Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-39734: In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" CVE-2025-39730: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() CVE-2025-38727: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() CVE-2025-38665: In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode CVE-2025-38653: In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al CVE-2025-38645: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage CVE-2025-38639: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated CVE-2025-38622: In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() CVE-2025-38618: In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY CVE-2025-38617: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() CVE-2025-38608: In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls CVE-2025-38588: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() CVE-2025-38587: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() CVE-2025-38572: In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() CVE-2025-38565: In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail CVE-2025-38563: In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings CVE-2025-38560: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation CVE-2025-38553: In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree CVE-2025-38500: In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface CVE-2025-38206: In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free CVE-2025-38162: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation CVE-2025-37954: In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.148-173.267 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.148-173.267.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.148-173.267.amzn2023 |
Vulnerabilities 22
-
Critical 9.3
x86/sev: Evict cache lines during SNP memory validation
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to priv…
-
High 8.6
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the…
-
High 7.8
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation When calculating the lookup table size, ensure the following multiplication does not overflow: - desc->field_len[] maxim…
-
High 7.8
exfat: fix double free in delayed_free
In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : f…
-
High 7.8
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…
-
High 7.8
ipv6: reject malicious packets in ipv6_gso_segment()
In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field …
-
High 7.8
net/packet: fix a race in packet_set_ring() and packet_notifier()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This …
-
High 7.8
vsock: Do not allow binding to VMADDR_PORT_ANY
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…
-
High 7.8
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…
-
High 7.5
smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't c…
-
High 7.1
netfilter: xt_nfacct: don't assume acct name is null-terminated
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [.…
-
Unscored —CVE-2025-38553 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
perf/core: Prevent VMA split of buffer mappings
In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports…
-
Unscored —
perf/core: Exit early on perf_mmap() fail
In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_r…
-
Unscored —
ipv6: fix possible infinite loop in fib6_info_uses_dev()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure…
-
Unscored —
ipv6: prevent infinite loop in rt6_nlmsg_size()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, …
-
Unscored —
net: drop UFO packets in udp_rcv_segment()
In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size,…
-
Unscored —
net/mlx5: Check device memory pointer before usage
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.
-
Unscored —
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver d…
-
Unscored —
netlink: avoid infinite retry looping in netlink_unicast()
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to …
-
Unscored —
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.
-
Unscored —
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bu…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37954.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38162.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38206.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38500.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38553.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38560.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38563.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38565.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38572.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38587.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38588.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38608.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38617.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38618.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38622.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38639.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38645.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38653.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38665.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38727.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39730.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39734.html