Linux · 
Amazon Linux · Security advisory · December 8, 2025
Amazon Linux · Security advisory · December 8, 2025ALAS2023-2025-1297: Security update for 22 packages
ALAS2023-2025-1297, released December 8, 2025, fixes 30 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
30
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0064
51st percentile
Priority of the 30 CVEs
Patch now 0
Urgent 0
High 17
Routine 13
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-devel | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-headers | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-libbpf | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-livepatch-6.1.158-178.288 | amzn 2023 | 1:1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-tools | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| kernel-tools-devel | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| perf | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| perf-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| python3-perf | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 1:6.1.158-178.288.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-40240 | sctp: avoid NULL dereference when chunk data buffer is missing | 8.6 | 0.0064 | None reported |
| High | CVE-2025-40187 | net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() | 7.5 | 0.0064 | None reported |
| High | CVE-2025-40183 | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_... | 7.5 | 0.0063 | None reported |
| High | CVE-2025-40176 | tls: wait for pending async decryptions if tls_strp_msg_hold fails | 9.8 | 0.0049 | None reported |
| High | CVE-2025-40204 | sctp: Fix MAC comparison to be constant-time | 8.1 | 0.0047 | None reported |
| High | CVE-2025-40099 | cifs: parse_dfs_referrals: prevent oob on malformed input | 9.4 | 0.0041 | None reported |
| High | CVE-2025-40019 | crypto: essiv - Check ssize for decryption and in-place encryption | 7.0 | 0.0029 | None reported |
| High | CVE-2025-40103 | smb: client: Fix refcount leak for cifs_sb_tlink | 7.1 | 0.0021 | None reported |
| High | CVE-2025-40190 | ext4: guard against EA inode refcount underflow in xattr update | 7.8 | 0.0018 | None reported |
| High | CVE-2025-40105 | vfs: Don't leak disconnected dentries on umount | 7.8 | 0.0017 | None reported |
| High | CVE-2025-40167 | ext4: detect invalid INLINE_DATA + EXTENTS flag combination | 7.8 | 0.0017 | None reported |
| High | CVE-2025-40198 | ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() | 7.8 | 0.0017 | None reported |
| High | CVE-2025-40173 | net/ip6_tunnel: Prevent perpetual tunnel growth | 7.8 | 0.0015 | None reported |
| High | CVE-2025-40205 | btrfs: avoid potential out-of-bounds in btrfs_encode_fh() | 7.8 | 0.0015 | None reported |
| High | CVE-2025-40104 | ixgbevf: fix mailbox API compatibility by negotiating supported features | 7.8 | 0.0015 | None reported |
| High | CVE-2025-40201 | kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths | 7.8 | 0.0015 | None reported |
| High | CVE-2025-40111 | drm/vmwgfx: Fix Use-after-free in validation | 7.8 | 0.0015 | None reported |
| Routine | CVE-2025-40040 | mm/ksm: fix flag-dropping behavior in ksm_madvise | 5.8 | 0.0038 | None reported |
| Routine | CVE-2025-40219 | PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV | 6.7 | 0.0024 | None reported |
| Routine | CVE-2025-40042 | tracing: Fix race condition in kprobe initialization causing NULL pointer dereference | 5.5 | 0.0023 | None reported |
| Routine | CVE-2025-40178 | pid: Add a judgment for ns null in pid_nr_ns | 5.5 | 0.0023 | None reported |
| Routine | CVE-2025-40179 | ext4: verify orphan file size is not too big | 5.5 | 0.0022 | None reported |
| Routine | CVE-2025-40231 | linux: In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transp... | 5.5 | 0.0022 | None reported |
| Routine | CVE-2025-40194 | cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() | 5.8 | 0.0021 | None reported |
| Routine | CVE-2025-40200 | Squashfs: reject negative file sizes in squashfs_read_inode() | 5.5 | 0.0021 | None reported |
Showing 1 to 25 of 30
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.