Linux · 
Amazon Linux · Security advisory · August 26, 2025
Amazon Linux · Security advisory · August 26, 2025ALAS2023-2025-1169: Security update for 22 packages
ALAS2023-2025-1169, released August 26, 2025, fixes 22 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
22
None rated Critical
Exploited
0
None reported
Highest CVSS
7.8
Base score, 0 to 10
Highest EPSS
0.0044
38th percentile
Priority of the 22 CVEs
Patch now 0
Urgent 0
High 15
Routine 7
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-libbpf | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-livepatch-6.1.148-173.267 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| perf | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.148-173.267.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-38563 | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0044 | None reported |
| High | CVE-2025-38608 | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0044 | None reported |
| High | CVE-2025-38617 | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0043 | None reported |
| High | CVE-2025-37954 | smb: client: Avoid race in open_cached_dir with lease breaks | 7.0 | 0.0037 | None reported |
| High | CVE-2025-39730 | NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() | 7.8 | 0.0021 | None reported |
| High | CVE-2025-38565 | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0020 | None reported |
| High | CVE-2025-38572 | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0020 | None reported |
| High | CVE-2025-38206 | exfat: fix double free in delayed_free | 7.8 | 0.0019 | None reported |
| High | CVE-2025-38560 | x86/sev: Evict cache lines during SNP memory validation | 7.5 | 0.0019 | None reported |
| High | CVE-2025-38162 | netfilter: nft_set_pipapo: prevent overflow in lookup table allocation | 7.0 | 0.0019 | None reported |
| High | CVE-2025-38618 | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 | None reported |
| High | CVE-2025-38500 | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0018 | None reported |
| High | CVE-2025-38587 | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0018 | None reported |
| High | CVE-2025-38653 | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 | None reported |
| High | CVE-2025-38665 | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 | None reported |
| Routine | CVE-2025-38639 | netfilter: xt_nfacct: don't assume acct name is null-terminated | 5.5 | 0.0019 | None reported |
| Routine | CVE-2025-38622 | net: drop UFO packets in udp_rcv_segment() | 5.5 | 0.0018 | None reported |
| Routine | CVE-2025-38588 | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 | None reported |
| Routine | CVE-2025-38727 | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 | None reported |
| Routine | CVE-2025-38645 | net/mlx5: Check device memory pointer before usage | 5.5 | 0.0017 | None reported |
| Routine | CVE-2025-39734 | linux: In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with ino... | 5.5 | 0.0016 | None reported |
| Routine | CVE-2025-38553 | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a | None reported |
Showing 1 to 22 of 22
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.