# ALAS2023-2025-1208: Security update for 22 packages ALAS2023-2025-1208, released September 23, 2025, fixes 122 CVEs across 22 products. One of them is being exploited (CVE-2025-39682); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-1208 - Platform: Linux - Released: Sep 23, 2025 - Priority: Patch now (Closes CVE-2025-39682, exploited (CISA KEV)) - CVEs: 122, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-1208.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel-livepatch-6.12.46-66.121](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.46-66.121.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-libbpf](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-libbpf-static](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-static.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-39682](https://patchblox.com/security/data/cve/CVE-2025-39682.md) | Patch now | tls: fix handling of zero-length records on the rx_list | 9.8 | 0.0331 | CISA KEV | | [CVE-2025-39898](https://patchblox.com/security/data/cve/CVE-2025-39898.md) | Urgent | e1000e: fix heap overflow in e1000_set_eeprom | 9.8 | n/a | | | [CVE-2025-38566](https://patchblox.com/security/data/cve/CVE-2025-38566.md) | High | sunrpc: fix handling of server side tls alerts | 8.1 | 0.0067 | | | [CVE-2025-39702](https://patchblox.com/security/data/cve/CVE-2025-39702.md) | High | ipv6: sr: Fix MAC comparison to be constant-time | 7.1 | 0.0045 | | | [CVE-2025-38563](https://patchblox.com/security/data/cve/CVE-2025-38563.md) | High | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0044 | | | [CVE-2025-38608](https://patchblox.com/security/data/cve/CVE-2025-38608.md) | High | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0044 | | | [CVE-2025-38590](https://patchblox.com/security/data/cve/CVE-2025-38590.md) | High | net/mlx5e: Remove skb secpath if xfrm state is not found | 7.5 | 0.0044 | | | [CVE-2025-38676](https://patchblox.com/security/data/cve/CVE-2025-38676.md) | High | iommu/amd: Avoid stack buffer overflow from kernel cmdline | 7.8 | 0.0042 | | | [CVE-2025-38617](https://patchblox.com/security/data/cve/CVE-2025-38617.md) | High | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0041 | | | [CVE-2025-38724](https://patchblox.com/security/data/cve/CVE-2025-38724.md) | High | nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() | 7.8 | 0.0041 | | | [CVE-2025-38660](https://patchblox.com/security/data/cve/CVE-2025-38660.md) | High | [ceph] parse_longname(): strrchr() expects NUL-terminated string | 7.1 | 0.0041 | | | [CVE-2025-39851](https://patchblox.com/security/data/cve/CVE-2025-39851.md) | High | vxlan: Fix NPD when refreshing an FDB entry with a nexthop object | 7.0 | 0.0040 | | | [CVE-2025-38708](https://patchblox.com/security/data/cve/CVE-2025-38708.md) | High | drbd: add missing kref_get in handle_write_conflicts | 7.8 | 0.0040 | | | [CVE-2025-38737](https://patchblox.com/security/data/cve/CVE-2025-38737.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix... | 7.8 | 0.0039 | | | [CVE-2025-38571](https://patchblox.com/security/data/cve/CVE-2025-38571.md) | High | sunrpc: fix client side handling of tls alerts | 8.1 | 0.0037 | | | [CVE-2025-38728](https://patchblox.com/security/data/cve/CVE-2025-38728.md) | High | smb3: fix for slab out of bounds on mount to ksmbd | 7.1 | 0.0036 | | | [CVE-2025-39894](https://patchblox.com/security/data/cve/CVE-2025-39894.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed... | 7.0 | 0.0033 | | | [CVE-2025-39866](https://patchblox.com/security/data/cve/CVE-2025-39866.md) | High | fs: writeback: fix use-after-free in __mark_inode_dirty() | 7.8 | 0.0031 | | | [CVE-2025-39798](https://patchblox.com/security/data/cve/CVE-2025-39798.md) | High | NFS: Fix the setting of capabilities when automounting a new filesystem | 7.0 | 0.0028 | | | [CVE-2025-22113](https://patchblox.com/security/data/cve/CVE-2025-22113.md) | High | ext4: avoid journaling sb update on error if journal is destroying | 7.8 | 0.0026 | | | [CVE-2025-39723](https://patchblox.com/security/data/cve/CVE-2025-39723.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If a... | 7.8 | 0.0024 | | | [CVE-2025-39806](https://patchblox.com/security/data/cve/CVE-2025-39806.md) | High | kernel-64k-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: H... | 7.8 | 0.0024 | | | [CVE-2025-39677](https://patchblox.com/security/data/cve/CVE-2025-39677.md) | High | net/sched: Fix backlog accounting in qdisc_dequeue_internal | 7.0 | 0.0021 | | | [CVE-2025-38616](https://patchblox.com/security/data/cve/CVE-2025-38616.md) | High | tls: handle data disappearing from under the TLS ULP | 7.1 | 0.0021 | | | [CVE-2025-39730](https://patchblox.com/security/data/cve/CVE-2025-39730.md) | High | NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() | 7.8 | 0.0021 | | | [CVE-2025-38565](https://patchblox.com/security/data/cve/CVE-2025-38565.md) | High | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0020 | | | [CVE-2025-38572](https://patchblox.com/security/data/cve/CVE-2025-38572.md) | High | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0020 | | | [CVE-2025-39698](https://patchblox.com/security/data/cve/CVE-2025-39698.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n... | 7.5 | 0.0020 | | | [CVE-2025-38702](https://patchblox.com/security/data/cve/CVE-2025-38702.md) | High | fbdev: fix potential buffer overflow in do_register_framebuffer() | 7.8 | 0.0020 | | | [CVE-2025-39850](https://patchblox.com/security/data/cve/CVE-2025-39850.md) | High | vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects | 7.0 | 0.0020 | | | [CVE-2025-38614](https://patchblox.com/security/data/cve/CVE-2025-38614.md) | High | eventpoll: Fix semi-unbounded recursion | 7.5 | 0.0020 | | | [CVE-2025-38615](https://patchblox.com/security/data/cve/CVE-2025-38615.md) | High | fs/ntfs3: cancle set bad inode after removing name fails | 9.8 | 0.0019 | | | [CVE-2025-39691](https://patchblox.com/security/data/cve/CVE-2025-39691.md) | High | fs/buffer: fix use-after-free when call bh_read() helper | 7.8 | 0.0019 | | | [CVE-2025-39689](https://patchblox.com/security/data/cve/CVE-2025-39689.md) | High | ftrace: Also allocate and copy hash for reading of filter files | 7.8 | 0.0019 | | | [CVE-2025-39683](https://patchblox.com/security/data/cve/CVE-2025-39683.md) | High | tracing: Limit access to parser->buffer when trace_get_user failed | 7.1 | 0.0019 | | | [CVE-2025-38701](https://patchblox.com/security/data/cve/CVE-2025-38701.md) | High | ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | 7.0 | 0.0019 | | | [CVE-2025-38704](https://patchblox.com/security/data/cve/CVE-2025-38704.md) | High | rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access | 7.8 | 0.0019 | | | [CVE-2025-38453](https://patchblox.com/security/data/cve/CVE-2025-38453.md) | High | kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0019 | | | [CVE-2025-38568](https://patchblox.com/security/data/cve/CVE-2025-38568.md) | High | net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing | 7.8 | 0.0019 | | | [CVE-2025-38502](https://patchblox.com/security/data/cve/CVE-2025-38502.md) | High | bpf: Fix oob access in cgroup local storage | 7.1 | 0.0019 | | | [CVE-2025-38685](https://patchblox.com/security/data/cve/CVE-2025-38685.md) | High | fbdev: Fix vmalloc out-of-bounds write in fast_imageblit | 7.8 | 0.0019 | | | [CVE-2025-39766](https://patchblox.com/security/data/cve/CVE-2025-39766.md) | High | net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit | 8.1 | 0.0018 | | | [CVE-2025-38618](https://patchblox.com/security/data/cve/CVE-2025-38618.md) | High | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 | | | [CVE-2025-39727](https://patchblox.com/security/data/cve/CVE-2025-39727.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_... | 7.8 | 0.0018 | | | [CVE-2025-38700](https://patchblox.com/security/data/cve/CVE-2025-38700.md) | High | scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated | 7.0 | 0.0018 | | | [CVE-2025-38732](https://patchblox.com/security/data/cve/CVE-2025-38732.md) | High | netfilter: nf_reject: don't leak dst refcount for loopback packets | 7.0 | 0.0018 | | | [CVE-2025-38556](https://patchblox.com/security/data/cve/CVE-2025-38556.md) | High | HID: core: Harden s32ton() against conversion to 0 bits | 8.0 | 0.0018 | | | [CVE-2025-39823](https://patchblox.com/security/data/cve/CVE-2025-39823.md) | High | KVM: x86: use array_index_nospec with indices that come from guest | 7.8 | 0.0018 | | | [CVE-2025-38707](https://patchblox.com/security/data/cve/CVE-2025-38707.md) | High | fs/ntfs3: Add sanity check for file name | 7.8 | 0.0018 | | | [CVE-2025-39760](https://patchblox.com/security/data/cve/CVE-2025-39760.md) | High | usb: core: config: Prevent OOB read in SS endpoint companion parsing | 7.8 | 0.0018 | | | [CVE-2025-38500](https://patchblox.com/security/data/cve/CVE-2025-38500.md) | High | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0018 | | | [CVE-2025-38587](https://patchblox.com/security/data/cve/CVE-2025-38587.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 7.0 | 0.0018 | | | [CVE-2025-38653](https://patchblox.com/security/data/cve/CVE-2025-38653.md) | High | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 | | | [CVE-2025-39738](https://patchblox.com/security/data/cve/CVE-2025-39738.md) | High | btrfs: do not allow relocation of partially dropped subvolumes | 7.8 | 0.0018 | | | [CVE-2025-39749](https://patchblox.com/security/data/cve/CVE-2025-39749.md) | High | rcu: Protect ->defer_qs_iw_pending from data race | 7.0 | 0.0017 | | | [CVE-2025-38730](https://patchblox.com/security/data/cve/CVE-2025-38730.md) | High | io_uring/net: commit partial buffers on retry | 7.8 | 0.0017 | | | [CVE-2025-39835](https://patchblox.com/security/data/cve/CVE-2025-39835.md) | High | xfs: do not propagate ENODATA disk errors into xattr code | 7.8 | 0.0017 | | | [CVE-2025-38718](https://patchblox.com/security/data/cve/CVE-2025-38718.md) | High | sctp: linearize cloned gso packets in sctp_rcv | 7.8 | 0.0017 | | | [CVE-2025-39718](https://patchblox.com/security/data/cve/CVE-2025-39718.md) | High | vsock/virtio: Validate length in packet header before skb_put() | 7.8 | 0.0017 | | | [CVE-2025-39783](https://patchblox.com/security/data/cve/CVE-2025-39783.md) | High | PCI: endpoint: Fix configfs group list head handling | 7.8 | 0.0017 | | | [CVE-2025-39824](https://patchblox.com/security/data/cve/CVE-2025-39824.md) | High | HID: asus: fix UAF via HID_CLAIMED_INPUT validation | 7.8 | 0.0017 | | | [CVE-2025-39902](https://patchblox.com/security/data/cve/CVE-2025-39902.md) | High | mm/slub: avoid accessing metadata when pointer is invalid in object_err() | 7.8 | 0.0017 | | | [CVE-2025-39817](https://patchblox.com/security/data/cve/CVE-2025-39817.md) | High | efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare | 7.6 | 0.0017 | | | [CVE-2025-38670](https://patchblox.com/security/data/cve/CVE-2025-38670.md) | High | arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() | 7.1 | 0.0017 | | | [CVE-2025-38692](https://patchblox.com/security/data/cve/CVE-2025-38692.md) | High | exfat: add cluster chain loop check for dir | 7.0 | 0.0017 | | | [CVE-2025-39744](https://patchblox.com/security/data/cve/CVE-2025-39744.md) | High | rcu: Fix rcu_read_unlock() deadloop due to IRQ work | 7.1 | 0.0016 | | | [CVE-2025-39797](https://patchblox.com/security/data/cve/CVE-2025-39797.md) | High | xfrm: Duplicate SPI Handling | 7.8 | 0.0016 | | | [CVE-2025-39838](https://patchblox.com/security/data/cve/CVE-2025-39838.md) | High | cifs: prevent NULL pointer dereference in UTF16 conversion | 7.0 | 0.0016 | | | [CVE-2025-39697](https://patchblox.com/security/data/cve/CVE-2025-39697.md) | High | NFS: Fix a race when updating an existing write | 7.6 | 0.0016 | | | [CVE-2025-38665](https://patchblox.com/security/data/cve/CVE-2025-38665.md) | High | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 | | | [CVE-2025-38709](https://patchblox.com/security/data/cve/CVE-2025-38709.md) | High | loop: Avoid updating block size under exclusive owner | 7.0 | 0.0016 | | | [CVE-2025-39725](https://patchblox.com/security/data/cve/CVE-2025-39725.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling i... | 7.0 | 0.0015 | | | [CVE-2025-39819](https://patchblox.com/security/data/cve/CVE-2025-39819.md) | High | fs/smb: Fix inconsistent refcnt update | 7.6 | 0.0015 | | | [CVE-2025-39903](https://patchblox.com/security/data/cve/CVE-2025-39903.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing k... | 7.3 | 0.0015 | | | [CVE-2025-39900](https://patchblox.com/security/data/cve/CVE-2025-39900.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues wer... | 7.0 | 0.0015 | | | [CVE-2025-39825](https://patchblox.com/security/data/cve/CVE-2025-39825.md) | High | smb: client: fix race with concurrent opens in rename(2) | 7.6 | 0.0012 | | | [CVE-2025-39759](https://patchblox.com/security/data/cve/CVE-2025-39759.md) | High | btrfs: qgroup: fix race between quota disable and quota rescan ioctl | 7.0 | 0.0012 | | | [CVE-2025-39843](https://patchblox.com/security/data/cve/CVE-2025-39843.md) | High | mm: slub: avoid wake up kswapd in set_track_prepare | 7.8 | 0.0012 | | | [CVE-2025-39832](https://patchblox.com/security/data/cve/CVE-2025-39832.md) | High | net/mlx5: Fix lockdep assertion on sync reset unload event | 7.0 | 0.0012 | | | [CVE-2025-39770](https://patchblox.com/security/data/cve/CVE-2025-39770.md) | Routine | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM | 5.7 | 0.0038 | | | [CVE-2025-22103](https://patchblox.com/security/data/cve/CVE-2025-22103.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0021 | | | [CVE-2025-22124](https://patchblox.com/security/data/cve/CVE-2025-22124.md) | Routine | md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb | 6.0 | 0.0020 | | | [CVE-2025-22125](https://patchblox.com/security/data/cve/CVE-2025-22125.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0019 | | | [CVE-2025-38691](https://patchblox.com/security/data/cve/CVE-2025-38691.md) | Routine | pNFS: Fix uninited ptr deref in block/scsi layout | 6.2 | 0.0019 | | | [CVE-2025-39829](https://patchblox.com/security/data/cve/CVE-2025-39829.md) | Routine | trace/fgraph: Fix the warning caused by missing unregister notifier | 5.5 | 0.0019 | | | [CVE-2025-38586](https://patchblox.com/security/data/cve/CVE-2025-38586.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception... | 5.5 | 0.0019 | | | [CVE-2025-38639](https://patchblox.com/security/data/cve/CVE-2025-38639.md) | Routine | netfilter: xt_nfacct: don't assume acct name is null-terminated | 5.5 | 0.0019 | | | [CVE-2025-38622](https://patchblox.com/security/data/cve/CVE-2025-38622.md) | Routine | net: drop UFO packets in udp_rcv_segment() | 5.5 | 0.0018 | | | [CVE-2025-38683](https://patchblox.com/security/data/cve/CVE-2025-38683.md) | Routine | kernel: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion wi... | 5.5 | 0.0018 | | | [CVE-2025-39681](https://patchblox.com/security/data/cve/CVE-2025-39681.md) | Routine | x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper | 5.5 | 0.0018 | | | [CVE-2025-39756](https://patchblox.com/security/data/cve/CVE-2025-39756.md) | Routine | fs: Prevent file descriptor table allocations exceeding INT_MAX | 5.5 | 0.0018 | | | [CVE-2025-39724](https://patchblox.com/security/data/cve/CVE-2025-39724.md) | Routine | serial: 8250: fix panic due to PSLVERR | 5.5 | 0.0018 | | | [CVE-2025-38588](https://patchblox.com/security/data/cve/CVE-2025-38588.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0018 | | | [CVE-2025-38721](https://patchblox.com/security/data/cve/CVE-2025-38721.md) | Routine | netfilter: ctnetlink: fix refcount leak on table dump | 5.5 | 0.0018 | | | [CVE-2025-39812](https://patchblox.com/security/data/cve/CVE-2025-39812.md) | Routine | sctp: initialize more fields in sctp_v6_from_sk() | 5.5 | 0.0018 | | | [CVE-2025-38640](https://patchblox.com/security/data/cve/CVE-2025-38640.md) | Routine | bpf: Disable migration in nf_hook_run_bpf(). | 5.5 | 0.0017 | | | [CVE-2025-39748](https://patchblox.com/security/data/cve/CVE-2025-39748.md) | Routine | bpf: Forget ranges when refining tnum after JSET | 5.5 | 0.0017 | | | [CVE-2025-39795](https://patchblox.com/security/data/cve/CVE-2025-39795.md) | Routine | block: avoid possible overflow for chunk_sectors check in blk_stack_limits() | 5.5 | 0.0017 | | | [CVE-2025-38645](https://patchblox.com/security/data/cve/CVE-2025-38645.md) | Routine | net/mlx5: Check device memory pointer before usage | 5.5 | 0.0017 | | | [CVE-2025-38686](https://patchblox.com/security/data/cve/CVE-2025-38686.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD... | 5.5 | 0.0017 | | | [CVE-2025-39700](https://patchblox.com/security/data/cve/CVE-2025-39700.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to... | 5.5 | 0.0016 | | | [CVE-2025-39763](https://patchblox.com/security/data/cve/CVE-2025-39763.md) | Routine | ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered | 5.5 | 0.0016 | | | [CVE-2025-39792](https://patchblox.com/security/data/cve/CVE-2025-39792.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limi... | 5.5 | 0.0016 | | | [CVE-2025-39800](https://patchblox.com/security/data/cve/CVE-2025-39800.md) | Routine | btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() | 5.5 | 0.0016 | | | [CVE-2025-39845](https://patchblox.com/security/data/cve/CVE-2025-39845.md) | Routine | x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() | 5.5 | 0.0016 | | | [CVE-2025-39734](https://patchblox.com/security/data/cve/CVE-2025-39734.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with ino... | 5.5 | 0.0016 | | | [CVE-2025-39779](https://patchblox.com/security/data/cve/CVE-2025-39779.md) | Routine | btrfs: subpage: keep TOWRITE tag until folio is cleaned | 5.5 | 0.0015 | | | [CVE-2025-39780](https://patchblox.com/security/data/cve/CVE-2025-39780.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on... | 5.5 | 0.0015 | | | [CVE-2025-39844](https://patchblox.com/security/data/cve/CVE-2025-39844.md) | Routine | mm: move page table sync declarations to linux/pgtable.h | 5.5 | 0.0015 | | | [CVE-2025-39895](https://patchblox.com/security/data/cve/CVE-2025-39895.md) | Routine | sched: Fix sched_numa_find_nth_cpu() if mask offline | 5.5 | 0.0015 | | | [CVE-2025-39852](https://patchblox.com/security/data/cve/CVE-2025-39852.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failur... | 5.5 | 0.0015 | | | [CVE-2025-39899](https://patchblox.com/security/data/cve/CVE-2025-39899.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for... | 5.5 | 0.0015 | | | [CVE-2025-38632](https://patchblox.com/security/data/cve/CVE-2025-38632.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 4.7 | 0.0014 | | | [CVE-2025-39754](https://patchblox.com/security/data/cve/CVE-2025-39754.md) | Routine | mm/smaps: fix race between smaps_hugetlb_range and migration | 5.5 | 0.0014 | | | [CVE-2025-38681](https://patchblox.com/security/data/cve/CVE-2025-38681.md) | Routine | mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() | 5.5 | 0.0014 | | | [CVE-2025-39782](https://patchblox.com/security/data/cve/CVE-2025-39782.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoi... | 5.5 | 0.0013 | | | [CVE-2025-39791](https://patchblox.com/security/data/cve/CVE-2025-39791.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs... | 5.5 | 0.0013 | | | [CVE-2025-38675](https://patchblox.com/security/data/cve/CVE-2025-38675.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: state: initialize state_ptrs earlier in xf... | 5.9 | 0.0012 | | | [CVE-2025-39773](https://patchblox.com/security/data/cve/CVE-2025-39773.md) | Routine | net: bridge: fix soft lockup in br_multicast_query_expired() | 5.5 | 0.0012 | | | [CVE-2025-38717](https://patchblox.com/security/data/cve/CVE-2025-38717.md) | Routine | net: kcm: Fix race condition in kcm_unattach() | 5.5 | 0.0012 | | | [CVE-2025-39813](https://patchblox.com/security/data/cve/CVE-2025-39813.md) | Routine | ftrace: Fix potential warning in trace_printk_seq during ftrace_dump | 5.5 | 0.0012 | | | [CVE-2025-38553](https://patchblox.com/security/data/cve/CVE-2025-38553.md) | Routine | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.