Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40186: In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). CVE-2025-40153: In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area CVE-2025-40134: In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() CVE-2025-40125: In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx CVE-2025-40123: In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility CVE-2025-40115: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() CVE-2025-40109: In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present CVE-2025-40081: In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() CVE-2025-40080: In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP CVE-2025-40078: In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr CVE-2025-40070: In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail CVE-2025-40068: In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() CVE-2025-40049: In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent CVE-2025-40048: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask CVE-2025-40044: In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling CVE-2025-40035: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak CVE-2025-40018: In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup CVE-2025-39998: In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.156-177.286 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.156-177.286.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.156-177.286.amzn2023 |
Vulnerabilities 18
-
High 8.4
fs: ntfs3: Fix integer overflow in run_unpack()
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physica…
-
High 8.1
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tc…
-
High 7.8
ipvs: Defer ip_vs_ftp unregister during netns cleanup
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leadin…
-
High 7.8
fs: udf: fix OOB read in lengthAllocDescs handling
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or…
-
High 7.8
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
-
High 7.8CVE-2025-40123 Public exploit
bpf: Enforce expected_attach_type for tailcall compatibility
In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function…
-
High 7.5
uio_hv_generic: Let userspace take care of interrupt mask
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled c…
-
High 7.1
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show f…
-
Unscored —
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, …
-
Unscored —
Squashfs: fix uninit-value in squashfs_get_parent
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle c…
-
Unscored —
pps: fix warning in pps_register_cdev when register device fail
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook …
-
Unscored —
bpf: Explicitly check accesses to bpf_sock_addr
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: e…
-
Unscored —
nbd: restrict sockets to TCP and UDP
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket…
-
Unscored —
crypto: rng - Ensure set_ent is always present
In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it.
-
Unscored —
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this …
-
Unscored —
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs cre…
-
Unscored —
dm: fix NULL pointer dereference in __dm_suspend()
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend …
-
Unscored —
mm: hugetlb: avoid soft lockup when mprotect to large memory area
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was ob…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39998.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40018.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40044.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40048.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40049.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40068.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40070.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40078.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40080.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40109.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40115.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40125.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40134.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40153.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40186.html