Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21899: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list CVE-2025-21898: In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() CVE-2025-21891: In the Linux kernel, the following vulnerability has been resolved: ipvlan: ensure network headers are in skb linear part CVE-2025-21887: In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up CVE-2025-21881: In the Linux kernel, the following vulnerability has been resolved: uprobes: Reject the shared zeropage in uprobe_write_opcode() CVE-2025-21875: In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock CVE-2025-21867: In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() CVE-2025-21864: In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst CVE-2025-21858: In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). CVE-2025-21846: In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue CVE-2025-21844: In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() CVE-2025-21712: In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime CVE-2025-21702: In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 CVE-2024-58090: In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled CVE-2024-58005: In the Linux kernel, the following vulnerability has been resolved: tpm: Change to kvalloc() in eventlog/acpi.c CVE-2024-57977: In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process CVE-2024-53179: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key CVE-2023-52927: In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.130-139.222 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.130-139.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.130-139.222.amzn2023 |
Vulnerabilities 18
-
Critical 9.8
smb: client: fix use-after-free of signing key
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B ci…
-
High 7.8CVE-2023-52927 Public exploit
netfilter: allow exp not to be removed in nf_ct_find_expectation
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenari…
-
High 7.8
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease sche…
-
High 7.8
md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct md_bitmap_stats"), following panic is reported: Oops: g…
-
High 7.8
geneve: Fix use-after-free in geneve_find_dev().
In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…
-
High 7.8
tcp: drop secpath at the same time as we currently drop dst
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a b…
-
High 7.8
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…
-
High 7.8
mptcp: always handle address removal under msk socket lock
In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkaller reported a lockdep splat in the PM control path: WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sock_owned_by_me i…
-
High 7.8
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…
-
High 7.8
tracing: Fix bad hist from corrupting named_triggers list
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax…
-
High 7.5
smb: client: Add check for next_buffer in receive_encrypted_standard()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…
-
Medium 5.5
acct: perform last write from workqueue
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…
-
Medium 5.5
ipvlan: ensure network headers are in skb linear part
In the Linux kernel, the following vulnerability has been resolved: ipvlan: ensure network headers are in skb linear part syzbot found that ipvlan_process_v6_outbound() was assuming the IPv6 network header isis present in skb->head [1] Add the needed pskb_net…
-
Medium 5.5
ftrace: Avoid potential division by zero in function_stat_show()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case…
-
Unscored —
memcg: fix soft lockup in the OOM process
In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggere…
-
Unscored —
tpm: Change to kvalloc() in eventlog/acpi.c
In the Linux kernel, the following vulnerability has been resolved: tpm: Change to kvalloc() in eventlog/acpi.c The following failure was reported on HPE ProLiant D320: [ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0) [ 10.848132][ T1] …
-
Unscored —
sched/core: Prevent rescheduling when interrupts are disabled
In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU:…
-
Unscored —
uprobes: Reject the shared zeropage in uprobe_write_opcode()
In the Linux kernel, the following vulnerability has been resolved: uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-52927.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53179.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57977.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58005.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58090.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21702.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21712.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21844.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21858.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21867.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21875.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21881.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21887.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21891.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21898.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21899.html