Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-39989: In the Linux kernel, the following vulnerability has been resolved: x86/mce: use is_copy_from_user() to determine copy-from-user context CVE-2025-39688: In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() CVE-2025-38637: In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions CVE-2025-37785: In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir CVE-2025-23138: In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch CVE-2025-23136: In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev CVE-2025-22091: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix page_size variable overflow CVE-2025-22090: In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() CVE-2025-22089: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace CVE-2025-22087: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto CVE-2025-22086: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow CVE-2025-22085: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name CVE-2025-22081: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems CVE-2025-22080: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() CVE-2025-22076: In the Linux kernel, the following vulnerability has been resolved: exfat: fix missing shutdown check CVE-2025-22075: In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported CVE-2025-22064: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't unregister hook when table is dormant CVE-2025-22063: In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets CVE-2025-22062: In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() CVE-2025-22059: In the Linux kernel, the following vulnerability has been resolved: udp: Fix multiple wraparounds of sk->sk_rmem_alloc. CVE-2025-22058: In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. CVE-2025-22057: In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release CVE-2025-22056: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition CVE-2025-22055: In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow CVE-2025-22047: In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value CVE-2025-22046: In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check CVE-2025-22045: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs CVE-2025-22044: In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl CVE-2025-22036: In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block CVE-2025-22035: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching CVE-2025-22034: In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs CVE-2025-22033: In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() CVE-2025-22030: In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() CVE-2025-22027: In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback CVE-2025-22025: In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall CVE-2025-22024: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports CVE-2025-21751: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect CVE-2024-58093: In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.23-29.97 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 0:6.12.23-29.97.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 0:6.12.23-29.97.amzn2023 |
Vulnerabilities 38
-
High 8.8
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…
-
High 8.4
fs/ntfs3: Prevent integer overflow in hdr_first_de()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both grea…
-
High 7.8
net/mlx5: HWS, change error flow on matcher disconnect
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and r…
-
High 7.8
mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs Patch series "mm: fixes for device-exclusive entries (hmm)", v2. Discussing the PageTail() call in make_device_exclusive_range() with Willy, I …
-
High 7.8
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can …
-
High 7.8
exfat: fix random stack corruption after get_block
In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may o…
-
High 7.8
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…
-
High 7.8
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is p…
-
High 7.8
netfilter: nft_tunnel: fix geneve_opt type confusion addition
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…
-
High 7.8
net: decrease cached dst counters in dst_release
In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_re…
-
High 7.8
sctp: add mutual exclusion in proc_sctp_do_udp_port()
In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fa…
-
High 7.8
fs/ntfs3: Fix a couple integer overflows on 32bit systems
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().
-
High 7.8
RDMA/core: Fix use-after-free when rename device name
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: ================================================================== B…
-
High 7.8
bpf: Fix array bounds error with may_goto
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. …
-
High 7.8
RDMA/core: Don't expose hw_counters outside of init net namespace
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …
-
High 7.8
ext4: fix OOB read when checking dotdot dir
In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…
-
High 7.5
nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…
-
High 7.5
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix multiple wraparounds of sk->sk_rmem_alloc. __udp_enqueue_schedule_skb() has the following condition: if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) goto drop; sk->sk_rcvbuf is …
-
High 7.5
nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then t…
-
High 7.3
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree…
-
High 7.1
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the ar…
-
High 7.1
net: fix geneve_opt length integer overflow
In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all curre…
-
Medium 5.5
nfsd: fix management of listener transports
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previousl…
-
Medium 5.5
arm64: Don't call NULL in do_compat_alignment_fixup()
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that…
-
Medium 5.5
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…
-
Medium 5.5
thermal: int340x: Add NULL check for adev
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for a…
-
Medium 4.7
media: streamzap: fix race between device disconnection and urb callback
In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused b…
-
Unscored —
PCI/ASPM: Fix link state exit during switch upstream function removal
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…
-
Unscored —
mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() …
-
Unscored —
uprobes/x86: Harden uretprobe syscall trampoline check
In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call int…
-
Unscored —
udp: Fix memory accounting leak.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…
-
Unscored —
netfilter: nf_tables: don't unregister hook when table is dormant
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't unregister hook when table is dormant When nf_tables_updchain encounters an error, hook registration needs to be rolled back. This should only be done if the hook …
-
Unscored —
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifin…
-
Unscored —
exfat: fix missing shutdown check
In the Linux kernel, the following vulnerability has been resolved: exfat: fix missing shutdown check xfstests generic/730 test failed because after deleting the device that still had dirty data, the file could still be read without returning an error. The re…
-
Unscored —
RDMA/mlx5: Fix page_size variable overflow
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix page_size variable overflow Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow. For example…
-
Unscored —
watch_queue: fix pipe accounting mismatch
In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, du…
-
Unscored —
net_sched: skbprio: Remove overly strict queue assertions
In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used…
-
Unscored —
x86/mce: use is_copy_from_user() to determine copy-from-user context
In the Linux kernel, the following vulnerability has been resolved: x86/mce: use is_copy_from_user() to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. ## 1. What am I trying to do: This patchset re…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58093.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21751.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22024.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22025.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22027.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22030.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22033.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22034.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22035.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22036.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22044.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22045.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22046.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22047.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22055.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22056.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22057.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22058.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22059.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22062.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22063.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22064.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22076.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22080.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22081.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22085.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22086.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22087.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22089.html