Linux · 
Amazon Linux · Security advisory · July 21, 2025
Amazon Linux · Security advisory · July 21, 2025ALAS2023-2025-1111: Security update for 22 packages
ALAS2023-2025-1111, released July 21, 2025, fixes 70 CVEs across 22 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
70
1 rated Critical
Exploited
1
CVE-2025-38352
Highest CVSS
9.3
Base score, 0 to 10
Highest EPSS
0.0136
71st percentile
Priority of the 70 CVEs
Patch now 1
Urgent 1
High 46
Routine 22
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-libbpf | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-livepatch-6.1.144-170.251 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| perf | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.144-170.251.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2025-38352 | posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() | 7.8 | 0.0136 | KEVExploited |
| Urgent | CVE-2024-36913 | linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_enc... | 9.3 | 0.0066 | None reported |
| High | CVE-2025-38430 | nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request | 7.1 | 0.0059 | None reported |
| High | CVE-2025-38181 | calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). | 7.0 | 0.0058 | None reported |
| High | CVE-2025-38399 | scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() | 7.0 | 0.0051 | None reported |
| High | CVE-2025-38146 | net: openvswitch: Fix the dead loop of MPLS parse | 7.8 | 0.0049 | None reported |
| High | CVE-2025-38124 | kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.0 | 0.0047 | None reported |
| High | CVE-2025-38211 | RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction | 7.8 | 0.0042 | None reported |
| High | CVE-2025-38350 | net/sched: Always pass notifications when child class becomes empty | 7.8 | 0.0030 | None reported |
| High | CVE-2025-38236 | af_unix: Don't leave consecutive consumed OOB skbs. | 7.8 | 0.0030 | None reported |
| High | CVE-2025-37807 | bpf: Fix kmemleak warning for percpu hashmap | 7.0 | 0.0025 | None reported |
| High | CVE-2025-38103 | HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() | 7.1 | 0.0023 | None reported |
| High | CVE-2025-37958 | mm/huge_memory: fix dereferencing invalid pmd migration entry | 7.1 | 0.0023 | None reported |
| High | CVE-2025-38115 | net_sched: sch_sfq: fix a potential crash on gso_skb handling | 7.0 | 0.0023 | None reported |
| High | CVE-2025-38298 | linux: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault A... | 7.8 | 0.0023 | None reported |
| High | CVE-2025-38111 | net/mdiobus: Fix potential out-of-bounds read/write access | 7.1 | 0.0023 | None reported |
| High | CVE-2025-38147 | calipso: Don't call calipso functions for AF_INET sk. | 7.8 | 0.0023 | None reported |
| High | CVE-2025-38415 | Squashfs: check return result of sb_min_blocksize | 7.8 | 0.0023 | None reported |
| High | CVE-2024-41013 | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu... | 7.8 | 0.0022 | None reported |
| High | CVE-2025-38498 | do_change_type(): refuse to operate on unmounted/not ours mounts | 7.9 | 0.0022 | None reported |
| High | CVE-2025-38403 | vsock/vmci: Clear the vmci transport packet properly when initializing it | 7.8 | 0.0022 | None reported |
| High | CVE-2025-38324 | mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). | 7.0 | 0.0022 | None reported |
| High | CVE-2025-38424 | perf: Fix sample vs do_exit() | 7.0 | 0.0022 | None reported |
| High | CVE-2025-38389 | drm/i915/gt: Fix timeline left held on VMA alloc error | 7.8 | 0.0022 | None reported |
| High | CVE-2025-38084 | mm/hugetlb: unshare page tables during VMA split, not before | 7.3 | 0.0021 | None reported |
Showing 1 to 25 of 70
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.