Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38097: In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak CVE-2025-38079: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept CVE-2025-38075: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection CVE-2025-38072: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() CVE-2025-38071: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() CVE-2025-38068: In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun CVE-2025-38066: In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes CVE-2025-38063: In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH CVE-2025-38062: In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie CVE-2025-38058: In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock CVE-2025-38051: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent CVE-2025-38048: In the Linux kernel, the following vulnerability has been resolved: virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN CVE-2025-38040: In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs CVE-2025-38037: In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races CVE-2025-38034: In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref CVE-2025-38031: In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work CVE-2025-38004: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates CVE-2025-38003: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content CVE-2025-38001: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice CVE-2025-38000: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() CVE-2025-21816: In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING CVE-2024-56758: In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio()
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.141-155.222 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.141-155.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.141-155.222.amzn2023 |
Vulnerabilities 22
-
Critical 9.8
scsi: target: iscsi: Fix timeout on deleted connection
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing c…
-
High 7.8
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementi…
-
High 7.8CVE-2025-38001 Public exploit
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be byp…
-
High 7.8
can: bcm: add missing rcu read protection for procfs content
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable da…
-
High 7.8
smb: client: Fix use-after-free in cifs_fill_dirent
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…
-
High 7.8
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is …
-
High 7.8
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie The IOMMU translation for MSI message addresses has been a 2-step process, separated in time: 1) iommu_dma_prepar…
-
High 7.8
crypto: lzo - Fix compression buffer overrun
In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides e…
-
High 7.8
crypto: algif_hash - fix double free in hash_accept
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also fr…
-
High 7.8
espintcp: remove encap socket caching to avoid reference leak
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain …
-
High 7.3
can: bcm: add locking for bcm_op runtime updates
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be chan…
-
Unscored —
btrfs: check folio mapping after unlock in relocate_one_folio()
In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread c…
-
Unscored —
hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not…
-
Unscored —
padata: do not leak refcount in reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of th…
-
Unscored —
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref() calls the old and new reference variables in the incorrect order. This causes a NULL pointer dereferen…
-
Unscored —
vxlan: Annotate FDB data races
In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced u…
-
Unscored —
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs The following splat has been observed on a SAMA5D27 platform using atmel_serial: BUG: sleeping function called from invalid con…
-
Unscored —
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
In the Linux kernel, the following vulnerability has been resolved: virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN syzbot reports a data-race when accessing the event_triggered, here is the simplified stack when the issue occurred: ==…
-
Unscored —
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYN…
-
Unscored —
dm cache: prevent BUG_ON by blocking retries on failed device resumes
In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initializ…
-
Unscored —
x86/mm: Check return value from memblock_phys_alloc_range()
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel wil…
-
Unscored —
libnvdimm/labels: Fix divide error in nd_label_data_init()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h)…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-56758.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21816.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38001.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38031.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38034.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38037.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38040.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38048.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38058.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38062.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38063.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38066.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38068.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38072.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38079.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38097.html