Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-39903: In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing kernel panic CVE-2025-39902: In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() CVE-2025-39900: In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y CVE-2025-39899: In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE CVE-2025-39898: In the Linux kernel, the following vulnerability has been resolved: e1000e: fix heap overflow in e1000_set_eeprom CVE-2025-39895: In the Linux kernel, the following vulnerability has been resolved: sched: Fix sched_numa_find_nth_cpu() if mask offline CVE-2025-39894: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm CVE-2025-39866: In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() CVE-2025-39852: In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 CVE-2025-39851: In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object CVE-2025-39850: In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects CVE-2025-39845: In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() CVE-2025-39844: In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h CVE-2025-39843: In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare CVE-2025-39838: In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion CVE-2025-39835: In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code CVE-2025-39832: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event CVE-2025-39829: In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier CVE-2025-39825: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) CVE-2025-39824: In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation CVE-2025-39823: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest CVE-2025-39819: In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update CVE-2025-39817: In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare CVE-2025-39813: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump CVE-2025-39812: In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() CVE-2025-39806: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() CVE-2025-39800: In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() CVE-2025-39798: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem CVE-2025-39797: In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling CVE-2025-39795: In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() CVE-2025-39792: In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limits CVE-2025-39791: In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets CVE-2025-39783: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling CVE-2025-39782: In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() CVE-2025-39780: In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch CVE-2025-39779: In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned CVE-2025-39773: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() CVE-2025-39770: In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM CVE-2025-39766: In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit CVE-2025-39763: In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered CVE-2025-39760: In the Linux kernel, the following vulnerability has been
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.46-66.121 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.46-66.121.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.46-66.121.amzn2023 |
Vulnerabilities 122
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
Critical 9.8
sunrpc: fix handling of server side tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…
-
Critical 9.8
[ceph] parse_longname(): strrchr() expects NUL-terminated string
In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou…
-
Critical 9.8
drbd: add missing kref_get in handle_write_conflicts
In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same s…
-
Critical 9.8
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…
-
Critical 9.8
cifs: Fix oops due to uninitialised variable
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer …
-
Critical 9.8
ipv6: sr: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
Critical 9.1
smb3: fix for slab out of bounds on mount to ksmbd
In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see …
-
High 8.8
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller th…
-
High 8.6
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the…
-
High 8.4
vsock/virtio: Validate length in packet header before skb_put()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unf…
-
High 8.2
sunrpc: fix client side handling of tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…
-
High 7.8
md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k --------------------------------------…
-
High 7.8
io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Co…
-
High 7.8
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…
-
High 7.8CVE-2025-38502 Public exploit
bpf: Fix oob access in cgroup local storage
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup loca…
-
High 7.8
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…
-
High 7.8
ipv6: reject malicious packets in ipv6_gso_segment()
In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field …
-
High 7.8
bpf, arm64: Fix fp initialization for exception boundary
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a …
-
High 7.8
eventpoll: Fix semi-unbounded recursion
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-fre…
-
High 7.8
fs/ntfs3: cancle set bad inode after removing name fails
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode …
-
High 7.8
tls: handle data disappearing from under the TLS ULP
In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered befor…
-
High 7.8
net/packet: fix a race in packet_set_ring() and packet_notifier()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This …
-
High 7.8
vsock: Do not allow binding to VMADDR_PORT_ANY
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…
-
High 7.8
bpf: Disable migration in nf_hook_run_bpf().
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nf_hook_run_bpf(). syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in __bpf_prog_run() fails, t…
-
High 7.8
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…
-
High 7.8
arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it i…
-
High 7.8
xfrm: state: initialize state_ptrs earlier in xfrm_state_find
In the Linux kernel, the following vulnerability has been resolved: xfrm: state: initialize state_ptrs earlier in xfrm_state_find In case of preemption, xfrm_state_look_at will find a different pcpu_id and look up states for that other CPU. If we matched a st…
-
High 7.8
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideall…
-
High 7.8
net: kcm: Fix race condition in kcm_unattach()
In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of …
-
High 7.8
sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …
-
High 7.8
io_uring/net: commit partial buffers on retry
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and in…
-
High 7.8
net/sched: Fix backlog accounting in qdisc_dequeue_internal
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to t…
-
High 7.8
tracing: Limit access to parser->buffer when trace_get_user failed
In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be trigge…
-
High 7.8
ftrace: Also allocate and copy hash for reading of filter files
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterato…
-
High 7.8
fs/buffer: fix use-after-free when call bh_read() helper
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 b…
-
High 7.8
NFS: Fix a race when updating an existing write
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…
-
High 7.8
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with RE…
-
High 7.8
btrfs: subpage: keep TOWRITE tag until folio is cleaned
In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfs_subpage_set_writeback() calls folio_start_writeback() the first time a folio is written back, and it also clears the PAGECACHE_TA…
-
High 7.8
sched/ext: Fix invalid task state transitions on class switch
In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch When enabling a sched_ext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following (whi…
-
High 7.8
dm: dm-crypt: Do not partially accept write BIOs with zoned targets
In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the…
-
High 7.8
dm: Always split write BIOs to zoned device limits
In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging. In such case, DM target drivers must n…
-
High 7.8
btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and …
-
High 7.8
smb: client: fix race with concurrent opens in rename(2)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding…
-
High 7.8CVE-2025-39866 Public exploit
fs: writeback: fix use-after-free in __mark_inode_dirty()
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 5…
-
High 7.5
net/mlx5e: Remove skb secpath if xfrm state is not found
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state mig…
-
High 7.5
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incor…
-
High 7.5
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deploy…
-
High 7.5
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to …
-
High 7.3
btrfs: do not allow relocation of partially dropped subvolumes
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (59450982…
-
High 7.3
NFS: Fix the setting of capabilities when automounting a new filesystem
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, an…
-
High 7.1
netfilter: xt_nfacct: don't assume acct name is null-terminated
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [.…
-
High 7.1
fs/ntfs3: Add sanity check for file name
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.
-
High 7.1
netfs: Fix unbuffered write error handling
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write stream fail, the subrequest collector doesn't update the stream->transferred value and it retains its …
-
High 7.1
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…
-
High 7.1
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However,…
-
Medium 5.5
trace/fgraph: Fix the warning caused by missing unregister notifier
In the Linux kernel, the following vulnerability has been resolved: trace/fgraph: Fix the warning caused by missing unregister notifier This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNI…
-
Medium 5.5
net/mlx5: Fix lockdep assertion on sync reset unload event
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_ac…
-
Medium 5.5
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation me…
-
Medium 5.5
net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a memory-l…
-
Medium 5.5
sched: Fix sched_numa_find_nth_cpu() if mask offline
In the Linux kernel, the following vulnerability has been resolved: sched: Fix sched_numa_find_nth_cpu() if mask offline sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might…
-
Medium 5.5
mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In…
-
Medium 5.5
net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. …
-
Medium 5.5
of_numa: fix uninitialized memory nodes causing kernel panic
In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing kernel panic When there are memory-only nodes (nodes without CPUs), these nodes are not properly initialized, causing kernel panic during boot.…
-
Unscored —
net: fix NULL pointer dereference in l3mdev_l3_rcv
In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_fin…
-
Unscored —
ext4: avoid journaling sb update on error if journal is destroying
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUG_ON if trying to start a transaction on a journal marked with JBD2_UNMOUNT, since this should never h…
-
Unscored —
md/raid1,raid10: don't ignore IO flags
In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: don't ignore IO flags If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to fl…
-
Unscored —CVE-2025-38553 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
HID: core: Harden s32ton() against conversion to 0 bits
In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity t…
-
Unscored —
perf/core: Prevent VMA split of buffer mappings
In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports…
-
Unscored —
perf/core: Exit early on perf_mmap() fail
In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_r…
-
Unscored —
ipv6: fix possible infinite loop in fib6_info_uses_dev()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure…
-
Unscored —
ipv6: prevent infinite loop in rt6_nlmsg_size()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, …
-
Unscored —
net: drop UFO packets in udp_rcv_segment()
In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size,…
-
Unscored —
pinmux: fix race causing mux_owner NULL with active mux_usecount
In the Linux kernel, the following vulnerability has been resolved: pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client o…
-
Unscored —
net/mlx5: Check device memory pointer before usage
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.
-
Unscored —
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver d…
-
Unscored —CVE-2025-38676 Public exploit
iommu/amd: Avoid stack buffer overflow from kernel cmdline
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of "acpiid" if the "str"…
-
Unscored —
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurren…
-
Unscored —
hv_netvsc: Fix panic during namespace deletion with VF
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, def…
-
Unscored —
userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the en…
-
Unscored —
pNFS: Fix uninited ptr deref in block/scsi layout
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encodin…
-
Unscored —
exfat: add cluster chain loop check for dir
In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop inf…
-
Unscored —
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_d…
-
Unscored —
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missin…
-
Unscored —
fbdev: fix potential buffer overflow in do_register_framebuffer()
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All ar…
-
Unscored —
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, t…
-
Unscored —
loop: Avoid updating block size under exclusive owner
In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch betwee…
-
Unscored —
netfilter: ctnetlink: fix refcount leak on table dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsig…
-
Unscored —
netfilter: nf_reject: don't leak dst refcount for loopback packets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_c…
-
Unscored —
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved fro…
-
Unscored —
mm/damon/ops-common: ignore migration request to invalid nodes
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() tries migration even if the target node is invalid. If users mistakenly make such invalid requests via DAM…
-
Unscored —
serial: 8250: fix panic due to PSLVERR
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Regist…
-
Unscored —
mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(), the hwpoisoned folio may be large folio, which can't be handled by unmap_poisoned_folio(). For THP,…
-
Unscored —
mm: swap: fix potential buffer overflow in setup_clusters()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As maxpages might be < last_page, setup_clusters() will e…
-
Unscored —
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.
-
Unscored —
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bu…
-
Unscored —
rcu: Fix rcu_read_unlock() deadloop due to IRQ work
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself trig…
-
Unscored —
bpf: Forget ranges when refining tnum after JSET
In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 g…
-
Unscored —
rcu: Protect ->defer_qs_iw_pending from data race
In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke r…
-
Unscored —
mm/smaps: fix race between smaps_hugetlb_range and migration
In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_en…
-
Unscored —
fs: Prevent file descriptor table allocations exceeding INT_MAX
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file d…
-
Unscored —
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of…
-
Unscored —
usb: core: config: Prevent OOB read in SS endpoint companion parsing
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…
-
Unscored —
ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, th…
-
Unscored —
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo …
-
Unscored —
net: bridge: fix soft lockup in br_multicast_query_expired()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the ti…
-
Unscored —
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffe…
-
Unscored —
PCI: endpoint: Fix configfs group list head handling
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, no…
-
Unscored —
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value.…
-
Unscored —
xfrm: Duplicate SPI Handling
In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expecte…
-
Unscored —
sctp: initialize more fields in sctp_v6_from_sk()
In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSA…
-
Unscored —
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be trigger…
-
Unscored —
fs/smb: Fix inconsistent refcnt update
In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it …
-
Unscored —
KVM: x86: use array_index_nospec with indices that come from guest
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to miti…
-
Unscored —
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT…
-
Unscored —
xfs: do not propagate ENODATA disk errors into xattr code
In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found…
-
Unscored —
cifs: prevent NULL pointer dereference in UTF16 conversion
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked t…
-
Unscored —
mm: slub: avoid wake up kswapd in set_track_prepare
In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)…
-
Unscored —
mm: move page table sync declarations to linux/pgtable.h
In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amou…
-
Unscored —
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized wh…
-
Unscored —CVE-2025-39898 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22113.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22125.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38453.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38500.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38502.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38553.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38556.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38563.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38565.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38566.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38568.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38571.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38572.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38586.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38587.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38588.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38590.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38608.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38614.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38615.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38616.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38617.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38618.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38622.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38632.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38639.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38640.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38645.html