Linux · Amazon Linux · Security advisory · July 3, 2025

ALAS2023-2025-1080: Security update for 22 packages

ALAS2023-2025-1080, released July 3, 2025, fixes 90 CVEs across 22 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
90
None rated Critical
Exploited
1
CVE-2025-38352
Highest CVSS
7.9
Base score, 0 to 10
Highest EPSS
0.0136
71st percentile

Priority of the 90 CVEs

Patch now 1 Urgent 0 High 67 Routine 22

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.12.35-55.103.amzn2023
bpftool-debuginfoamzn 20236.12.35-55.103.amzn2023
kernel-develamzn 20236.12.35-55.103.amzn2023
kernel-headersamzn 20236.12.35-55.103.amzn2023
kernel-libbpfamzn 20236.12.35-55.103.amzn2023
kernel-libbpf-debuginfoamzn 20236.12.35-55.103.amzn2023
kernel-libbpf-develamzn 20236.12.35-55.103.amzn2023
kernel-libbpf-staticamzn 20236.12.35-55.103.amzn2023
kernel-livepatch-6.12.35-55.103amzn 20231.0-0.amzn2023
kernel-modules-extra-commonamzn 20236.12.35-55.103.amzn2023
kernel-toolsamzn 20236.12.35-55.103.amzn2023
kernel-tools-debuginfoamzn 20236.12.35-55.103.amzn2023
kernel-tools-develamzn 20236.12.35-55.103.amzn2023
kernel6.12amzn 20236.12.35-55.103.amzn2023
kernel6.12-debuginfoamzn 20236.12.35-55.103.amzn2023
kernel6.12-debuginfo-common-aarch64amzn 20236.12.35-55.103.amzn2023
kernel6.12-debuginfo-common-x86_64amzn 20236.12.35-55.103.amzn2023
kernel6.12-modules-extraamzn 20236.12.35-55.103.amzn2023
perf6.12amzn 20236.12.35-55.103.amzn2023
perf6.12-debuginfoamzn 20236.12.35-55.103.amzn2023
python3-perf6.12amzn 20236.12.35-55.103.amzn2023
python3-perf6.12-debuginfoamzn 20236.12.35-55.103.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()7.8 0.0136 KEVExploited
High CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request7.1 0.0059 None reported
High CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().7.0 0.0058 None reported
High CVE-2025-38089 sunrpc: handle SVC_GARBAGE during svc auth processing as auth error7.5 0.0056 None reported
High CVE-2025-38001 net_sched: hfsc: Address reentrant enqueue adding class to eltree twice7.8 0.0056 None reported
High CVE-2025-38146 net: openvswitch: Fix the dead loop of MPLS parse7.8 0.0049 None reported
High CVE-2025-38124 kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system7.0 0.0047 None reported
High CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction7.8 0.0042 None reported
High CVE-2025-38201 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX7.8 0.0024 None reported
High CVE-2025-38115 net_sched: sch_sfq: fix a potential crash on gso_skb handling7.0 0.0023 None reported
High CVE-2025-38103 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()7.1 0.0023 None reported
High CVE-2025-38415 Squashfs: check return result of sb_min_blocksize7.8 0.0023 None reported
High CVE-2025-38147 calipso: Don't call calipso functions for AF_INET sk.7.8 0.0023 None reported
High CVE-2025-38298 linux: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault A...7.8 0.0023 None reported
High CVE-2025-38111 net/mdiobus: Fix potential out-of-bounds read/write access7.1 0.0023 None reported
High CVE-2025-38498 do_change_type(): refuse to operate on unmounted/not ours mounts7.9 0.0022 None reported
High CVE-2025-38084 mm/hugetlb: unshare page tables during VMA split, not before7.3 0.0022 None reported
High CVE-2025-38324 mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().7.0 0.0022 None reported
High CVE-2025-38424 perf: Fix sample vs do_exit()7.0 0.0022 None reported
High CVE-2025-38100 x86/iopl: Cure TIF_IO_BITMAP inconsistencies7.0 0.0022 None reported
High CVE-2025-38280 bpf: Avoid __bpf_prog_ret0_warn when jit fails7.8 0.0021 None reported
High CVE-2025-38267 kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system7.8 0.0021 None reported
High CVE-2025-38320 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()7.1 0.0021 None reported
High CVE-2025-38193 net_sched: sch_sfq: reject invalid perturb period7.0 0.0021 None reported
High CVE-2025-22112 kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu...7.1 0.0021 None reported
Showing 1 to 25 of 90 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.