Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21948: In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle CVE-2025-21938: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr CVE-2025-21928: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() CVE-2025-21926: In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment CVE-2025-21920: In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type CVE-2025-21919: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list CVE-2025-21913: In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() CVE-2025-21796: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them CVE-2025-21791: In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() CVE-2025-21764: In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() CVE-2025-21763: In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() CVE-2025-21762: In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() CVE-2025-21761: In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() CVE-2025-21760: In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() CVE-2025-21758: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() CVE-2025-21756: In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction CVE-2025-21753: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction CVE-2025-21731: In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect CVE-2025-21727: In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder CVE-2025-21726: In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work CVE-2025-21701: In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops CVE-2025-21700: In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another CVE-2024-57979: In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free CVE-2024-56549: In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object->file CVE-2024-26982: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.131-143.221 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.131-143.221.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.131-143.221.amzn2023 |
Vulnerabilities 25
-
Critical 9.8
nfsd: clear acl_access/acl_default after releasing them
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…
-
High 8.1CVE-2025-21760 EPSS 38%
ndisc: extend RCU protection in ndisc_send_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potenti…
-
High 8.1
arp: use RCU protection in arp_xmit()
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 7.8
cachefiles: Fix NULL pointer dereference in object->file
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object->file At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and ob…
-
High 7.8
pps: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]----------…
-
High 7.8
net: sched: Disallow replacing of child qdisc from one parent to another
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1.…
-
High 7.8
net: avoid race between device unregistration and ethnl ops
In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN…
-
High 7.8
padata: avoid UAF for reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as bel…
-
High 7.8
padata: fix UAF in padata_reorder
In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…
-
High 7.8
nbd: don't allow reconnect after disconnect
In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial …
-
High 7.8
btrfs: fix use-after-free when attempting to join an aborted transaction
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs…
-
High 7.8CVE-2025-21756 Public exploit
vsock: Keep the binding until socket destruction
In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). …
-
High 7.8CVE-2025-21758 EPSS 17%
ipv6: mcast: add RCU protection to mld_newpack()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP…
-
High 7.8
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.
-
High 7.8
neighbour: use RCU protection in __neigh_notify()
In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 7.8
ndisc: use RCU protection in ndisc_alloc_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.
-
High 7.8
vrf: use RCU protection in l3mdev_l3_out()
In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…
-
High 7.8
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's l…
-
High 7.8
net: gso: fix ownership in __udp_gso_segment
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the origi…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handli…
-
High 7.5
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may en…
-
High 7.1
vlan: enforce underlying device type
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leak…
-
Medium 5.5
HID: appleir: Fix potential NULL dereference at raw event handle
In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read incl…
-
Unscored —
Squashfs: check the inode number is not the invalid value of zero
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…
-
Unscored —
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR fr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26982.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-56549.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57979.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21700.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21701.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21726.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21727.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21731.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21753.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21756.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21758.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21760.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21761.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21762.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21763.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21764.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21791.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21796.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21913.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21919.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21920.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21926.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21928.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21938.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21948.html