# ALAS2023-2025-994: Security update for 22 packages ALAS2023-2025-994, released June 3, 2025, fixes 66 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-994 - Platform: Linux - Released: Jun 3, 2025 - Priority: High (Closes CVE-2025-37928, high severity) - CVEs: 66, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-994.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-livepatch-6.12.29-33.102](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.29-33.102.md) | amzn 2023 | 1.0-0.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 6.12.29-33.102.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-37928](https://patchblox.com/security/data/cve/CVE-2025-37928.md) | High | dm-bufio: don't schedule in atomic context | 7.8 | 0.0074 | | | [CVE-2025-37894](https://patchblox.com/security/data/cve/CVE-2025-37894.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIM... | 7.0 | 0.0049 | | | [CVE-2025-37799](https://patchblox.com/security/data/cve/CVE-2025-37799.md) | High | kpatch-patch-5_14_0-570_17_1: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a run... | 9.4 | 0.0037 | | | [CVE-2025-37954](https://patchblox.com/security/data/cve/CVE-2025-37954.md) | High | smb: client: Avoid race in open_cached_dir with lease breaks | 7.0 | 0.0037 | | | [CVE-2025-37885](https://patchblox.com/security/data/cve/CVE-2025-37885.md) | High | KVM: x86: Reset IRTE to host control if *new* route isn't postable | 7.8 | 0.0032 | | | [CVE-2025-37882](https://patchblox.com/security/data/cve/CVE-2025-37882.md) | High | usb: xhci: Fix isochronous Ring Underrun/Overrun event handling | 7.8 | 0.0030 | | | [CVE-2025-37927](https://patchblox.com/security/data/cve/CVE-2025-37927.md) | High | iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid | 7.8 | 0.0030 | | | [CVE-2025-37878](https://patchblox.com/security/data/cve/CVE-2025-37878.md) | High | perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init | 7.0 | 0.0028 | | | [CVE-2025-37807](https://patchblox.com/security/data/cve/CVE-2025-37807.md) | High | bpf: Fix kmemleak warning for percpu hashmap | 7.0 | 0.0025 | | | [CVE-2025-37923](https://patchblox.com/security/data/cve/CVE-2025-37923.md) | High | tracing: Fix oob write in trace_seq_to_buffer() | 7.8 | 0.0025 | | | [CVE-2025-37913](https://patchblox.com/security/data/cve/CVE-2025-37913.md) | High | net_sched: qfq: Fix double list add in class with netem as child qdisc | 7.8 | 0.0024 | | | [CVE-2025-37921](https://patchblox.com/security/data/cve/CVE-2025-37921.md) | High | vxlan: vnifilter: Fix unlocked deletion of default FDB entry | 7.8 | 0.0024 | | | [CVE-2025-37914](https://patchblox.com/security/data/cve/CVE-2025-37914.md) | High | net_sched: ets: Fix double list add in class with netem as child qdisc | 7.8 | 0.0023 | | | [CVE-2025-37823](https://patchblox.com/security/data/cve/CVE-2025-37823.md) | High | net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too | 7.8 | 0.0023 | | | [CVE-2025-37958](https://patchblox.com/security/data/cve/CVE-2025-37958.md) | High | mm/huge_memory: fix dereferencing invalid pmd migration entry | 7.1 | 0.0023 | | | [CVE-2025-37797](https://patchblox.com/security/data/cve/CVE-2025-37797.md) | High | net_sched: hfsc: Fix a UAF vulnerability in class handling | 7.8 | 0.0023 | | | [CVE-2025-37819](https://patchblox.com/security/data/cve/CVE-2025-37819.md) | High | irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() | 7.8 | 0.0023 | | | [CVE-2025-37915](https://patchblox.com/security/data/cve/CVE-2025-37915.md) | High | net_sched: drr: Fix double list add in class with netem as child qdisc | 7.0 | 0.0023 | | | [CVE-2025-37890](https://patchblox.com/security/data/cve/CVE-2025-37890.md) | High | net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc | 7.8 | 0.0022 | | | [CVE-2025-37995](https://patchblox.com/security/data/cve/CVE-2025-37995.md) | High | module: ensure that kobject_put() is safe for module type kobjects | 7.0 | 0.0022 | | | [CVE-2025-37936](https://patchblox.com/security/data/cve/CVE-2025-37936.md) | High | perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. | 7.0 | 0.0022 | | | [CVE-2025-38177](https://patchblox.com/security/data/cve/CVE-2025-38177.md) | High | sch_hfsc: make hfsc_qlen_notify() idempotent | 7.0 | 0.0022 | | | [CVE-2025-37908](https://patchblox.com/security/data/cve/CVE-2025-37908.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When m... | 7.8 | 0.0021 | | | [CVE-2025-37964](https://patchblox.com/security/data/cve/CVE-2025-37964.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may b... | 7.0 | 0.0021 | | | [CVE-2025-37948](https://patchblox.com/security/data/cve/CVE-2025-37948.md) | High | arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs | 7.0 | 0.0021 | | | [CVE-2025-37938](https://patchblox.com/security/data/cve/CVE-2025-37938.md) | High | tracing: Verify event formats that have "%*p.." | 7.8 | 0.0021 | | | [CVE-2025-37929](https://patchblox.com/security/data/cve/CVE-2025-37929.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 7.0 | 0.0020 | | | [CVE-2025-37963](https://patchblox.com/security/data/cve/CVE-2025-37963.md) | High | arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users | 7.0 | 0.0020 | | | [CVE-2025-21709](https://patchblox.com/security/data/cve/CVE-2025-21709.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about dup_mmap() failure... | 7.1 | 0.0020 | | | [CVE-2025-37900](https://patchblox.com/security/data/cve/CVE-2025-37900.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 7.0 | 0.0020 | | | [CVE-2025-37989](https://patchblox.com/security/data/cve/CVE-2025-37989.md) | High | net: phy: leds: fix memory leak | 7.0 | 0.0020 | | | [CVE-2025-37957](https://patchblox.com/security/data/cve/CVE-2025-37957.md) | High | KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception | 7.8 | 0.0019 | | | [CVE-2025-37960](https://patchblox.com/security/data/cve/CVE-2025-37960.md) | High | memblock: Accept allocated memory before use in memblock_double_array() | 7.0 | 0.0019 | | | [CVE-2025-37955](https://patchblox.com/security/data/cve/CVE-2025-37955.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_x... | 7.0 | 0.0019 | | | [CVE-2025-37999](https://patchblox.com/security/data/cve/CVE-2025-37999.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split()... | 7.0 | 0.0019 | | | [CVE-2025-37997](https://patchblox.com/security/data/cve/CVE-2025-37997.md) | High | netfilter: ipset: fix region locking in hash types | 7.0 | 0.0018 | | | [CVE-2025-37988](https://patchblox.com/security/data/cve/CVE-2025-37988.md) | High | fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() | 7.0 | 0.0015 | | | [CVE-2025-37820](https://patchblox.com/security/data/cve/CVE-2025-37820.md) | Routine | xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() | 5.5 | 0.0040 | | | [CVE-2025-37959](https://patchblox.com/security/data/cve/CVE-2025-37959.md) | Routine | bpf: Scrub packet on bpf_redirect_peer | 5.5 | 0.0038 | | | [CVE-2025-22108](https://patchblox.com/security/data/cve/CVE-2025-22108.md) | Routine | bnxt_en: Mask the bd_cnt field in the TX BD properly | 5.5 | 0.0037 | | | [CVE-2025-37888](https://patchblox.com/security/data/cve/CVE-2025-37888.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0028 | | | [CVE-2025-37877](https://patchblox.com/security/data/cve/CVE-2025-37877.md) | Routine | iommu: Clear iommu-dma ops on cleanup | 5.5 | 0.0028 | | | [CVE-2025-37998](https://patchblox.com/security/data/cve/CVE-2025-37998.md) | Routine | openvswitch: Fix unsafe attribute parsing in output_userspace() | 5.5 | 0.0027 | | | [CVE-2024-57976](https://patchblox.com/security/data/cve/CVE-2024-57976.md) | Routine | btrfs: do proper folio cleanup when cow_file_range() failed | 5.5 | 0.0027 | | | [CVE-2025-37876](https://patchblox.com/security/data/cve/CVE-2025-37876.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIG_PR... | 5.5 | 0.0026 | | | [CVE-2025-37949](https://patchblox.com/security/data/cve/CVE-2025-37949.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0024 | | | [CVE-2025-37806](https://patchblox.com/security/data/cve/CVE-2025-37806.md) | Routine | fs/ntfs3: Keep write operations atomic | 5.5 | 0.0024 | | | [CVE-2025-37932](https://patchblox.com/security/data/cve/CVE-2025-37932.md) | Routine | sch_htb: make htb_qlen_notify() idempotent | 5.5 | 0.0024 | | | [CVE-2025-37814](https://patchblox.com/security/data/cve/CVE-2025-37814.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0022 | | | [CVE-2025-37931](https://patchblox.com/security/data/cve/CVE-2025-37931.md) | Routine | btrfs: adjust subpage bit start based on sectorsize | 5.5 | 0.0022 | | | [CVE-2025-21884](https://patchblox.com/security/data/cve/CVE-2025-21884.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0022 | | | [CVE-2025-21833](https://patchblox.com/security/data/cve/CVE-2025-21833.md) | Routine | iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE | 5.5 | 0.0022 | | | [CVE-2025-37808](https://patchblox.com/security/data/cve/CVE-2025-37808.md) | Routine | crypto: null - Use spin lock instead of mutex | 5.5 | 0.0021 | | | [CVE-2025-37884](https://patchblox.com/security/data/cve/CVE-2025-37884.md) | Routine | bpf: Fix deadlock between rcu_tasks_trace and event_mutex. | 5.5 | 0.0021 | | | [CVE-2025-37800](https://patchblox.com/security/data/cve/CVE-2025-37800.md) | Routine | driver core: fix potential NULL pointer dereference in dev_uevent() | 5.5 | 0.0021 | | | [CVE-2025-37809](https://patchblox.com/security/data/cve/CVE-2025-37809.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0020 | | | [CVE-2025-37813](https://patchblox.com/security/data/cve/CVE-2025-37813.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues wer... | 5.7 | 0.0020 | | | [CVE-2025-37961](https://patchblox.com/security/data/cve/CVE-2025-37961.md) | Routine | ipvs: fix uninit-value for saddr in do_output_route4 | 6.5 | 0.0019 | | | [CVE-2025-22120](https://patchblox.com/security/data/cve/CVE-2025-22120.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0019 | | | [CVE-2025-37827](https://patchblox.com/security/data/cve/CVE-2025-37827.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group wr... | 5.5 | 0.0019 | | | [CVE-2025-37821](https://patchblox.com/security/data/cve/CVE-2025-37821.md) | Routine | kernel: In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX a... | 5.5 | 0.0019 | | | [CVE-2025-37834](https://patchblox.com/security/data/cve/CVE-2025-37834.md) | Routine | mm/vmscan: don't try to reclaim hwpoison folio | 5.5 | 0.0019 | | | [CVE-2025-37986](https://patchblox.com/security/data/cve/CVE-2025-37986.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0019 | | | [CVE-2025-37920](https://patchblox.com/security/data/cve/CVE-2025-37920.md) | Routine | xsk: Fix race condition in AF_XDP generic RX path | 5.5 | 0.0016 | | | [CVE-2025-21807](https://patchblox.com/security/data/cve/CVE-2025-21807.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in... | 5.5 | 0.0015 | | | [CVE-2025-21817](https://patchblox.com/security/data/cve/CVE-2025-21817.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() sys... | 5.5 | 0.0015 | | --- Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.