Linux · Amazon Linux · Security advisory · October 27, 2025

ALAS2023-2025-1254: Security update for 22 packages

ALAS2023-2025-1254, released October 27, 2025, fixes 48 CVEs across 22 products. One of them is being exploited (CVE-2025-39964); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
48
2 rated Critical
Exploited
1
CVE-2025-39964
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.1026
95th percentile

Priority of the 48 CVEs

Patch now 1 Urgent 2 High 28 Routine 17

Fixed package versions

ProductReleaseFixed in
bpftool6.12amzn 20231:6.12.53-69.119.amzn2023
bpftool6.12-debuginfoamzn 20231:6.12.53-69.119.amzn2023
kernel-livepatch-6.12.53-69.119amzn 20231:1.0-0.amzn2023
kernel6.12amzn 20231:6.12.53-69.119.amzn2023
kernel6.12-debuginfoamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-debuginfo-common-aarch64amzn 20231:6.12.53-69.119.amzn2023
kernel6.12-debuginfo-common-x86_64amzn 20231:6.12.53-69.119.amzn2023
kernel6.12-develamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-headersamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-libbpfamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-libbpf-debuginfoamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-libbpf-develamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-libbpf-staticamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-modules-extraamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-modules-extra-commonamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-toolsamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-tools-debuginfoamzn 20231:6.12.53-69.119.amzn2023
kernel6.12-tools-develamzn 20231:6.12.53-69.119.amzn2023
perf6.12amzn 20231:6.12.53-69.119.amzn2023
perf6.12-debuginfoamzn 20231:6.12.53-69.119.amzn2023
python3-perf6.12amzn 20231:6.12.53-69.119.amzn2023
python3-perf6.12-debuginfoamzn 20231:6.12.53-69.119.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2025-39964 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg8.8 0.0161 KEVExploited
Urgent CVE-2025-39975 linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_c...9.8 0.0047 None reported
Urgent CVE-2025-39967 fbcon: fix integer overflow in fbcon_do_set_font9.8 0.0017 None reported
High CVE-2025-39946 tls: make sure to abort the stream if headers are bogus7.0 0.1026 None reported
High CVE-2025-40048 uio_hv_generic: Let userspace take care of interrupt mask8.4 0.0064 None reported
High CVE-2025-40129 linux: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-len...7.5 0.0057 None reported
High CVE-2025-40057 ptp: Add a upper bound on max_vclocks7.1 0.0025 None reported
High CVE-2025-40009 linux: In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL Whe...n/a 0.0024 None reported
High CVE-2025-39980 nexthop: Forbid FDB status change while nexthop is in a group7.1 0.0023 None reported
High CVE-2025-40035 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak7.1 0.0023 None reported
High CVE-2025-40052 smb: client: fix crypto buffers in non-linear memory7.1 0.0021 None reported
High CVE-2025-40006 linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when delet...7.8 0.0021 None reported
High CVE-2025-39965 xfrm: xfrm_alloc_spi shouldn't use 0 as SPI7.8 0.0020 None reported
High CVE-2025-39992 linux: In the Linux kernel, the following vulnerability has been resolved: mm: swap: check for stable address space before...n/a 0.0020 None reported
High CVE-2025-39990 bpf: Check the helper function is valid in get_helper_proto7.8 0.0020 None reported
High CVE-2025-39984 kernel-default: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues wer...7.8 0.0020 None reported
High CVE-2025-40068 fs: ntfs3: Fix integer overflow in run_unpack()8.4 0.0018 None reported
High CVE-2025-39998 scsi: target: target_core_configfs: Add length check to avoid buffer overflow7.8 0.0018 None reported
High CVE-2025-40044 fs: udf: fix OOB read in lengthAllocDescs handling7.8 0.0017 None reported
High CVE-2025-39931 crypto: af_alg - Set merge to zero early in af_alg_sendmsg7.0 0.0017 None reported
High CVE-2025-40123 linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall c...7.8 0.0017 None reported
High CVE-2025-39955 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().7.8 0.0017 None reported
High CVE-2025-40067 linux: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is...7.8 0.0016 None reported
High CVE-2025-40058 linux: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoheren...8.8 0.0016 None reported
High CVE-2025-40047 linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry i...7.8 0.0016 None reported
Showing 1 to 25 of 48 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.