# ALAS2023-2025-836: Security update for 21 packages ALAS2023-2025-836, released January 30, 2025, fixes 38 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-836 - Platform: Linux - Released: Jan 30, 2025 - Priority: High (Closes CVE-2024-40920, high severity) - CVEs: 38, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-836.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-livepatch-6.1.96-102.177](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.96-102.177.md) | amzn 2023 | 1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 6.1.96-102.177.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-40920](https://patchblox.com/security/data/cve/CVE-2024-40920.md) | High | kernel-default-base: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (bsc#1227781). | 7.8 | 0.0041 | | | [CVE-2024-40901](https://patchblox.com/security/data/cve/CVE-2024-40901.md) | High | dtb-aarch64: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762). | 7.8 | 0.0031 | | | [CVE-2024-40989](https://patchblox.com/security/data/cve/CVE-2024-40989.md) | High | KVM: arm64: Disassociate vcpus from redistributor region on teardown | 7.8 | 0.0030 | | | [CVE-2024-41000](https://patchblox.com/security/data/cve/CVE-2024-41000.md) | High | dtb-aarch64: block/ioctl: prefer different overflow check (bsc#1227867). | 7.8 | 0.0030 | | | [CVE-2024-39499](https://patchblox.com/security/data/cve/CVE-2024-39499.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0030 | | | [CVE-2024-40927](https://patchblox.com/security/data/cve/CVE-2024-40927.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0029 | | | [CVE-2024-40904](https://patchblox.com/security/data/cve/CVE-2024-40904.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0029 | | | [CVE-2024-39496](https://patchblox.com/security/data/cve/CVE-2024-39496.md) | High | dtb-aarch64: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719). | 7.8 | 0.0029 | | | [CVE-2024-40913](https://patchblox.com/security/data/cve/CVE-2024-40913.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0029 | | | [CVE-2024-40995](https://patchblox.com/security/data/cve/CVE-2024-40995.md) | High | dtb-aarch64: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830). | 7.8 | 0.0029 | | | [CVE-2024-40900](https://patchblox.com/security/data/cve/CVE-2024-40900.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0028 | | | [CVE-2024-36978](https://patchblox.com/security/data/cve/CVE-2024-36978.md) | High | kernel-devel: Important: kernel security update | 7.8 | 0.0028 | | | [CVE-2024-40996](https://patchblox.com/security/data/cve/CVE-2024-40996.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskb_pull_reason syzkaller... | 7.8 | 0.0028 | | | [CVE-2024-40959](https://patchblox.com/security/data/cve/CVE-2024-40959.md) | High | dtb-aarch64: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884). | 7.8 | 0.0028 | | | [CVE-2024-40960](https://patchblox.com/security/data/cve/CVE-2024-40960.md) | High | dtb-aarch64: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813). | 7.8 | 0.0027 | | | [CVE-2024-40958](https://patchblox.com/security/data/cve/CVE-2024-40958.md) | High | kernel-default-base: netns: Make get_net_ns() handle zero refcount net (bsc#1227812). | 7.8 | 0.0027 | | | [CVE-2024-40935](https://patchblox.com/security/data/cve/CVE-2024-40935.md) | High | dtb-aarch64: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797). | 7.8 | 0.0026 | | | [CVE-2024-40954](https://patchblox.com/security/data/cve/CVE-2024-40954.md) | High | dtb-aarch64: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) | 7.8 | 0.0026 | | | [CVE-2024-40931](https://patchblox.com/security/data/cve/CVE-2024-40931.md) | High | dtb-aarch64: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780). | 7.8 | 0.0025 | | | [CVE-2024-38619](https://patchblox.com/security/data/cve/CVE-2024-38619.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2024-39503](https://patchblox.com/security/data/cve/CVE-2024-39503.md) | High | bpftool: kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type | 7.0 | 0.0022 | | | [CVE-2024-40957](https://patchblox.com/security/data/cve/CVE-2024-40957.md) | Routine | kernel-64kb: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (bsc#1227811). | 5.5 | 0.0073 | | | [CVE-2024-39509](https://patchblox.com/security/data/cve/CVE-2024-39509.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2024-40924](https://patchblox.com/security/data/cve/CVE-2024-40924.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2024-40984](https://patchblox.com/security/data/cve/CVE-2024-40984.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2024-40921](https://patchblox.com/security/data/cve/CVE-2024-40921.md) | Routine | dtb-aarch64: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (bsc#1227784). | 5.5 | 0.0029 | | | [CVE-2024-40966](https://patchblox.com/security/data/cve/CVE-2024-40966.md) | Routine | tty: add the option to have a tty reject a new ldisc | 5.5 | 0.0029 | | | [CVE-2024-40908](https://patchblox.com/security/data/cve/CVE-2024-40908.md) | Routine | kernel-source: bpf: Set run context for rawtp test_run callback (bsc#1227783). | 5.5 | 0.0028 | | | [CVE-2024-40914](https://patchblox.com/security/data/cve/CVE-2024-40914.md) | Routine | dtb-aarch64: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842). | 5.5 | 0.0028 | | | [CVE-2024-41001](https://patchblox.com/security/data/cve/CVE-2024-41001.md) | Routine | kernel-livepatch-SLE15-SP6_Update_4: Security update for the Linux Kernel | 5.5 | 0.0027 | | | [CVE-2024-40905](https://patchblox.com/security/data/cve/CVE-2024-40905.md) | Routine | dtb-aarch64: ipv6: fix possible race in __fib6_drop_pcpu_from() (bsc#1227761) | 4.7 | 0.0027 | | | [CVE-2024-40961](https://patchblox.com/security/data/cve/CVE-2024-40961.md) | Routine | kernel-64kb: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814). | 5.5 | 0.0027 | | | [CVE-2024-40948](https://patchblox.com/security/data/cve/CVE-2024-40948.md) | Routine | dtb-aarch64: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801). | 5.5 | 0.0025 | | | [CVE-2024-39298](https://patchblox.com/security/data/cve/CVE-2024-39298.md) | Routine | kernel-64kb: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082). | 5.5 | 0.0023 | | | [CVE-2024-39371](https://patchblox.com/security/data/cve/CVE-2024-39371.md) | Routine | dtb-aarch64: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990). | 5.5 | 0.0022 | | | [CVE-2024-39474](https://patchblox.com/security/data/cve/CVE-2024-39474.md) | Routine | kernel-default: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL (bsc#1227434). | 5.5 | 0.0022 | | | [CVE-2024-39500](https://patchblox.com/security/data/cve/CVE-2024-39500.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2024-40953](https://patchblox.com/security/data/cve/CVE-2024-40953.md) | Routine | dtb-aarch64: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806). | 4.7 | 0.0020 | | --- Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.