Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40220: In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers CVE-2025-40219: In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV CVE-2025-40218: In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success CVE-2025-40207: In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() CVE-2025-40206: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions CVE-2025-40205: In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() CVE-2025-40204: In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time CVE-2025-40203: In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore CVE-2025-40202: In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling CVE-2025-40201: In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths CVE-2025-40200: In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() CVE-2025-40199: In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches CVE-2025-40198: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() CVE-2025-40197: In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device CVE-2025-40196: In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work CVE-2025-40195: In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() CVE-2025-40194: In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() CVE-2025-40190: In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update CVE-2025-40187: In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() CVE-2025-40183: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} CVE-2025-40181: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP CVE-2025-40179: In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big CVE-2025-40178: In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns CVE-2025-40176: In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails CVE-2025-40173: In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth CVE-2025-40167: In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination CVE-2025-40160: In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs CVE-2025-40159: In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation CVE-2025-40133: In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). CVE-2025-40111: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation CVE-2025-40110: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper CVE-2025-40105: In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount CVE-2025-40104: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features CVE-2025-40103: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink CVE-2025-40101: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST CVE-2025-40100: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree CVE-2025-40099: In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input CVE-2025-40042: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference CVE-2025-40040: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise CVE-2025-40019: In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.55-74.119 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.55-74.119.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.55-74.119.amzn2023 |
Vulnerabilities 40
-
Critical 9.8
tls: wait for pending async decryptions if tls_strp_msg_hold fails
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we …
-
Critical 9.4
cifs: parse_dfs_referrals: prevent oob on malformed input
In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - rep…
-
High 8.1
mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not a…
-
High 8.1
sctp: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
High 7.8CVE-2025-40040 Public exploit
mm/ksm: fix flag-dropping behavior in ksm_madvise
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfa…
-
High 7.8
ixgbevf: fix mailbox API compatibility by negotiating supported features
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapter…
-
High 7.8
vfs: Don't leak disconnected dentries on umount
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory,…
-
High 7.8
drm/vmwgfx: Fix Use-after-free in validation
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are …
-
High 7.8
xsk: Harden userspace-supplied xdp_desc validation
In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or…
-
High 7.8
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a jour…
-
High 7.8
net/ip6_tunnel: Prevent perpetual tunnel growth
In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5a…
-
High 7.8
ext4: guard against EA inode refcount underflow in xattr update
In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref…
-
High 7.8
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden pa…
-
High 7.8
page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of th…
-
High 7.8
kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_p…
-
High 7.8
ipmi: Rework user message limit handling
In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all don…
-
High 7.8
listmount: don't call path_put() under namespace semaphore
In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
-
High 7.8
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the …
-
High 7.8
netfilter: nft_objref: validate objref and objrefmap expressions
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack g…
-
High 7.5
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT …
-
High 7.5
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then …
-
Unscored —CVE-2025-40019 Public exploit
crypto: essiv - Check ssize for decryption and in-place encryption
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
-
Unscored —
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and…
-
Unscored —
btrfs: do not assert we found block group item when creating free space tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree…
-
Unscored —
btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is…
-
Unscored —
smb: client: Fix refcount leak for cifs_sb_tlink
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be cal…
-
Unscored —
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows …
-
Unscored —
xen/events: Return -EEXIST for bound VIRQs
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_t…
-
Unscored —
pid: Add a judgment for ns null in pid_nr_ns
In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) …
-
Unscored —
ext4: verify orphan file size is not too big
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus …
-
Unscored —
x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM a…
-
Unscored —
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_q…
-
Unscored —
mount: handle NULL values in mnt_ns_release()
In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. Handle that case gracefully.
-
Unscored —
fs: quota: create dedicated workqueue for quota_release_work
In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set. This issue occurs when writeback is triggered due to sync call…
-
Unscored —
media: mc: Clear minor number before put device
In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released.
-
Unscored —
Squashfs: reject negative file sizes in squashfs_read_inode()
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs…
-
Unscored —
media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check th…
-
Unscored —
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address space operation set implementation (vaddr) calls pte_offset_map_lock() inside the page table walk cal…
-
Unscored —
PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF re…
-
Unscored —
fuse: fix livelock in synchronous file put from fuseblk workers
In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to t…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40019.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40040.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40042.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40099.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40100.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40101.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40104.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40105.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40110.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40133.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40159.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40160.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40167.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40173.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40176.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40178.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40181.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40183.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40187.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40190.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40194.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40195.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40196.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40199.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40200.html