Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21694: In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) CVE-2025-21683: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak CVE-2025-21681: In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier CVE-2025-21678: In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. CVE-2025-21675: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create CVE-2025-21671: In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table CVE-2025-21669: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes CVE-2025-21666: In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] CVE-2025-21665: In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits CVE-2025-21664: In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function CVE-2025-21662: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns CVE-2025-21655: In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period CVE-2025-21653: In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute CVE-2025-21648: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX CVE-2025-21647: In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts CVE-2025-21640: In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy CVE-2025-21639: In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy CVE-2025-21638: In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy CVE-2025-21637: In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy CVE-2025-21636: In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy CVE-2025-21631: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() CVE-2024-57951: In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug CVE-2024-57949: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() CVE-2024-57940: In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() CVE-2024-57929: In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end CVE-2024-57917: In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap CVE-2024-56664: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() CVE-2024-56631: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() CVE-2024-53685: In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX CVE-2024-53170: In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags CVE-2024-53128: In the Linux kernel, the following vulnerability has been resolved: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers CVE-2024-53124: In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc CVE-2024-50246: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add rough attr alloc_size check CVE-2024-50164: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning CVE-2024-36899: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.127-135.201 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.127-135.201.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.127-135.201.amzn2023 |
Vulnerabilities 35
-
High 7.8
bpf: Fix overloading of MEM_UNINIT's meaning
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an issue in the BPF verifier where check_mem_size_reg() has the following code: if (!tnum_is_const(reg->var_off)) /* For unprivile…
-
High 7.8
fs/ntfs3: Add rough attr alloc_size check
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add rough attr alloc_size check
-
High 7.8
block: fix uaf for flush rq while iterating tags
In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags blk_mq_clear_flush_rq_mapping() is not called during scsi probe, by checking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is cleared i…
-
High 7.8
scsi: sg: Fix slab-use-after-free read in sg_release()
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 ker…
-
High 7.8
bpf, sockmap: Fix race between element replace and close()
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_de…
-
High 7.8
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving…
-
High 7.8
hrtimers: Handle CPU state correctly on hotplug
In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back …
-
High 7.8
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…
-
High 7.8
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eve…
-
High 7.8
dm thin: make get_first_thin use rcu-safe list first function
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty(…
-
High 7.8
vsock/virtio: discard packets if the transport changes
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected …
-
High 7.8
zram: fix potential UAF of zram table
In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table …
-
High 7.8
gtp: Destroy device along with udp socket's netns dismantle.
In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created. Even when src_n…
-
High 7.5
net: fix data-races around sk->sk_forward_alloc
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c…
-
High 7.3
sched: sch_cake: add bounds checks to host bulk flow fairness counts
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…
-
High 7.1
sctp: sysctl: udp_port: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inco…
-
High 7.1
sctp: sysctl: auth_enable: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
High 7.1
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:…
-
Medium 5.5
irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irq_set_vcpu_affinity(…
-
Medium 5.5
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different r…
-
Medium 5.5
sctp: sysctl: rto_min/max: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
Medium 5.5
filemap: avoid truncating 64-bit offset to 32 bits
In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_data() was inadvertently truncating a 64-bit value to 32 bits, leading to a possible infinite loop when w…
-
Medium 5.5
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see …
-
Medium 5.5
net/mlx5: Clear port select structure when fail to create
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure on error so no stale values left after definers are destroyed. That's because the mlx5_lag_destroy_de…
-
Medium 5.5
bpf: Fix bpf_sk_select_reuseport() memory leak
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_…
-
Medium 5.5
fs/proc: fix softlockup in __read_vmcore (part 2)
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone dow…
-
Unscored —
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…
-
Unscored —
sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
In the Linux kernel, the following vulnerability has been resolved: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect resu…
-
Unscored —
ceph: give up on paths longer than PATH_MAX
In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, e…
-
Unscored —
topology: Keep the cpumask unchanged when printing cpumap
In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values (15 and 11) from vsnprintf("%*pbl ", ...) test:key…
-
Unscored —
exfat: fix the infinite loop in exfat_readdir()
In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the clust…
-
Unscored —
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…
-
Unscored —
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSA…
-
Unscored —
net/mlx5: Fix variable not being completed when function returns
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task whi…
-
Unscored —
openvswitch: fix lockup on tx to unregistering netdev with carrier
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queu…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36899.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-50164.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-50246.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53170.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53685.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-56631.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-56664.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57917.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57929.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57940.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57949.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57951.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21631.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21636.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21637.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21638.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21639.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21640.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21647.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21648.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21653.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21655.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21662.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21664.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21665.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21666.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21669.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21671.html