Linux · Amazon Linux · Security advisory · December 8, 2025

ALAS2023-2025-1316: Security update for 22 packages

ALAS2023-2025-1316, released December 8, 2025, fixes 40 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
40
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0064
50th percentile

Priority of the 40 CVEs

Patch now 0 Urgent 0 High 26 Routine 14

Fixed package versions

ProductReleaseFixed in
bpftool6.12amzn 20231:6.12.55-74.119.amzn2023
bpftool6.12-debuginfoamzn 20231:6.12.55-74.119.amzn2023
kernel-livepatch-6.12.55-74.119amzn 20231:1.0-0.amzn2023
kernel6.12amzn 20231:6.12.55-74.119.amzn2023
kernel6.12-debuginfoamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-debuginfo-common-aarch64amzn 20231:6.12.55-74.119.amzn2023
kernel6.12-debuginfo-common-x86_64amzn 20231:6.12.55-74.119.amzn2023
kernel6.12-develamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-headersamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-libbpfamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-libbpf-debuginfoamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-libbpf-develamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-libbpf-staticamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-modules-extraamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-modules-extra-commonamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-toolsamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-tools-debuginfoamzn 20231:6.12.55-74.119.amzn2023
kernel6.12-tools-develamzn 20231:6.12.55-74.119.amzn2023
perf6.12amzn 20231:6.12.55-74.119.amzn2023
perf6.12-debuginfoamzn 20231:6.12.55-74.119.amzn2023
python3-perf6.12amzn 20231:6.12.55-74.119.amzn2023
python3-perf6.12-debuginfoamzn 20231:6.12.55-74.119.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-40187 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()7.5 0.0064 None reported
High CVE-2025-40183 linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_...7.5 0.0063 None reported
High CVE-2025-40133 linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in m...8.1 0.0051 None reported
High CVE-2025-40176 tls: wait for pending async decryptions if tls_strp_msg_hold fails9.8 0.0049 None reported
High CVE-2025-40204 sctp: Fix MAC comparison to be constant-time8.1 0.0047 None reported
High CVE-2025-40099 cifs: parse_dfs_referrals: prevent oob on malformed input9.4 0.0041 None reported
High CVE-2025-40019 crypto: essiv - Check ssize for decryption and in-place encryption7.0 0.0029 None reported
High CVE-2025-40181 linux: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overri...n/a 0.0021 None reported
High CVE-2025-40103 smb: client: Fix refcount leak for cifs_sb_tlink7.1 0.0021 None reported
High CVE-2025-40196 linux: In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_...n/a 0.0021 None reported
High CVE-2025-40160 linux: In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Chan...n/a 0.0020 None reported
High CVE-2025-40101 linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SIN...n/a 0.0020 None reported
High CVE-2025-40190 ext4: guard against EA inode refcount underflow in xattr update7.8 0.0018 None reported
High CVE-2025-40105 vfs: Don't leak disconnected dentries on umount7.8 0.0017 None reported
High CVE-2025-40167 ext4: detect invalid INLINE_DATA + EXTENTS flag combination7.8 0.0017 None reported
High CVE-2025-40198 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()7.8 0.0017 None reported
High CVE-2025-40173 net/ip6_tunnel: Prevent perpetual tunnel growth7.8 0.0015 None reported
High CVE-2025-40205 btrfs: avoid potential out-of-bounds in btrfs_encode_fh()7.8 0.0015 None reported
High CVE-2025-40206 netfilter: nft_objref: validate objref and objrefmap expressions7.8 0.0015 None reported
High CVE-2025-40104 ixgbevf: fix mailbox API compatibility by negotiating supported features7.8 0.0015 None reported
High CVE-2025-40201 kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths7.8 0.0015 None reported
High CVE-2025-40159 linux: In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validati...7.8 0.0015 None reported
High CVE-2025-40199 linux: In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing o...7.8 0.0015 None reported
High CVE-2025-40203 linux: In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace...7.8 0.0015 None reported
High CVE-2025-40111 drm/vmwgfx: Fix Use-after-free in validation7.8 0.0015 None reported
Showing 1 to 25 of 40 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.