Skip to content
OpenAdvisories
High ALAS2-2025-2944 5 CVEs

Important: kernel security update (Amazon Linux 2)

Published Jul 17, 2025 · Updated Aug 26, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-38075: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection CVE-2025-38051: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent CVE-2025-23150: In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split CVE-2022-50103: In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed CVE-2022-50092: In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.355-280.652 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.355-280.652.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.355-280.652.amzn2
Amazon Linux · 2 perf 0:4.14.355-280.652.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.355-280.652.amzn2
Amazon Linux · 2 python-perf 0:4.14.355-280.652.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.355-280.652.amzn2

Vulnerabilities 5

  • Critical 9.8
    CVE-2025-38075

    scsi: target: iscsi: Fix timeout on deleted connection

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-23150

    ext4: fix off-by-one error in do_split

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KAS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38051

    smb: client: Fix use-after-free in cifs_fill_dirent

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-50092

    dm thin: fix use-after-free crash in dm_sm_register_threshold_callback

    In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x8…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50103

    sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed

    In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating that the cpuset will just use the effective CPUs of…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-50092.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-50103.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-23150.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38051.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38075.html