# ALAS2023-2025-947: Security update for 22 packages ALAS2023-2025-947, released April 23, 2025, fixes 22 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-947 - Platform: Linux - Released: Apr 23, 2025 - Priority: High (Closes CVE-2025-21759, high severity) - CVEs: 22, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-947.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel](https://patchblox.com/security/data/product/linux/kernel.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-debuginfo](https://patchblox.com/security/data/product/linux/kernel-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-aarch64.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel-debuginfo-common-x86-64.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-livepatch-6.1.134-150.224](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.1.134-150.224.md) | amzn 2023 | 1.0-0.amzn2023 | | [kernel-modules-extra](https://patchblox.com/security/data/product/linux/kernel-modules-extra.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [perf](https://patchblox.com/security/data/product/linux/perf.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [perf-debuginfo](https://patchblox.com/security/data/product/linux/perf-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [python3-perf](https://patchblox.com/security/data/product/linux/python3-perf.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | | [python3-perf-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf-debuginfo.md) | amzn 2023 | 6.1.134-150.224.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-21759](https://patchblox.com/security/data/cve/CVE-2025-21759.md) | High | kernel-64kb: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). | 7.8 | 0.0780 | | | [CVE-2025-22056](https://patchblox.com/security/data/cve/CVE-2025-22056.md) | High | kernel-64kb: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525). | 7.8 | 0.0033 | | | [CVE-2025-37785](https://patchblox.com/security/data/cve/CVE-2025-37785.md) | High | kernel-64kb: ext4: fix OOB read when checking dotdot dir (bsc#1241640). | 7.1 | 0.0032 | | | [CVE-2025-22035](https://patchblox.com/security/data/cve/CVE-2025-22035.md) | High | kernel-64kb: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544). | 7.8 | 0.0031 | | | [CVE-2025-22063](https://patchblox.com/security/data/cve/CVE-2025-22063.md) | High | kernel-64kb: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351). | 7.8 | 0.0030 | | | [CVE-2025-22055](https://patchblox.com/security/data/cve/CVE-2025-22055.md) | High | kernel-64kb: net: fix geneve_opt length integer overflow (bsc#1241371). | 7.1 | 0.0026 | | | [CVE-2024-58093](https://patchblox.com/security/data/cve/CVE-2024-58093.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel-64kb: udp: Fix memory accounting leak (bsc#1241332). | 7.3 | 0.0024 | | | [CVE-2025-22025](https://patchblox.com/security/data/cve/CVE-2025-22025.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0059 | | | [CVE-2025-22021](https://patchblox.com/security/data/cve/CVE-2025-22021.md) | Routine | kernel-64kb: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282). | 5.5 | 0.0048 | | | [CVE-2025-38637](https://patchblox.com/security/data/cve/CVE-2025-38637.md) | Routine | kernel-64kb: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657). | 5.5 | 0.0034 | | | [CVE-2025-22086](https://patchblox.com/security/data/cve/CVE-2025-22086.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2024-46753](https://patchblox.com/security/data/cve/CVE-2024-46753.md) | Routine | dtb-aarch64: btrfs: handle errors from btrfs_dec_ref() properly (bsc#1230796). | 5.5 | 0.0026 | | | [CVE-2025-22045](https://patchblox.com/security/data/cve/CVE-2025-22045.md) | Routine | kernel-64kb: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433). | 5.5 | 0.0024 | | | [CVE-2025-23136](https://patchblox.com/security/data/cve/CVE-2025-23136.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-22044](https://patchblox.com/security/data/cve/CVE-2025-22044.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22075](https://patchblox.com/security/data/cve/CVE-2025-22075.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.1 | 0.0022 | | | [CVE-2025-22081](https://patchblox.com/security/data/cve/CVE-2025-22081.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0022 | | | [CVE-2025-22089](https://patchblox.com/security/data/cve/CVE-2025-22089.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-23138](https://patchblox.com/security/data/cve/CVE-2025-23138.md) | Routine | kernel-64kb: watch_queue: fix pipe accounting mismatch (bsc#1241648). | 5.5 | 0.0022 | | | [CVE-2025-22033](https://patchblox.com/security/data/cve/CVE-2025-22033.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22027](https://patchblox.com/security/data/cve/CVE-2025-22027.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0017 | | --- Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.