CVE-2026-89753", "CVE-2026-89756", "CVE-2026-89776", "CVE-2026-89777", "CVE-2026-89778", "CVE-2026-89779", "CVE-2026-89781", "CVE-2026-89782", "CVE-2026-89783", "CVE-2026-89784", "CVE-2026-89785", "CVE-2026-89786", "CVE-2026-89816", "CVE-2026-89822", "CVE-2026-89823", "CVE-2026-89927", "CVE-2026-89930", "CVE-2026-89932", "CVE-2026-89965", "CVE-2026-89973", "CVE-2026-89983", "CVE-2026-89984", "CVE-2026-89988", "CVE-2026-89989", "CVE-2026-89992", "CVE-2026-89997", "CVE-2026-89998", "CVE-2026-90011", "CVE-2026-90015", "CVE-2026-90049", "CVE-2026-90053", "CVE-2026-90054", "CVE-2026-90058", "CVE-2026-90062", "CVE-2026-90063", "CVE-2026-90067", "CVE-2026-90071", "CVE-2026-90072", "CVE-2026-90073", "CVE-2026-90075", "CVE-2026-90081", "CVE-2026-90102", "CVE-2026-90103", "CVE-2026-90110", "CVE-2026-90114", "CVE-2026-90140", "CVE-2026-90141", "CVE-2026-90151", "CVE-2026-90157", "CVE-2026-90160", "CVE-2026-90184", "CVE-2026-90185", "CVE-2026-90186", "CVE-2026-90188", "CVE-2026-90189", "CVE-2026-90190", "CVE-2026-90194", "CVE-2026-90202", "CVE-2026-90203", "CVE-2026-90218", "CVE-2026-90248", "CVE-2026-90283", "CVE-2026-90284", "CVE-2026-90290", "CVE-2026-90318", "CVE-2026-90329", "CVE-2026-90334", "CVE-2026-90388", "CVE-2026-90393", "CVE-2026-90416", "CVE-2026-90434", "CVE-2026-90435", "CVE-2026-92494", "CVE-2026-92501", "CVE-2026-92507", "CVE-2026-92508", "CVE-2026-92509", "CVE-2026-92510", "CVE-2026-92511", "CVE-2026-92512", "CVE-2026-92521", "CVE-2026-92522", "CVE-2026-92523", "CVE-2026-92524", "CVE-2026-93046", "CVE-2026-93054", "CVE-2026-93055", "CVE-2026-93073", "CVE-2026-93109", "CVE-2026-93110", "CVE-2026-93117", "CVE-2026-93137", "CVE-2026-93138", "CVE-2026-93182", "CVE-2026-93189", "CVE-2026-93206", "CVE-2026-93210", "CVE-2026-93213", "CVE-2026-93222", "CVE-2026-93226", "CVE-2026-93256", "CVE-2026-93262", "CVE-2026-93268", "CVE-2026-97557", "CVE-2026-98164", "CVE-2026-100070");
  if (hotfix_cves_check(cve_list))
  {
    audit(AUDIT_PATCH_INSTALLED, "kpatch hotfix for ALAS2023-2026-3197");
  }
  else
  {
    __rpm_report = hotfix_reporting_text();
  }
}

var pkgs = [
    {'reference':'bpftool-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-6.1.'},
    {'reference':'bpftool-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-6.1.'},
    {'reference':'bpftool-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-debuginfo-6.1.'},
    {'reference':'bpftool-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool-debuginfo-6.1.'},
    {'reference':'kernel-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-6.1.'},
    {'reference':'kernel-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-6.1.'},
    {'reference':'kernel-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-6.1.'},
    {'reference':'kernel-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-6.1.'},
    {'reference':'kernel-debuginfo-common-aarch64-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-common-aarch64-6.1.'},
    {'reference':'kernel-debuginfo-common-x86_64-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-debuginfo-common-x86_64-6.1.'},
    {'reference':'kernel-devel-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-devel-6.1.'},
    {'reference':'kernel-devel-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-devel-6.1.'},
    {'reference':'kernel-headers-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-6.1.'},
    {'reference':'kernel-headers-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-headers-6.1.'},
    {'reference':'kernel-livepatch-6.1.188-233.385-1.0-0.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel-livepatch-6.1.188-233.385-1.0-0.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel-modules-extra-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-6.1.'},
    {'reference':'kernel-modules-extra-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-6.1.'},
    {'reference':'kernel-modules-extra-common-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-common-6.1.'},
    {'reference':'kernel-modules-extra-common-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-modules-extra-common-6.1.'},
    {'reference':'kernel-tools-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-6.1.'},
    {'reference':'kernel-tools-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-6.1.'},
    {'reference':'kernel-tools-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-debuginfo-6.1.'},
    {'reference':'kernel-tools-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-debuginfo-6.1.'},
    {'reference':'kernel-tools-devel-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-devel-6.1.'},
    {'reference':'kernel-tools-devel-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-tools-devel-6.1.'},
    {'reference':'perf-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-6.1.'},
    {'reference':'perf-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-6.1.'},
    {'reference':'perf-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-debuginfo-6.1.'},
    {'reference':'perf-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf-debuginfo-6.1.'},
    {'reference':'python3-perf-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-6.1.'},
    {'reference':'python3-perf-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-6.1.'},
    {'reference':'python3-perf-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-debuginfo-6.1.'},
    {'reference':'python3-perf-debuginfo-6.1.188-233.385.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf-debuginfo-6.1.'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bpftool / bpftool-debuginfo / kernel / etc");
}