Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40364: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers CVE-2025-21832: In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED CVE-2025-21826: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length CVE-2025-21814: In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set CVE-2025-21806: In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero CVE-2025-21795: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback CVE-2025-21790: In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value CVE-2025-21787: In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation CVE-2025-21785: In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array CVE-2025-21779: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel CVE-2025-21776: In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces CVE-2025-21767: In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context CVE-2025-21766: In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() CVE-2025-21765: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() CVE-2025-21745: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage CVE-2025-21738: In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer CVE-2025-21728: In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible CVE-2025-21725: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed CVE-2025-21724: In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() CVE-2025-21719: In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries CVE-2025-21716: In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() CVE-2025-21707: In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status CVE-2025-21706: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp CVE-2025-21705: In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly CVE-2025-21704: In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access CVE-2025-21703: In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() CVE-2024-58083: In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() CVE-2024-58071: In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower CVE-2024-58020: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured CVE-2024-58017: In the Linux kernel, the following vulnerability has been resolved: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX CVE-2024-58016: In the Linux kernel, the following vulnerability has been resolved: safesetid: check size of policy writes CVE-2024-57996: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit CVE-2024-57993: In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check CVE-2024-57986: In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections CVE-2024-57981: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts CVE-2024-53166: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() CVE-2024-40945: In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device()
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.129-138.220 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.129-138.220.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.129-138.220.amzn2023 |
Vulnerabilities 37
-
Critical 9.8
mptcp: consolidate suboption status
In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional …
-
High 8.1
ipv6: use RCU protection in ip6_default_advmss()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.
-
High 8.1
ipv4: use RCU protection in __ip_rt_update_pmtu()
In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.
-
High 7.8
block, bfq: fix bfqq uaf in bfq_limit_depth()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from …
-
High 7.8
net_sched: sch_sfq: don't allow 1 packet limit
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel …
-
High 7.8
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the no…
-
High 7.8
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of th…
-
High 7.8
ata: libata-sff: Ensure that we cannot write outside the allocated buffer
In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PA…
-
High 7.8
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache le…
-
High 7.8
netfilter: nf_tables: reject mismatching sum of field_len with set key length
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field get…
-
High 7.8
block: don't revert iter for -EIOCBQUEUED
In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (…
-
High 7.8
io_uring: fix io_req_prep_async with provided buffers
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed.
-
High 7.5
smb: client: fix oops due to unset link speed
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always be set by the server, so the client must handle any values and then preven…
-
High 7.5
NFSD: fix hang in nfsd4_shutdown_callback
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is …
-
High 7.1
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated w…
-
High 7.1
ipmr: do not call mr_mfc_uses_dev() for unres entries
In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias …
-
Medium 5.5
team: prevent adding a device which is already a team device lower
In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lo…
-
Medium 5.5
vxlan: Fix uninit-value in vxlan_vnifilter_dump()
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1]. If the length of the netlink message payload is less than sizeof(struct …
-
Medium 5.5
vxlan: check vxlan_vnigroup_init() return value
In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot. Oops: general protection fault, proba…
-
Unscored —
iommu: Return right value in iommu_sva_bind_device()
In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only …
-
Unscored —
usb: xhci: Fix NULL pointer dereference on certain command aborts
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB …
-
Unscored —
HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-…
-
Unscored —
safesetid: check size of policy writes
In the Linux kernel, the following vulnerability has been resolved: safesetid: check size of policy writes syzbot attempts to write a buffer with a large size to a sysfs entry with writes handled by handle_policy_update(), triggering a warning in kmalloc. Che…
-
Unscored —
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
In the Linux kernel, the following vulnerability has been resolved: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which leads to undefined behavior. To prevent this, cast 1 t…
-
Unscored —
HID: multitouch: Add NULL check in mt_input_configured
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in…
-
Unscored —
usb: cdc-acm: Check control transfer buffer size before access
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…
-
Unscored —
mptcp: handle fastopen disconnect correctly
In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly Syzbot was able to trigger a data stream corruption: WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp…
-
Unscored —
mptcp: pm: only set fullmesh for subflow endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 's…
-
Unscored —
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of ty…
-
Unscored —
bpf: Send signals asynchronously if !preemptible
In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it…
-
Unscored —
blk-cgroup: Fix class @block_class's subsystem refcount leakage
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with…
-
Unscored —
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid c…
-
Unscored —
USB: hub: Ignore non-compliant devices with too many configs or interfaces
In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate …
-
Unscored —
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtu…
-
Unscored —
team: better TEAM_OPTION_TYPE_STRING validation
In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make sure user-provided data contains one nul byte. [1] BUG: KMSAN: uninit-value in string_nocheck lib/vspr…
-
Unscored —
net: let net.core.dev_weight always be non-zero
In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exce…
-
Unscored —
ptp: Ensure info->enable callback is always set
In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences.…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-40945.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53166.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57981.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57986.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57993.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57996.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58016.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58017.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58020.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58071.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21703.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21704.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21705.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21706.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21716.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21719.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21724.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21725.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21728.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21738.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21745.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21765.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21766.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21767.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21776.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21779.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21785.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21787.html