Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40021: In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent CVE-2025-40006: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted CVE-2025-39980: In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group CVE-2025-39977: In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI CVE-2025-39967: In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font CVE-2025-39964: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg CVE-2025-39955: In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). CVE-2025-39953: In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues CVE-2025-39946: In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus CVE-2025-39931: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg CVE-2025-39916: In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() CVE-2025-39914: In the Linux kernel, the following vulnerability has been resolved: tracing: Silence warning when chunk allocation fails in trace_pid_write CVE-2025-39913: In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. CVE-2025-39909: In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() CVE-2025-39902: In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() CVE-2025-39898: In the Linux kernel, the following vulnerability has been resolved: e1000e: fix heap overflow in e1000_set_eeprom CVE-2025-39894: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm CVE-2025-39883: In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory CVE-2025-39881: In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released CVE-2025-39880: In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info CVE-2025-39877: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show()
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.155-176.282 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.155-176.282.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.155-176.282.amzn2023 |
Vulnerabilities 21
-
High 7.8
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…
KEV Sep 18, 2026 -
Critical 9.8
libceph: fix invalid accesses to ceph_connection_v1_info
In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without ch…
-
Critical 9.8
tls: make sure to abort the stream if headers are bogus
In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read o…
-
High 7.8
kernfs: Fix UAF in polling when open file is released
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-af…
-
High 7.8
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a c…
-
High 7.8
fbcon: fix integer overflow in fbcon_do_set_font
In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font par…
-
High 7.8
futex: Prevent use-after-free during requeue-PI
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atom…
-
High 7.8
mm/hugetlb: fix folio is still mapped when deleted
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. remove_inode_single_folio will unmap the folio if the folio is still mapped. However, it's cal…
-
High 7.5
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to …
-
High 7.1
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However,…
-
Unscored —
mm/damon/sysfs: fix use-after-free in state_show()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. This allows a use-after-free race: CPU 0 CPU 1 ----- ----- state_sho…
-
Unscored —
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) ker…
-
Unscored —CVE-2025-39898 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() Patch series "mm/damon: avoid divide-by-zero in DAMON module's parameters application". DAMON's RECLAIM and LRU_SO…
-
Unscored —CVE-2025-39913 Public exploit
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_…
-
Unscored —
tracing: Silence warning when chunk allocation fails in trace_pid_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Silence warning when chunk allocation fails in trace_pid_write Syzkaller trigger a fault injection warning: WARNING: CPU: 1 PID: 12326 at tracepoint_add_func+0xbfc/0xeb0 Modules link…
-
Unscored —
mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() When creating a new scheme of DAMON_RECLAIM, the calculation of 'min_age_region' uses 'aggr_interval' as the divisor…
-
Unscored —
cgroup: split cgroup_destroy_wq into 3 workqueues
In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cgroup testing when repeatedly mounting/unmounting perf_event and net_prio controllers with systemd.unif…
-
Unscored —
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server…
-
Unscored —
nexthop: Forbid FDB status change while nexthop is in a group
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop…
-
Unscored —
tracing: dynevent: Add a missing lockdown check on dynevent
In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown sta…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39877.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39880.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39881.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39894.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39898.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39902.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39909.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39913.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39914.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39916.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39946.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39953.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39955.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39964.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39967.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39980.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40006.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40021.html