Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40346: In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() CVE-2025-40240: In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing CVE-2025-40231: In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() CVE-2025-40220: In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers CVE-2025-40219: In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV CVE-2025-40207: In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() CVE-2025-40205: In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() CVE-2025-40204: In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time CVE-2025-40201: In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths CVE-2025-40200: In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() CVE-2025-40198: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() CVE-2025-40197: In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device CVE-2025-40194: In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() CVE-2025-40190: In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update CVE-2025-40187: In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() CVE-2025-40183: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} CVE-2025-40179: In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big CVE-2025-40178: In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns CVE-2025-40176: In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails CVE-2025-40173: In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth CVE-2025-40167: In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination CVE-2025-40111: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation CVE-2025-40105: In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount CVE-2025-40104: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features CVE-2025-40103: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink CVE-2025-40100: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree CVE-2025-40099: In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input CVE-2025-40042: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference CVE-2025-40040: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise CVE-2025-40019: In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.158-178.288 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.158-178.288.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.158-178.288.amzn2023 |
Vulnerabilities 30
-
Critical 9.8
tls: wait for pending async decryptions if tls_strp_msg_hold fails
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we …
-
Critical 9.4
cifs: parse_dfs_referrals: prevent oob on malformed input
In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - rep…
-
High 8.1
sctp: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
High 7.8CVE-2025-40040 Public exploit
mm/ksm: fix flag-dropping behavior in ksm_madvise
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfa…
-
High 7.8
ixgbevf: fix mailbox API compatibility by negotiating supported features
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapter…
-
High 7.8
vfs: Don't leak disconnected dentries on umount
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory,…
-
High 7.8
drm/vmwgfx: Fix Use-after-free in validation
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are …
-
High 7.8
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a jour…
-
High 7.8
net/ip6_tunnel: Prevent perpetual tunnel growth
In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5a…
-
High 7.8
ext4: guard against EA inode refcount underflow in xattr update
In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref…
-
High 7.8
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden pa…
-
High 7.8
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_p…
-
High 7.8
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the …
-
High 7.5
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT …
-
High 7.5
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then …
-
High 7.5
sctp: avoid NULL dereference when chunk data buffer is missing
In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->he…
-
Unscored —CVE-2025-40019 Public exploit
crypto: essiv - Check ssize for decryption and in-place encryption
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
-
Unscored —
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and…
-
Unscored —
btrfs: do not assert we found block group item when creating free space tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree…
-
Unscored —
smb: client: Fix refcount leak for cifs_sb_tlink
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be cal…
-
Unscored —
pid: Add a judgment for ns null in pid_nr_ns
In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) …
-
Unscored —
ext4: verify orphan file size is not too big
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus …
-
Unscored —
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_q…
-
Unscored —
media: mc: Clear minor number before put device
In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released.
-
Unscored —
Squashfs: reject negative file sizes in squashfs_read_inode()
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs…
-
Unscored —
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check th…
-
Unscored —
PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF re…
-
Unscored —
fuse: fix livelock in synchronous file put from fuseblk workers
In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to t…
-
Unscored —
vsock: fix lock inversion in vsock_assign_transport()
In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The …
-
Unscored —
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL cl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40019.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40040.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40042.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40099.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40100.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40104.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40105.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40167.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40173.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40178.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40187.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40190.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40200.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40201.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40204.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40205.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40207.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40219.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40220.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40231.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40240.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40346.html