# ALAS2023-2025-1208: Security update for 22 packages

ALAS2023-2025-1208, released September 23, 2025, fixes 122 CVEs across 22 products. One of them is being exploited (CVE-2025-39682); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2025-1208
- Platform: Linux
- Released: Sep 23, 2025
- Priority: Patch now (Closes CVE-2025-39682, exploited (CISA KEV))
- CVEs: 122, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-1208.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [bpftool6.12](https://patchblox.com/security/data/product/linux/bpftool6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [bpftool6.12-debuginfo](https://patchblox.com/security/data/product/linux/bpftool6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel-livepatch-6.12.46-66.121](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.46-66.121.md) | amzn 2023 | 1:1.0-0.amzn2023 |
| [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-devel](https://patchblox.com/security/data/product/linux/kernel6.12-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-headers](https://patchblox.com/security/data/product/linux/kernel6.12-headers.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-libbpf](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-libbpf-static](https://patchblox.com/security/data/product/linux/kernel6.12-libbpf-static.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra-common.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-tools](https://patchblox.com/security/data/product/linux/kernel6.12-tools.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-tools-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [kernel6.12-tools-devel](https://patchblox.com/security/data/product/linux/kernel6.12-tools-devel.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |
| [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 1:6.12.46-66.121.amzn2023 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-39682](https://patchblox.com/security/data/cve/CVE-2025-39682.md) | Patch now | tls: fix handling of zero-length records on the rx_list | 9.8 | 0.0331 | CISA KEV |
| [CVE-2025-39898](https://patchblox.com/security/data/cve/CVE-2025-39898.md) | Urgent | e1000e: fix heap overflow in e1000_set_eeprom | 9.8 | n/a |  |
| [CVE-2025-38566](https://patchblox.com/security/data/cve/CVE-2025-38566.md) | High | sunrpc: fix handling of server side tls alerts | 8.1 | 0.0067 |  |
| [CVE-2025-39702](https://patchblox.com/security/data/cve/CVE-2025-39702.md) | High | ipv6: sr: Fix MAC comparison to be constant-time | 7.1 | 0.0045 |  |
| [CVE-2025-38563](https://patchblox.com/security/data/cve/CVE-2025-38563.md) | High | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0044 |  |
| [CVE-2025-38608](https://patchblox.com/security/data/cve/CVE-2025-38608.md) | High | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0044 |  |
| [CVE-2025-38590](https://patchblox.com/security/data/cve/CVE-2025-38590.md) | High | net/mlx5e: Remove skb secpath if xfrm state is not found | 7.5 | 0.0044 |  |
| [CVE-2025-38617](https://patchblox.com/security/data/cve/CVE-2025-38617.md) | High | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0043 |  |
| [CVE-2025-38676](https://patchblox.com/security/data/cve/CVE-2025-38676.md) | High | iommu/amd: Avoid stack buffer overflow from kernel cmdline | 7.8 | 0.0042 |  |
| [CVE-2025-38724](https://patchblox.com/security/data/cve/CVE-2025-38724.md) | High | nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() | 7.8 | 0.0041 |  |
| [CVE-2025-38660](https://patchblox.com/security/data/cve/CVE-2025-38660.md) | High | [ceph] parse_longname(): strrchr() expects NUL-terminated string | 7.1 | 0.0041 |  |
| [CVE-2025-39851](https://patchblox.com/security/data/cve/CVE-2025-39851.md) | High | vxlan: Fix NPD when refreshing an FDB entry with a nexthop object | 7.0 | 0.0040 |  |
| [CVE-2025-38708](https://patchblox.com/security/data/cve/CVE-2025-38708.md) | High | drbd: add missing kref_get in handle_write_conflicts | 7.8 | 0.0040 |  |
| [CVE-2025-38737](https://patchblox.com/security/data/cve/CVE-2025-38737.md) | High | kernel-uek64k-core: ELSA-2025-25754: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0039 |  |
| [CVE-2025-38571](https://patchblox.com/security/data/cve/CVE-2025-38571.md) | High | sunrpc: fix client side handling of tls alerts | 8.1 | 0.0037 |  |
| [CVE-2025-38728](https://patchblox.com/security/data/cve/CVE-2025-38728.md) | High | smb3: fix for slab out of bounds on mount to ksmbd | 7.1 | 0.0036 |  |
| [CVE-2025-39894](https://patchblox.com/security/data/cve/CVE-2025-39894.md) | High | kernel-64kb: netfilter: br_netfilter: do not check confirmed bit | 7.0 | 0.0033 |  |
| [CVE-2025-39866](https://patchblox.com/security/data/cve/CVE-2025-39866.md) | High | fs: writeback: fix use-after-free in __mark_inode_dirty() | 7.8 | 0.0031 |  |
| [CVE-2025-39798](https://patchblox.com/security/data/cve/CVE-2025-39798.md) | High | NFS: Fix the setting of capabilities when automounting a new filesystem | 7.0 | 0.0028 |  |
| [CVE-2025-22113](https://patchblox.com/security/data/cve/CVE-2025-22113.md) | High | ext4: avoid journaling sb update on error if journal is destroying | 7.8 | 0.0026 |  |
| [CVE-2025-39723](https://patchblox.com/security/data/cve/CVE-2025-39723.md) | High | kernel-64kb: kABI: netfs: handle new netfs_io_stream flag (bsc#1249314). | 7.8 | 0.0024 |  |
| [CVE-2025-39806](https://patchblox.com/security/data/cve/CVE-2025-39806.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 |  |
| [CVE-2025-39677](https://patchblox.com/security/data/cve/CVE-2025-39677.md) | High | net/sched: Fix backlog accounting in qdisc_dequeue_internal | 7.0 | 0.0021 |  |
| [CVE-2025-38616](https://patchblox.com/security/data/cve/CVE-2025-38616.md) | High | tls: handle data disappearing from under the TLS ULP | 7.1 | 0.0021 |  |
| [CVE-2025-39730](https://patchblox.com/security/data/cve/CVE-2025-39730.md) | High | NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() | 7.8 | 0.0021 |  |
| [CVE-2025-38565](https://patchblox.com/security/data/cve/CVE-2025-38565.md) | High | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0020 |  |
| [CVE-2025-38572](https://patchblox.com/security/data/cve/CVE-2025-38572.md) | High | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0020 |  |
| [CVE-2025-39698](https://patchblox.com/security/data/cve/CVE-2025-39698.md) | High | kernel-64kb: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (bsc#1249322). | 7.5 | 0.0020 |  |
| [CVE-2025-38702](https://patchblox.com/security/data/cve/CVE-2025-38702.md) | High | fbdev: fix potential buffer overflow in do_register_framebuffer() | 7.8 | 0.0020 |  |
| [CVE-2025-39850](https://patchblox.com/security/data/cve/CVE-2025-39850.md) | High | vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects | 7.0 | 0.0020 |  |
| [CVE-2025-38614](https://patchblox.com/security/data/cve/CVE-2025-38614.md) | High | eventpoll: Fix semi-unbounded recursion | 7.5 | 0.0020 |  |
| [CVE-2025-38615](https://patchblox.com/security/data/cve/CVE-2025-38615.md) | High | fs/ntfs3: cancle set bad inode after removing name fails | 9.8 | 0.0019 |  |
| [CVE-2025-39691](https://patchblox.com/security/data/cve/CVE-2025-39691.md) | High | fs/buffer: fix use-after-free when call bh_read() helper | 7.8 | 0.0019 |  |
| [CVE-2025-39766](https://patchblox.com/security/data/cve/CVE-2025-39766.md) | High | net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit | 8.1 | 0.0019 |  |
| [CVE-2025-39689](https://patchblox.com/security/data/cve/CVE-2025-39689.md) | High | ftrace: Also allocate and copy hash for reading of filter files | 7.8 | 0.0019 |  |
| [CVE-2025-39683](https://patchblox.com/security/data/cve/CVE-2025-39683.md) | High | tracing: Limit access to parser->buffer when trace_get_user failed | 7.1 | 0.0019 |  |
| [CVE-2025-38701](https://patchblox.com/security/data/cve/CVE-2025-38701.md) | High | ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | 7.0 | 0.0019 |  |
| [CVE-2025-38704](https://patchblox.com/security/data/cve/CVE-2025-38704.md) | High | rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access | 7.8 | 0.0019 |  |
| [CVE-2025-38453](https://patchblox.com/security/data/cve/CVE-2025-38453.md) | High | kernel-source: kABI: io_uring: msg_ring ensure io_kiocb freeing is deferred (bsc#1247234). | 7.8 | 0.0019 |  |
| [CVE-2025-38568](https://patchblox.com/security/data/cve/CVE-2025-38568.md) | High | net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing | 7.8 | 0.0019 |  |
| [CVE-2025-39760](https://patchblox.com/security/data/cve/CVE-2025-39760.md) | High | usb: core: config: Prevent OOB read in SS endpoint companion parsing | 7.8 | 0.0019 |  |
| [CVE-2025-38502](https://patchblox.com/security/data/cve/CVE-2025-38502.md) | High | bpf: Fix oob access in cgroup local storage | 7.1 | 0.0019 |  |
| [CVE-2025-38685](https://patchblox.com/security/data/cve/CVE-2025-38685.md) | High | fbdev: Fix vmalloc out-of-bounds write in fast_imageblit | 7.8 | 0.0019 |  |
| [CVE-2025-38618](https://patchblox.com/security/data/cve/CVE-2025-38618.md) | High | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 |  |
| [CVE-2025-39727](https://patchblox.com/security/data/cve/CVE-2025-39727.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0018 |  |
| [CVE-2025-38700](https://patchblox.com/security/data/cve/CVE-2025-38700.md) | High | scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated | 7.0 | 0.0018 |  |
| [CVE-2025-38732](https://patchblox.com/security/data/cve/CVE-2025-38732.md) | High | netfilter: nf_reject: don't leak dst refcount for loopback packets | 7.0 | 0.0018 |  |
| [CVE-2025-39738](https://patchblox.com/security/data/cve/CVE-2025-39738.md) | High | btrfs: do not allow relocation of partially dropped subvolumes | 7.8 | 0.0018 |  |
| [CVE-2025-38556](https://patchblox.com/security/data/cve/CVE-2025-38556.md) | High | HID: core: Harden s32ton() against conversion to 0 bits | 8.0 | 0.0018 |  |
| [CVE-2025-39823](https://patchblox.com/security/data/cve/CVE-2025-39823.md) | High | KVM: x86: use array_index_nospec with indices that come from guest | 7.8 | 0.0018 |  |
| [CVE-2025-39749](https://patchblox.com/security/data/cve/CVE-2025-39749.md) | High | rcu: Protect ->defer_qs_iw_pending from data race | 7.0 | 0.0018 |  |
| [CVE-2025-38500](https://patchblox.com/security/data/cve/CVE-2025-38500.md) | High | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0018 |  |
| [CVE-2025-38707](https://patchblox.com/security/data/cve/CVE-2025-38707.md) | High | fs/ntfs3: Add sanity check for file name | 7.8 | 0.0018 |  |
| [CVE-2025-38587](https://patchblox.com/security/data/cve/CVE-2025-38587.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0018 |  |
| [CVE-2025-38653](https://patchblox.com/security/data/cve/CVE-2025-38653.md) | High | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 |  |
| [CVE-2025-39783](https://patchblox.com/security/data/cve/CVE-2025-39783.md) | High | PCI: endpoint: Fix configfs group list head handling | 7.8 | 0.0017 |  |
| [CVE-2025-38730](https://patchblox.com/security/data/cve/CVE-2025-38730.md) | High | io_uring/net: commit partial buffers on retry | 7.8 | 0.0017 |  |
| [CVE-2025-39835](https://patchblox.com/security/data/cve/CVE-2025-39835.md) | High | xfs: do not propagate ENODATA disk errors into xattr code | 7.8 | 0.0017 |  |
| [CVE-2025-38718](https://patchblox.com/security/data/cve/CVE-2025-38718.md) | High | sctp: linearize cloned gso packets in sctp_rcv | 7.8 | 0.0017 |  |
| [CVE-2025-39744](https://patchblox.com/security/data/cve/CVE-2025-39744.md) | High | rcu: Fix rcu_read_unlock() deadloop due to IRQ work | 7.1 | 0.0017 |  |
| [CVE-2025-39718](https://patchblox.com/security/data/cve/CVE-2025-39718.md) | High | vsock/virtio: Validate length in packet header before skb_put() | 7.8 | 0.0017 |  |
| [CVE-2025-39824](https://patchblox.com/security/data/cve/CVE-2025-39824.md) | High | HID: asus: fix UAF via HID_CLAIMED_INPUT validation | 7.8 | 0.0017 |  |
| [CVE-2025-39902](https://patchblox.com/security/data/cve/CVE-2025-39902.md) | High | mm/slub: avoid accessing metadata when pointer is invalid in object_err() | 7.8 | 0.0017 |  |
| [CVE-2025-39817](https://patchblox.com/security/data/cve/CVE-2025-39817.md) | High | efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare | 7.6 | 0.0017 |  |
| [CVE-2025-38670](https://patchblox.com/security/data/cve/CVE-2025-38670.md) | High | arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() | 7.1 | 0.0017 |  |
| [CVE-2025-38692](https://patchblox.com/security/data/cve/CVE-2025-38692.md) | High | exfat: add cluster chain loop check for dir | 7.0 | 0.0017 |  |
| [CVE-2025-39797](https://patchblox.com/security/data/cve/CVE-2025-39797.md) | High | xfrm: Duplicate SPI Handling | 7.8 | 0.0016 |  |
| [CVE-2025-39838](https://patchblox.com/security/data/cve/CVE-2025-39838.md) | High | cifs: prevent NULL pointer dereference in UTF16 conversion | 7.0 | 0.0016 |  |
| [CVE-2025-39697](https://patchblox.com/security/data/cve/CVE-2025-39697.md) | High | NFS: Fix a race when updating an existing write | 7.6 | 0.0016 |  |
| [CVE-2025-38665](https://patchblox.com/security/data/cve/CVE-2025-38665.md) | High | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 |  |
| [CVE-2025-38709](https://patchblox.com/security/data/cve/CVE-2025-38709.md) | High | loop: Avoid updating block size under exclusive owner | 7.0 | 0.0016 |  |
| [CVE-2025-39725](https://patchblox.com/security/data/cve/CVE-2025-39725.md) | High | kernel-uek: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] | 7.0 | 0.0015 |  |
| [CVE-2025-39819](https://patchblox.com/security/data/cve/CVE-2025-39819.md) | High | fs/smb: Fix inconsistent refcnt update | 7.6 | 0.0015 |  |
| [CVE-2025-39903](https://patchblox.com/security/data/cve/CVE-2025-39903.md) | High | kernel-64kb: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749). | 7.3 | 0.0015 |  |
| [CVE-2025-39900](https://patchblox.com/security/data/cve/CVE-2025-39900.md) | High | kernel-default-base: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758). | 7.0 | 0.0015 |  |
| [CVE-2025-39759](https://patchblox.com/security/data/cve/CVE-2025-39759.md) | High | btrfs: qgroup: fix race between quota disable and quota rescan ioctl | 7.0 | 0.0012 |  |
| [CVE-2025-39825](https://patchblox.com/security/data/cve/CVE-2025-39825.md) | High | smb: client: fix race with concurrent opens in rename(2) | 7.6 | 0.0012 |  |
| [CVE-2025-39843](https://patchblox.com/security/data/cve/CVE-2025-39843.md) | High | mm: slub: avoid wake up kswapd in set_track_prepare | 7.8 | 0.0012 |  |
| [CVE-2025-39832](https://patchblox.com/security/data/cve/CVE-2025-39832.md) | High | net/mlx5: Fix lockdep assertion on sync reset unload event | 7.0 | 0.0012 |  |
| [CVE-2025-39770](https://patchblox.com/security/data/cve/CVE-2025-39770.md) | Routine | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM | 5.7 | 0.0039 |  |
| [CVE-2025-22103](https://patchblox.com/security/data/cve/CVE-2025-22103.md) | Routine | kernel-64kb: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448). | 5.5 | 0.0021 |  |
| [CVE-2025-22124](https://patchblox.com/security/data/cve/CVE-2025-22124.md) | Routine | md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb | 6.0 | 0.0020 |  |
| [CVE-2025-22125](https://patchblox.com/security/data/cve/CVE-2025-22125.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-38691](https://patchblox.com/security/data/cve/CVE-2025-38691.md) | Routine | pNFS: Fix uninited ptr deref in block/scsi layout | 6.2 | 0.0019 |  |
| [CVE-2025-39756](https://patchblox.com/security/data/cve/CVE-2025-39756.md) | Routine | fs: Prevent file descriptor table allocations exceeding INT_MAX | 5.5 | 0.0019 |  |
| [CVE-2025-39829](https://patchblox.com/security/data/cve/CVE-2025-39829.md) | Routine | trace/fgraph: Fix the warning caused by missing unregister notifier | 5.5 | 0.0019 |  |
| [CVE-2025-38586](https://patchblox.com/security/data/cve/CVE-2025-38586.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-38639](https://patchblox.com/security/data/cve/CVE-2025-38639.md) | Routine | netfilter: xt_nfacct: don't assume acct name is null-terminated | 5.5 | 0.0019 |  |
| [CVE-2025-38622](https://patchblox.com/security/data/cve/CVE-2025-38622.md) | Routine | net: drop UFO packets in udp_rcv_segment() | 5.5 | 0.0018 |  |
| [CVE-2025-38683](https://patchblox.com/security/data/cve/CVE-2025-38683.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 |  |
| [CVE-2025-39681](https://patchblox.com/security/data/cve/CVE-2025-39681.md) | Routine | x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper | 5.5 | 0.0018 |  |
| [CVE-2025-39724](https://patchblox.com/security/data/cve/CVE-2025-39724.md) | Routine | serial: 8250: fix panic due to PSLVERR | 5.5 | 0.0018 |  |
| [CVE-2025-39748](https://patchblox.com/security/data/cve/CVE-2025-39748.md) | Routine | bpf: Forget ranges when refining tnum after JSET | 5.5 | 0.0018 |  |
| [CVE-2025-38588](https://patchblox.com/security/data/cve/CVE-2025-38588.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 |  |
| [CVE-2025-38721](https://patchblox.com/security/data/cve/CVE-2025-38721.md) | Routine | netfilter: ctnetlink: fix refcount leak on table dump | 5.5 | 0.0018 |  |
| [CVE-2025-39812](https://patchblox.com/security/data/cve/CVE-2025-39812.md) | Routine | sctp: initialize more fields in sctp_v6_from_sk() | 5.5 | 0.0018 |  |
| [CVE-2025-38640](https://patchblox.com/security/data/cve/CVE-2025-38640.md) | Routine | bpf: Disable migration in nf_hook_run_bpf(). | 5.5 | 0.0017 |  |
| [CVE-2025-39795](https://patchblox.com/security/data/cve/CVE-2025-39795.md) | Routine | block: avoid possible overflow for chunk_sectors check in blk_stack_limits() | 5.5 | 0.0017 |  |
| [CVE-2025-38645](https://patchblox.com/security/data/cve/CVE-2025-38645.md) | Routine | net/mlx5: Check device memory pointer before usage | 5.5 | 0.0017 |  |
| [CVE-2025-39763](https://patchblox.com/security/data/cve/CVE-2025-39763.md) | Routine | ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered | 5.5 | 0.0017 |  |
| [CVE-2025-38686](https://patchblox.com/security/data/cve/CVE-2025-38686.md) | Routine | kernel-64kb: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (bsc#1249160). | 5.5 | 0.0017 |  |
| [CVE-2025-39700](https://patchblox.com/security/data/cve/CVE-2025-39700.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2025-39779](https://patchblox.com/security/data/cve/CVE-2025-39779.md) | Routine | btrfs: subpage: keep TOWRITE tag until folio is cleaned | 5.5 | 0.0016 |  |
| [CVE-2025-39780](https://patchblox.com/security/data/cve/CVE-2025-39780.md) | Routine | kernel-uek: ELSA-2025-25754: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0016 |  |
| [CVE-2025-39792](https://patchblox.com/security/data/cve/CVE-2025-39792.md) | Routine | kernel-64kb: dm: Always split write BIOs to zoned device limits (bsc#1249618). | 5.5 | 0.0016 |  |
| [CVE-2025-39800](https://patchblox.com/security/data/cve/CVE-2025-39800.md) | Routine | btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() | 5.5 | 0.0016 |  |
| [CVE-2025-39845](https://patchblox.com/security/data/cve/CVE-2025-39845.md) | Routine | x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() | 5.5 | 0.0016 |  |
| [CVE-2025-39734](https://patchblox.com/security/data/cve/CVE-2025-39734.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  Revert "fs/ntfs3: Replace inode_trylock with ino... | 5.5 | 0.0016 |  |
| [CVE-2025-39844](https://patchblox.com/security/data/cve/CVE-2025-39844.md) | Routine | mm: move page table sync declarations to linux/pgtable.h | 5.5 | 0.0015 |  |
| [CVE-2025-39895](https://patchblox.com/security/data/cve/CVE-2025-39895.md) | Routine | sched: Fix sched_numa_find_nth_cpu() if mask offline | 5.5 | 0.0015 |  |
| [CVE-2025-39754](https://patchblox.com/security/data/cve/CVE-2025-39754.md) | Routine | mm/smaps: fix race between smaps_hugetlb_range and migration | 5.5 | 0.0015 |  |
| [CVE-2025-39852](https://patchblox.com/security/data/cve/CVE-2025-39852.md) | Routine | kernel-64kb: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (bsc#1250258). | 5.5 | 0.0015 |  |
| [CVE-2025-39899](https://patchblox.com/security/data/cve/CVE-2025-39899.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0015 |  |
| [CVE-2025-38632](https://patchblox.com/security/data/cve/CVE-2025-38632.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0014 |  |
| [CVE-2025-39782](https://patchblox.com/security/data/cve/CVE-2025-39782.md) | Routine | kernel-64kb: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526). | 5.5 | 0.0014 |  |
| [CVE-2025-39791](https://patchblox.com/security/data/cve/CVE-2025-39791.md) | Routine | kernel-64kb: dm: dm-crypt: Do not partially accept write BIOs with zoned targets (bsc#1249550). | 5.5 | 0.0014 |  |
| [CVE-2025-38681](https://patchblox.com/security/data/cve/CVE-2025-38681.md) | Routine | mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() | 5.5 | 0.0014 |  |
| [CVE-2025-39773](https://patchblox.com/security/data/cve/CVE-2025-39773.md) | Routine | net: bridge: fix soft lockup in br_multicast_query_expired() | 5.5 | 0.0013 |  |
| [CVE-2025-38675](https://patchblox.com/security/data/cve/CVE-2025-38675.md) | Routine | kernel-uek: xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] | 5.9 | 0.0012 |  |
| [CVE-2025-38717](https://patchblox.com/security/data/cve/CVE-2025-38717.md) | Routine | net: kcm: Fix race condition in kcm_unattach() | 5.5 | 0.0012 |  |
| [CVE-2025-39813](https://patchblox.com/security/data/cve/CVE-2025-39813.md) | Routine | ftrace: Fix potential warning in trace_printk_seq during ftrace_dump | 5.5 | 0.0012 |  |
| [CVE-2025-38553](https://patchblox.com/security/data/cve/CVE-2025-38553.md) | Routine | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.