Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38097: In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak CVE-2025-38079: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept CVE-2025-38075: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection CVE-2025-38073: In the Linux kernel, the following vulnerability has been resolved: block: fix race between set_blocksize and read paths CVE-2025-38072: In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() CVE-2025-38071: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() CVE-2025-38068: In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun CVE-2025-38066: In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes CVE-2025-38063: In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH CVE-2025-38062: In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie CVE-2025-38060: In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field CVE-2025-38059: In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid csum tree CVE-2025-38058: In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock CVE-2025-38057: In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks CVE-2025-38055: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq CVE-2025-38051: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent CVE-2025-38048: In the Linux kernel, the following vulnerability has been resolved: virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN CVE-2025-38047: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Fix system hang during S4 resume with FRED enabled CVE-2025-38043: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask for ffa devices CVE-2025-38040: In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs CVE-2025-38039: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled CVE-2025-38038: In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost CVE-2025-38037: In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races CVE-2025-38034: In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref CVE-2025-38033: In the Linux kernel, the following vulnerability has been resolved: x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 CVE-2025-38031: In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work CVE-2025-38004: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates CVE-2025-38003: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content CVE-2025-38000: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.31-35.92 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 0:6.12.31-35.92.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 0:6.12.31-35.92.amzn2023 |
Vulnerabilities 29
-
Critical 9.8
scsi: target: iscsi: Fix timeout on deleted connection
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing c…
-
High 7.8
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementi…
-
High 7.8
can: bcm: add missing rcu read protection for procfs content
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable da…
-
High 7.8
smb: client: Fix use-after-free in cifs_fill_dirent
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…
-
High 7.8
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is …
-
High 7.8
bpf: copy_verifier_state() should copy 'loop_entry' field
In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field The bpf_verifier_state.loop_entry state should be copied by copy_verifier_state(). Otherwise, .loop_entry values from unrelated state…
-
High 7.8
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie The IOMMU translation for MSI message addresses has been a 2-step process, separated in time: 1) iommu_dma_prepar…
-
High 7.8
crypto: lzo - Fix compression buffer overrun
In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides e…
-
High 7.8
crypto: algif_hash - fix double free in hash_accept
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also fr…
-
High 7.8
espintcp: remove encap socket caching to avoid reference leak
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain …
-
High 7.5
espintcp: fix skb leaks
In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfree_skb.
-
High 7.3
can: bcm: add locking for bcm_op runtime updates
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be chan…
-
Unscored —
padata: do not leak refcount in reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of th…
-
Unscored —
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
In the Linux kernel, the following vulnerability has been resolved: x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 Calling core::fmt::write() from rust code while FineIBT is enabled results in a kernel panic: [ 4614.199779] kernel BUG at a…
-
Unscored —
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref() calls the old and new reference variables in the incorrect order. This causes a NULL pointer dereferen…
-
Unscored —
vxlan: Annotate FDB data races
In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced u…
-
Unscored —
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost set_boost is a per-policy function call, hence a driver wide lock is unnecessary. Also this mutex_acquire can collide with the…
-
Unscored —
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled When attempting to enable MQPRIO while HTB offload is already configured, the driver currently returns `-EINVAL` and …
-
Unscored —
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
In the Linux kernel, the following vulnerability has been resolved: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs The following splat has been observed on a SAMA5D27 platform using atmel_serial: BUG: sleeping function called from invalid con…
-
Unscored —
firmware: arm_ffa: Set dma_mask for ffa devices
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Set dma_mask for ffa devices Set dma_mask for FFA devices, otherwise DMA allocation using the device pointer lead to following warning: WARNING: CPU: 1 PID: 1 at kernel/dma…
-
Unscored —
x86/fred: Fix system hang during S4 resume with FRED enabled
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Fix system hang during S4 resume with FRED enabled Upon a wakeup from S4, the restore kernel starts and initializes the FRED MSRs as needed from its perspective. It then loads a hib…
-
Unscored —
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
In the Linux kernel, the following vulnerability has been resolved: virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN syzbot reports a data-race when accessing the event_triggered, here is the simplified stack when the issue occurred: ==…
-
Unscored —
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq Currently, using PEBS-via-PT with a sample frequency instead of a sample period, causes a segfault. For example: BUG: kernel NUL…
-
Unscored —
btrfs: avoid NULL pointer dereference if no valid csum tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid csum tree [BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace: BUG:…
-
Unscored —
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQ_PREFLUSH When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYN…
-
Unscored —
dm cache: prevent BUG_ON by blocking retries on failed device resumes
In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUG_ON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initializ…
-
Unscored —
x86/mm: Check return value from memblock_phys_alloc_range()
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel wil…
-
Unscored —
libnvdimm/labels: Fix divide error in nd_label_data_init()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h)…
-
Unscored —CVE-2025-38073 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38000.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38003.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38004.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38031.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38033.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38034.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38037.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38038.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38039.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38040.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38043.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38047.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38048.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38055.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38057.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38058.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38059.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38060.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38062.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38063.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38066.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38068.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38072.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38073.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38079.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38097.html