Amazon Linux 2023 Security Advisory: ALAS2023-2025-1144
Advisory Released Date: 2025-08-08
Advisory Updated Date: 2025-10-02
FAQs regarding Amazon Linux ALAS/CVE Severity
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix race condition in AF_XDP generic RX path (CVE-2025-37920)
In the Linux kernel, the following vulnerability has been resolved:
virtio: break and reset virtio devices on device_shutdown() (CVE-2025-38064)
In the Linux kernel, the following vulnerability has been resolved:
rseq: Fix segfault on registration when rseq_cs is non-zero (CVE-2025-38067)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential deadlock when reconnecting channels (CVE-2025-38244)
In the Linux kernel, the following vulnerability has been resolved:
bridge: mcast: Fix use-after-free during router port configuration (CVE-2025-38248)
In the Linux kernel, the following vulnerability has been resolved:
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() (CVE-2025-38364)
In the Linux kernel, the following vulnerability has been resolved:
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
In the Linux kernel, the following vulnerability has been resolved:
nbd: fix uaf in nbd_genl_connect() error path (CVE-2025-38443)
In the Linux kernel, the following vulnerability has been resolved:
raid10: cleanup memleak at raid10_make_request (CVE-2025-38444)
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: Fix stack memory use after return in raid1_reshape (CVE-2025-38445)
In the Linux kernel, the following vulnerability has been resolved:
md/md-bitmap: fix GPF in bitmap_get_stats() (CVE-2025-38451)
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (CVE-2025-38455)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Abort __tc_modify_qdisc if parent class does not exist (CVE-2025-38457)
In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix transport_* TOCTOU (CVE-2025-38461)
In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462)
In the Linux kernel, the following vulnerability has been resolved:
netlink: Fix wraparounds of sk->sk_rmem_alloc. (CVE-2025-38465)
In the Linux kernel, the following vulnerability has been resolved:
perf: Revert to requiring CAP_SYS_ADMIN for uprobes (CVE-2025-38466)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468)
In the Linux kernel, the following vulnerability has been resolved:
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
In the Linux kernel, the following vulnerability has been resolved:
tls: always refresh the queue when reading sock (CVE-2025-38471)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
In the Linux kernel, the following vulnerability has been resolved:
rpl: Fix use-after-free in rpl_do_srh_inline(). (CVE-2025-38476)
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in crypt_message when using async crypto (CVE-2025-38488)
In the Linux kernel, the following vulnerability has been resolved:
HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)
In the Linux kernel, the following vulnerability has been resolved:
HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)
In the Linux kernel, the following vulnerability has been resolved:
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix assertion when building free space tree (CVE-2025-38503)
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject %p% format string in bprintf-like helpers (CVE-2025-38528)
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add down_write(trace_event_sem) when adding trace event (CVE-2025-38539)
In the Linux kernel, the following vulnerability has been resolved:
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (CVE-2025-38540)
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)
Affected Packages:
kernel
Issue Correction:
Run dnf update kernel --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1144 --releasever 2023.8.20250808 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
System reboot is required in order to complete this update.
aarch64:
kernel-libbpf-6.1.147-172.266.amzn2023.aarch64
kernel-modules-extra-common-6.1.147-172.266.amzn2023.aarch64
python3-perf-6.1.147-172.266.amzn2023.aarch64
perf-debuginfo-6.1.147-172.266.amzn2023.aarch64
kernel-libbpf-debuginfo-6.1.147-172.266.amzn2023.aarch64
kernel-tools-devel-6.1.147-172.266.amzn2023.aarch64
python3-perf-debuginfo-6.1.147-172.266.amzn2023.aarch64
kernel-libbpf-static-6.1.147-172.266.amzn2023.aarch64
kernel-livepatch-6.1.147-172.266-1.0-0.amzn2023.aarch64
bpftool-debuginfo-6.1.147-172.266.amzn2023.aarch64
bpftool-6.1.147-172.266.amzn2023.aarch64
kernel-tools-debuginfo-6.1.147-172.266.amzn2023.aarch64
perf-6.1.147-172.266.amzn2023.aarch64
kernel-libbpf-devel-6.1.147-172.266.amzn2023.aarch64
kernel-modules-extra-6.1.147-172.266.amzn2023.aarch64
kernel-tools-6.1.147-172.266.amzn2023.aarch64
kernel-debuginfo-6.1.147-172.266.amzn2023.aarch64
kernel-6.1.147-172.266.amzn2023.aarch64
kernel-headers-6.1.147-172.266.amzn2023.aarch64
kernel-debuginfo-common-aarch64-6.1.147-172.266.amzn2023.aarch64
kernel-devel-6.1.147-172.266.amzn2023.aarch64
src:
kernel-6.1.147-172.266.amzn2023.src
x86_64:
python3-perf-debuginfo-6.1.147-172.266.amzn2023.x86_64
kernel-tools-6.1.147-172.266.amzn2023.x86_64
kernel-modules-extra-common-6.1.147-172.266.amzn2023.x86_64
perf-6.1.147-172.266.amzn2023.x86_64
kernel-libbpf-6.1.147-172.266.amzn2023.x86_64
kernel-libbpf-devel-6.1.147-172.266.amzn2023.x86_64
kernel-tools-devel-6.1.147-172.266.amzn2023.x86_64
bpftool-6.1.147-172.266.amzn2023.x86_64
kernel-livepatch-6.1.147-172.266-1.0-0.amzn2023.x86_64
perf-debuginfo-6.1.147-172.266.amzn2023.x86_64
bpftool-debuginfo-6.1.147-172.266.amzn2023.x86_64
kernel-headers-6.1.147-172.266.amzn2023.x86_64
kernel-libbpf-static-6.1.147-172.266.amzn2023.x86_64
kernel-tools-debuginfo-6.1.147-172.266.amzn2023.x86_64
python3-perf-6.1.147-172.266.amzn2023.x86_64
kernel-libbpf-debuginfo-6.1.147-172.266.amzn2023.x86_64
kernel-modules-extra-6.1.147-172.266.amzn2023.x86_64
kernel-debuginfo-6.1.147-172.266.amzn2023.x86_64
kernel-6.1.147-172.266.amzn2023.x86_64
kernel-debuginfo-common-x86_64-6.1.147-172.266.amzn2023.x86_64
kernel-devel-6.1.147-172.266.amzn2023.x86_64
2025-10-02: CVE-2025-38468 was added to this advisory.
2025-10-02: CVE-2025-38476 was added to this advisory.
2025-10-02: CVE-2025-38451 was added to this advisory.
2025-10-02: CVE-2025-38364 was added to this advisory.
2025-10-02: CVE-2025-38539 was added to this advisory.
2025-10-02: CVE-2025-38465 was added to this advisory.
2025-10-02: CVE-2025-38528 was added to this advisory.
2025-10-02: CVE-2025-38443 was added to this advisory.
2025-10-02: CVE-2025-38540 was added to this advisory.
2025-10-02: CVE-2025-38444 was added to this advisory.
2025-10-02: CVE-2025-38441 was added to this advisory.
2025-10-02: CVE-2025-38503 was added to this advisory.
2025-10-02: CVE-2025-38455 was added to this advisory.
2025-10-02: CVE-2025-38470 was added to this advisory.
2025-09-10: CVE-2025-38495 was added to this advisory.
2025-09-10: CVE-2025-38488 was added to this advisory.
2025-09-10: CVE-2025-38445 was added to this advisory.
2025-09-10: CVE-2025-38466 was added to this advisory.
2025-09-10: CVE-2025-38477 was added to this advisory.
2025-09-10: CVE-2025-38472 was added to this advisory.
2025-09-10: CVE-2025-38527 was added to this advisory.
2025-09-10: CVE-2025-38461 was added to this advisory.
2025-09-10: CVE-2025-38550 was added to this advisory.
2025-09-10: CVE-2025-38462 was added to this advisory.
2025-09-10: CVE-2025-38457 was added to this advisory.
2025-09-10: CVE-2025-38471 was added to this advisory.
2025-09-10: CVE-2025-38499 was added to this advisory.
2025-09-10: CVE-2025-38494 was added to this advisory.
2025-08-26: CVE-2025-38396 was added to this advisory.
2025-08-26: CVE-2025-38244 was added to this advisory.
2025-08-26: CVE-2025-38248 was added to this advisory.