# ALAS2023-2025-1223: Security update for 22 packages ALAS2023-2025-1223, released October 14, 2025, fixes 21 CVEs across 22 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-1223 - Platform: Linux - Released: Oct 14, 2025 - Priority: Patch now (Closes CVE-2025-39964, exploited (CISA KEV)) - CVEs: 21, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-1223.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-livepatch-6.1.155-176.282](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.155-176.282.md) | amzn 2023 | 1:1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 1:6.1.155-176.282.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-39964](https://patchblox.com/security/data/cve/CVE-2025-39964.md) | Patch now | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 8.8 | 0.0161 | CISA KEV | | [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 | | | [CVE-2025-39898](https://patchblox.com/security/data/cve/CVE-2025-39898.md) | Urgent | e1000e: fix heap overflow in e1000_set_eeprom | 9.8 | n/a | | | [CVE-2025-39946](https://patchblox.com/security/data/cve/CVE-2025-39946.md) | High | tls: make sure to abort the stream if headers are bogus | 7.0 | 0.1026 | | | [CVE-2025-39894](https://patchblox.com/security/data/cve/CVE-2025-39894.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed... | 7.0 | 0.0033 | | | [CVE-2025-39880](https://patchblox.com/security/data/cve/CVE-2025-39880.md) | High | libceph: fix invalid accesses to ceph_connection_v1_info | 7.8 | 0.0033 | | | [CVE-2025-39980](https://patchblox.com/security/data/cve/CVE-2025-39980.md) | High | nexthop: Forbid FDB status change while nexthop is in a group | 7.1 | 0.0023 | | | [CVE-2025-40006](https://patchblox.com/security/data/cve/CVE-2025-40006.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when delet... | 7.8 | 0.0021 | | | [CVE-2025-39913](https://patchblox.com/security/data/cve/CVE-2025-39913.md) | High | tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. | 7.8 | 0.0019 | | | [CVE-2025-39914](https://patchblox.com/security/data/cve/CVE-2025-39914.md) | High | tracing: Silence warning when chunk allocation fails in trace_pid_write | 7.0 | 0.0017 | | | [CVE-2025-39931](https://patchblox.com/security/data/cve/CVE-2025-39931.md) | High | crypto: af_alg - Set merge to zero early in af_alg_sendmsg | 7.0 | 0.0017 | | | [CVE-2025-39902](https://patchblox.com/security/data/cve/CVE-2025-39902.md) | High | mm/slub: avoid accessing metadata when pointer is invalid in object_err() | 7.8 | 0.0017 | | | [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 | | | [CVE-2025-39883](https://patchblox.com/security/data/cve/CVE-2025-39883.md) | High | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | 7.6 | 0.0016 | | | [CVE-2025-39877](https://patchblox.com/security/data/cve/CVE-2025-39877.md) | High | mm/damon/sysfs: fix use-after-free in state_show() | 7.8 | 0.0015 | | | [CVE-2025-39881](https://patchblox.com/security/data/cve/CVE-2025-39881.md) | High | kernfs: Fix UAF in polling when open file is released | 7.8 | 0.0015 | | | [CVE-2025-39977](https://patchblox.com/security/data/cve/CVE-2025-39977.md) | High | futex: Prevent use-after-free during requeue-PI | 7.8 | 0.0015 | | | [CVE-2025-40021](https://patchblox.com/security/data/cve/CVE-2025-40021.md) | Routine | tracing: dynevent: Add a missing lockdown check on dynevent | 5.5 | 0.0021 | | | [CVE-2025-39953](https://patchblox.com/security/data/cve/CVE-2025-39953.md) | Routine | cgroup: split cgroup_destroy_wq into 3 workqueues | 5.5 | 0.0016 | | | [CVE-2025-39909](https://patchblox.com/security/data/cve/CVE-2025-39909.md) | Routine | mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() | 5.5 | 0.0015 | | | [CVE-2025-39916](https://patchblox.com/security/data/cve/CVE-2025-39916.md) | Routine | mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() | 5.5 | 0.0015 | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.