Skip to content
OpenAdvisories
High ALAS2-2025-2968 6 CVEs

Important: kernel security update (Amazon Linux 2)

Published Aug 12, 2025 · Updated Sep 23, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-38161: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction CVE-2025-38086: In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart CVE-2025-38061: In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() CVE-2025-37940: In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() CVE-2023-53286: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ CVE-2022-49935: In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: check if the new fence is really later

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 kernel 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-debuginfo 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-debuginfo-common-aarch64 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-debuginfo-common-x86_64 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-devel 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-headers 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-livepatch-4.14.355-280.672 0:1.0-0.amzn2
Amazon Linux · 2 kernel-tools 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-tools-debuginfo 0:4.14.355-280.672.amzn2
Amazon Linux · 2 kernel-tools-devel 0:4.14.355-280.672.amzn2
Amazon Linux · 2 perf 0:4.14.355-280.672.amzn2
Amazon Linux · 2 perf-debuginfo 0:4.14.355-280.672.amzn2
Amazon Linux · 2 python-perf 0:4.14.355-280.672.amzn2
Amazon Linux · 2 python-perf-debuginfo 0:4.14.355-280.672.amzn2

Vulnerabilities 6

  • High 7.8
    CVE-2022-49935

    dma-buf/dma-resv: check if the new fence is really later

    In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: check if the new fence is really later Previously when we added a fence to a dma_resv object we always assumed the the newer than all the existing fences. With Jason's work …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53286

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, the result of the firmware destruction function was ignored and upper layers weren't informed a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38161

    RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-37940

    ftrace: Add cond_resched() to ftrace_graph_set_hash()

    In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to ex…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38061

    net: pktgen: fix access outside of user given buffer in pktgen_thread_write()

    In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() Honour the user given buffer size for the strn_len() calls (otherwise strn_len() will access memory outside of th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38086

    net: ch9200: fix uninitialised access during mii_nway_restart

    In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-49935.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-53286.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-37940.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38061.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38086.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38161.html