Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38550: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() CVE-2025-38540: In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras CVE-2025-38539: In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event CVE-2025-38528: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers CVE-2025-38527: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break CVE-2025-38503: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion when building free space tree CVE-2025-38499: In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns CVE-2025-38495: In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID CVE-2025-38494: In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request CVE-2025-38488: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto CVE-2025-38477: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate CVE-2025-38476: In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). CVE-2025-38472: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry CVE-2025-38471: In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock CVE-2025-38470: In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime CVE-2025-38468: In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree CVE-2025-38466: In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes CVE-2025-38465: In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. CVE-2025-38462: In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_{g2h,h2g} TOCTOU CVE-2025-38461: In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU CVE-2025-38457: In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist CVE-2025-38455: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight CVE-2025-38451: In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() CVE-2025-38445: In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape CVE-2025-38444: In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request CVE-2025-38443: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path CVE-2025-38441: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() CVE-2025-38396: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass CVE-2025-38364: In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() CVE-2025-38248: In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38244: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels CVE-2025-38067: In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero CVE-2025-38064: In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown() CVE-2025-37920: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.147-172.266 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.147-172.266.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.147-172.266.amzn2023 |
Vulnerabilities 34
-
Critical 9.8
tls: always refresh the queue when reading sock
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…
-
Critical 9.8
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP…
-
Critical 9.8
rpl: Fix use-after-free in rpl_do_srh_inline().
In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses i…
-
Critical 9.8
smb: client: fix use-after-free in crypt_message when using async crypto
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are s…
-
Critical 9.8
smb: client: fix use-after-free in cifs_oplock_break
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break()…
-
High 8.8
HID: core: ensure the allocated report buffer can contain the reserved report ID
In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, curren…
-
High 7.8
xsk: Fix race condition in AF_XDP generic RX path
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share singl…
-
High 7.8
virtio: break and reset virtio devices on device_shutdown()
In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown() Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang. Invalid read at addr 0x102877002, s…
-
High 7.8CVE-2025-38248 Public exploit
bridge: mcast: Fix use-after-free during router port configuration
In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding…
-
High 7.8
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. …
-
High 7.8
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm…
-
High 7.8
perf: Revert to requiring CAP_SYS_ADMIN for uprobes
In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid in…
-
High 7.8
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remo…
-
High 7.8
net/sched: sch_qfq: Fix race condition on qfq_aggregate
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurren…
-
High 7.8
HID: core: do not bypass hid_hw_raw_request
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver func…
-
High 7.8
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to …
-
High 7.8
tracing: Add down_write(trace_event_sem) when adding trace event
In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk forma…
-
High 7.8
ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return.
-
High 7.5
smb: client: fix potential deadlock when reconnecting channels
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order and prevent the following deadlock from happening =========…
-
High 7.1
bpf: Reject %p% format string in bprintf-like helpers
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at …
-
High 7.0
vsock: Fix transport_* TOCTOU
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…
-
Unscored —
rseq: Fix segfault on registration when rseq_cs is non-zero
In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by th…
-
Unscored —
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted again…
-
Unscored —
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. B…
-
Unscored —
nbd: fix uaf in nbd_genl_connect() error path
In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ======================…
-
Unscored —
raid10: cleanup memleak at raid10_make_request
In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from th…
-
Unscored —
md/raid1: Fix stack memory use after return in raid1_reshape
In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_poo…
-
Unscored —
md/md-bitmap: fix GPF in bitmap_get_stats()
In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states: Remove the external bitmap check as t…
-
Unscored —
net/sched: Abort __tc_modify_qdisc if parent class does not exist
In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent an…
-
Unscored —
vsock: Fix transport_{g2h,h2g} TOCTOU
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check. Introduce vsock_transpor…
-
Unscored —
netlink: Fix wraparounds of sk->sk_rmem_alloc.
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , wh…
-
Unscored —
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root hand…
-
Unscored —
btrfs: fix assertion when building free space tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion when building free space tree When building the free space tree with the block group tree feature enabled, we can hit an assertion failure like this: BTRFS info (device l…
-
Unscored —
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implem…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37920.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38064.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38067.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38244.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38248.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38364.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38396.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38441.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38443.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38444.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38445.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38451.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38455.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38457.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38461.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38462.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38465.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38466.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38468.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38470.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38471.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38472.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38476.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38477.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38488.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38494.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38495.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38499.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38503.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38527.html