Skip to content
OpenAdvisories
High ALAS2023-2025-947 22 CVEs

Important: kernel security update (Amazon Linux 2023)

Published Apr 23, 2025 · Updated Jul 29, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38637: In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions CVE-2025-37785: In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir CVE-2025-23138: In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch CVE-2025-23136: In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev CVE-2025-22089: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace CVE-2025-22086: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow CVE-2025-22081: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems CVE-2025-22075: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported CVE-2025-22063: In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets CVE-2025-22058: In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. CVE-2025-22056: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition CVE-2025-22055: In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow CVE-2025-22045: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs CVE-2025-22044: In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl CVE-2025-22035: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching CVE-2025-22033: In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() CVE-2025-22027: In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback CVE-2025-22025: In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall CVE-2025-22021: In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT CVE-2025-21759: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() CVE-2024-58093: In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal CVE-2024-46753: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfs_dec_ref() properly

Fixed packages 22

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-debuginfo 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-aarch64 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-debuginfo-common-x86_64 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-devel 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-headers 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-libbpf 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-libbpf-debuginfo 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-libbpf-devel 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-libbpf-static 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.1.134-150.224 0:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-tools 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 kernel-tools-devel 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 perf 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 perf-debuginfo 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 python3-perf 0:6.1.134-150.224.amzn2023
Amazon Linux · 2023 python3-perf-debuginfo 0:6.1.134-150.224.amzn2023

Vulnerabilities 22

  • Critical 10.0
    CVE-2025-22021

    netfilter: socket: Lookup orig tuple for IPv6 SNAT

    In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the righ…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-22086

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21759

    ipv6: mcast: extend RCU protection in igmp6_send()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a pot…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-22035

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-22045

    x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-22056

    netfilter: nft_tunnel: fix geneve_opt type confusion addition

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-22081

    fs/ntfs3: Fix a couple integer overflows on 32bit systems

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-22089

    RDMA/core: Don't expose hw_counters outside of init net namespace

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37785

    ext4: fix OOB read when checking dotdot dir

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-22025

    nfsd: put dl_stid if fail to queue dl_recall

    In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-22044

    acpi: nfit: fix narrowing conversion in acpi_nfit_ctl

    In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the ar…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-22055

    net: fix geneve_opt length integer overflow

    In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all curre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22033

    arm64: Don't call NULL in do_compat_alignment_fixup()

    In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-22063

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

    In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-23136

    thermal: int340x: Add NULL check for adev

    In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.7
    CVE-2025-22027

    media: streamzap: fix race between device disconnection and urb callback

    In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-46753

    btrfs: handle errors from btrfs_dec_ref() properly

    In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfs_dec_ref() properly In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-58093

    PCI/ASPM: Fix link state exit during switch upstream function removal

    In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-22058

    udp: Fix memory accounting leak.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22075

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-23138

    watch_queue: fix pipe accounting mismatch

    In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, du…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38637

    net_sched: skbprio: Remove overly strict queue assertions

    In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-46753.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-58093.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21759.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22021.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22025.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22027.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22033.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22035.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22044.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22045.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22055.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22056.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22058.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22063.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22075.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22081.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22086.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22089.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-23136.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-23138.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-37785.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-38637.html