Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40300: In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ] CVE-2025-39866: In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() CVE-2025-39849: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() CVE-2025-39848: In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() CVE-2025-39847: In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb CVE-2025-39846: In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() CVE-2025-39845: In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() CVE-2025-39844: In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h CVE-2025-39843: In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare CVE-2025-39842: In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown CVE-2025-39839: In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode CVE-2025-39838: In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion CVE-2025-39677: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal CVE-2025-38590: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found CVE-2025-38502: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage CVE-2025-38201: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX CVE-2025-38022: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem CVE-2025-37931: In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize CVE-2025-23160: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization CVE-2025-23143: In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. CVE-2024-57924: In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.153-175.280 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.153-175.280.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.153-175.280.amzn2023 |
Vulnerabilities 21
-
High 8.8
batman-adv: fix OOB read/write in network-coding decode
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), re…
-
High 8.8
ax25: properly unshare skbs in ax25_kiss_rcv()
In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL …
-
High 8.8
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…
-
High 7.8
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…
-
High 7.8CVE-2025-38502 Public exploit
bpf: Fix oob access in cgroup local storage
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup loca…
-
High 7.8
net/sched: Fix backlog accounting in qdisc_dequeue_internal
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to t…
-
High 7.8CVE-2025-39866 Public exploit
fs: writeback: fix use-after-free in __mark_inode_dirty()
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 5…
-
High 7.5
net/mlx5e: Remove skb secpath if xfrm state is not found
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state mig…
-
High 7.3
btrfs: adjust subpage bit start based on sectorsize
In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be beca…
-
Unscored —
fs: relax assertions on failure to encode file handles
In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of ex…
-
Unscored —
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a nul…
-
Unscored —
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed…
-
Unscored —
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is u…
-
Unscored —
cifs: prevent NULL pointer dereference in UTF16 conversion
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked t…
-
Unscored —
ocfs2: prevent release journal inode after journal shutdown
In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal m…
-
Unscored —
mm: slub: avoid wake up kswapd in set_track_prepare
In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)…
-
Unscored —
mm: move page table sync declarations to linux/pgtable.h
In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amou…
-
Unscored —
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized wh…
-
Unscored —
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dere…
-
Unscored —
ppp: fix memory leak in pad_compress_skb
In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb…
-
Unscored —
x86/vmscape: Add conditional IBPB mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57924.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23143.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38022.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38201.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38502.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38590.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39677.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39838.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39839.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39842.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39843.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39844.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39845.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39847.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39848.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39849.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39866.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40300.html