Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40216: In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment CVE-2025-38523: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy CVE-2025-38413: In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check CVE-2025-38405: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity CVE-2025-38403: In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it CVE-2025-38400: In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. CVE-2025-38399: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() CVE-2025-38396: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass CVE-2025-38393: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN CVE-2025-38390: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix memory leak by freeing notifier callback node CVE-2025-38389: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error CVE-2025-38388: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context CVE-2025-38387: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert CVE-2025-38386: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38383: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix data race in show_numa_info() CVE-2025-38382: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay CVE-2025-38379: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel CVE-2025-38375: In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size CVE-2025-38373: In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix potential deadlock in MR deregistration CVE-2025-38372: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling CVE-2025-38365: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging CVE-2025-38364: In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() CVE-2025-38350: In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty CVE-2025-38279: In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping CVE-2025-38264: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling CVE-2025-38263: In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() CVE-2025-38262: In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init CVE-2025-38260: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly CVE-2025-38258: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write CVE-2025-38256: In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio unpinning CVE-2025-38255: In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() CVE-2025-38244: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels CVE-2025-38242: In the Linux kernel, the following vulnerability has been resolved: mm: userfaultfd: fix race of userfaultfd_move and swap cache CVE-2025-38236: In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. CVE-2025-38139: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator CVE-2025-38064: In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown()
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.37-61.105 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.37-61.105.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.37-61.105.amzn2023 |
Vulnerabilities 36
-
Critical 9.8
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting of the subrequest iterator in netfs_retry_write_stream() to use the iterator-reset function as the iter…
-
Critical 9.8
nvme-tcp: sanitize request list handling
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list p…
-
Critical 9.1
btrfs: fix a race between renames and directory logging
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the…
-
High 8.4
virtio-net: ensure the received length does not exceed allocated size
In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the …
-
High 7.8
virtio: break and reset virtio devices on device_shutdown()
In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown() Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang. Invalid read at addr 0x102877002, s…
-
High 7.8
af_unix: Don't leave consecutive consumed OOB skbs.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket impor…
-
High 7.8
mm: userfaultfd: fix race of userfaultfd_move and swap cache
In the Linux kernel, the following vulnerability has been resolved: mm: userfaultfd: fix race of userfaultfd_move and swap cache This commit fixes two kinds of races, they may have different results: Barry reported a BUG_ON in commit c50f8e6053b0, we may see …
-
High 7.8
tty: serial: uartlite: register uart driver in init
In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which firs…
-
High 7.8
net/sched: Always pass notifications when child class becomes empty
In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …
-
High 7.8
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. T…
-
High 7.8
btrfs: fix iteration of extrefs during log replay
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't …
-
High 7.8
ACPICA: Refuse to evaluate a method if arguments are missing
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of …
-
High 7.8
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. …
-
High 7.8
io_uring/rsrc: don't rely on user vaddr alignment
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses…
-
High 7.7
virtio-net: xsk: rx: fix the frame's length check
In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk…
-
High 7.5
smb: client: fix potential deadlock when reconnecting channels
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order and prevent the following deadlock from happening =========…
-
High 7.5
smb: client: fix warning when reconnecting channel
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized…
-
High 7.5
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnf…
-
High 7.5
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_und…
-
High 7.5
nvmet: fix memory leak of bio integrity
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89…
-
High 7.5
cifs: Fix the smbd_response slab to allow usercopy
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's packet …
-
Unscored —
lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer derefer…
-
Unscored —
io_uring/rsrc: fix folio unpinning
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: [ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800…
-
Unscored —
mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the prev…
-
Unscored —
btrfs: handle csum tree error with rescue=ibadroots correctly
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) D…
-
Unscored —
bcache: fix NULL pointer in cache_set_flush()
In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register…
-
Unscored —
bpf: Do not include stack ptr register in precision backtracking bookkeeping
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtrac…
-
Unscored —
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted again…
-
Unscored —
IB/mlx5: Fix potential deadlock in MR deregistration
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix potential deadlock in MR deregistration The issue arises when kzalloc() is invoked while holding umem_mutex or any other lock acquired under umem_mutex. This is problematic becau…
-
Unscored —
mm/vmalloc: fix data race in show_numa_info()
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix data race in show_numa_info() The following data-race was found in show_numa_info(): ================================================================== BUG: KCSAN: data-race i…
-
Unscored —
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous poi…
-
Unscored —
firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context The current use of a mutex to protect the notifier hashtable accesses can lead to issues in the atomic context. I…
-
Unscored —
drm/i915/gt: Fix timeline left held on VMA alloc error
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: <4> [239.330…
-
Unscored —
firmware: arm_ffa: Fix memory leak by freeing notifier callback node
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix memory leak by freeing notifier callback node Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") adds support for notifier call…
-
Unscored —
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() f…
-
Unscored —
vsock/vmci: Clear the vmci transport packet properly when initializing it
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38064.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38139.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38236.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38242.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38244.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38255.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38256.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38258.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38260.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38262.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38263.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38264.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38279.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38350.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38364.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38365.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38372.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38373.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38375.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38379.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38382.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38383.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38386.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38387.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38388.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38389.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38390.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38393.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38396.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38399.html