Skip to content
OpenAdvisories
Medium ALAS2023-2025-984 7 CVEs

Moderate: kernel6.12 security update (Amazon Linux 2023)

Published May 21, 2025 · Updated Jun 2, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22108: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly CVE-2025-21884: In the Linux kernel, the following vulnerability has been resolved: net: better track kernel sockets lifetime CVE-2025-21833: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE CVE-2025-21817: In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() CVE-2025-21807: In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods CVE-2025-21709: In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about dup_mmap() failures and uprobe registering CVE-2024-57976: In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cow_file_range() failed

Fixed packages 22

ReleasePackageFixed in
Amazon Linux · 2023 bpftool 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 bpftool-debuginfo 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-devel 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-headers 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-libbpf 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-libbpf-debuginfo 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-libbpf-devel 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-libbpf-static 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-livepatch-6.12.29-33.102 0:1.0-0.amzn2023
Amazon Linux · 2023 kernel-modules-extra-common 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-tools 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-tools-debuginfo 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel-tools-devel 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel6.12 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel6.12-debuginfo 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel6.12-debuginfo-common-aarch64 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel6.12-debuginfo-common-x86_64 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 kernel6.12-modules-extra 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 perf6.12 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 perf6.12-debuginfo 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 python3-perf6.12 0:6.12.29-33.102.amzn2023
Amazon Linux · 2023 python3-perf6.12-debuginfo 0:6.12.29-33.102.amzn2023

Vulnerabilities 7

  • High 8.6
    CVE-2025-22108

    bnxt_en: Mask the bd_cnt field in the TX BD properly

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-57976

    btrfs: do proper folio cleanup when cow_file_range() failed

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cow_file_range() failed [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not resu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21709

    kernel: be more careful about dup_mmap() failures and uprobe registering

    In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about dup_mmap() failures and uprobe registering If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21884

    net: better track kernel sockets lifetime

    In the Linux kernel, the following vulnerability has been resolved: net: better track kernel sockets lifetime While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device qu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21833

    iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unlikely situation when domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless happens we…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-21807

    block: fix queue freeze vs limits lock order in sysfs store methods

    In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods queue_attr_store() always freezes a device queue before calling the attribute store operation. For attributes that control …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-21817

    block: mark GFP_NOIO around sysfs ->store()

    In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory wit…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-57976.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21709.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21807.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21817.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21833.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21884.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22108.html