# ALAS2023-2025-948: Security update for 22 packages ALAS2023-2025-948, released April 23, 2025, fixes 38 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alas2023-2025-948 - Platform: Linux - Released: Apr 23, 2025 - Priority: High (Closes CVE-2025-22056, high severity) - CVEs: 38, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2025-948.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [bpftool-debuginfo](https://patchblox.com/security/data/product/linux/bpftool-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-devel](https://patchblox.com/security/data/product/linux/kernel-devel.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-headers](https://patchblox.com/security/data/product/linux/kernel-headers.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-libbpf](https://patchblox.com/security/data/product/linux/kernel-libbpf.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-libbpf-debuginfo](https://patchblox.com/security/data/product/linux/kernel-libbpf-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-libbpf-devel](https://patchblox.com/security/data/product/linux/kernel-libbpf-devel.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-libbpf-static](https://patchblox.com/security/data/product/linux/kernel-libbpf-static.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-livepatch-6.12.23-29.97](https://patchblox.com/security/data/product/linux/kernel-livepatch-6.12.23-29.97.md) | amzn 2023 | 1.0-0.amzn2023 | | [kernel-modules-extra-common](https://patchblox.com/security/data/product/linux/kernel-modules-extra-common.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-tools](https://patchblox.com/security/data/product/linux/kernel-tools.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-tools-debuginfo](https://patchblox.com/security/data/product/linux/kernel-tools-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel-tools-devel](https://patchblox.com/security/data/product/linux/kernel-tools-devel.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel6.12](https://patchblox.com/security/data/product/linux/kernel6.12.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel6.12-debuginfo](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel6.12-debuginfo-common-aarch64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-aarch64.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel6.12-debuginfo-common-x86_64](https://patchblox.com/security/data/product/linux/kernel6.12-debuginfo-common-x86-64.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [kernel6.12-modules-extra](https://patchblox.com/security/data/product/linux/kernel6.12-modules-extra.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [perf6.12](https://patchblox.com/security/data/product/linux/perf6.12.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/perf6.12-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [python3-perf6.12](https://patchblox.com/security/data/product/linux/python3-perf6.12.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | | [python3-perf6.12-debuginfo](https://patchblox.com/security/data/product/linux/python3-perf6.12-debuginfo.md) | amzn 2023 | 6.12.23-29.97.amzn2023 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-22056](https://patchblox.com/security/data/cve/CVE-2025-22056.md) | High | kernel-64kb: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525). | 7.8 | 0.0033 | | | [CVE-2025-37785](https://patchblox.com/security/data/cve/CVE-2025-37785.md) | High | kernel-64kb: ext4: fix OOB read when checking dotdot dir (bsc#1241640). | 7.1 | 0.0031 | | | [CVE-2025-22035](https://patchblox.com/security/data/cve/CVE-2025-22035.md) | High | kernel-64kb: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544). | 7.8 | 0.0031 | | | [CVE-2025-22063](https://patchblox.com/security/data/cve/CVE-2025-22063.md) | High | kernel-64kb: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351). | 7.8 | 0.0030 | | | [CVE-2025-22055](https://patchblox.com/security/data/cve/CVE-2025-22055.md) | High | kernel-64kb: net: fix geneve_opt length integer overflow (bsc#1241371). | 7.1 | 0.0026 | | | [CVE-2025-22087](https://patchblox.com/security/data/cve/CVE-2025-22087.md) | High | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0024 | | | [CVE-2024-58093](https://patchblox.com/security/data/cve/CVE-2024-58093.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel-64kb: udp: Fix memory accounting leak (bsc#1241332). | 7.3 | 0.0024 | | | [CVE-2025-21751](https://patchblox.com/security/data/cve/CVE-2025-21751.md) | High | bpftool: ELSA-2026-500574: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0023 | | | [CVE-2025-22085](https://patchblox.com/security/data/cve/CVE-2025-22085.md) | High | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0021 | | | [CVE-2025-22091](https://patchblox.com/security/data/cve/CVE-2025-22091.md) | High | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0021 | | | [CVE-2025-22036](https://patchblox.com/security/data/cve/CVE-2025-22036.md) | High | kernel-64kb: exfat: fix random stack corruption after get_block (bsc#1241426). | 7.0 | 0.0020 | | | [CVE-2025-39688](https://patchblox.com/security/data/cve/CVE-2025-39688.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0062 | | | [CVE-2025-22025](https://patchblox.com/security/data/cve/CVE-2025-22025.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0059 | | | [CVE-2025-22059](https://patchblox.com/security/data/cve/CVE-2025-22059.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.7 | 0.0049 | | | [CVE-2025-38637](https://patchblox.com/security/data/cve/CVE-2025-38637.md) | Routine | kernel-64kb: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657). | 5.5 | 0.0033 | | | [CVE-2025-22062](https://patchblox.com/security/data/cve/CVE-2025-22062.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-22086](https://patchblox.com/security/data/cve/CVE-2025-22086.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-22034](https://patchblox.com/security/data/cve/CVE-2025-22034.md) | Routine | kernel-64kb: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435). | 5.5 | 0.0028 | | | [CVE-2025-22064](https://patchblox.com/security/data/cve/CVE-2025-22064.md) | Routine | kernel-64kb: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413). | 5.5 | 0.0027 | | | [CVE-2025-39989](https://patchblox.com/security/data/cve/CVE-2025-39989.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0025 | | | [CVE-2025-22045](https://patchblox.com/security/data/cve/CVE-2025-22045.md) | Routine | kernel-64kb: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433). | 5.5 | 0.0024 | | | [CVE-2025-23136](https://patchblox.com/security/data/cve/CVE-2025-23136.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-22080](https://patchblox.com/security/data/cve/CVE-2025-22080.md) | Routine | kernel-64kb: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416). | 5.5 | 0.0022 | | | [CVE-2025-22044](https://patchblox.com/security/data/cve/CVE-2025-22044.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22057](https://patchblox.com/security/data/cve/CVE-2025-22057.md) | Routine | net: decrease cached dst counters in dst_release | 6.6 | 0.0022 | | | [CVE-2025-22075](https://patchblox.com/security/data/cve/CVE-2025-22075.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.1 | 0.0022 | | | [CVE-2025-22081](https://patchblox.com/security/data/cve/CVE-2025-22081.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0022 | | | [CVE-2025-22089](https://patchblox.com/security/data/cve/CVE-2025-22089.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22090](https://patchblox.com/security/data/cve/CVE-2025-22090.md) | Routine | x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() | 5.5 | 0.0022 | | | [CVE-2025-22047](https://patchblox.com/security/data/cve/CVE-2025-22047.md) | Routine | kernel-default: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-23138](https://patchblox.com/security/data/cve/CVE-2025-23138.md) | Routine | kernel-64kb: watch_queue: fix pipe accounting mismatch (bsc#1241648). | 5.5 | 0.0022 | | | [CVE-2025-22033](https://patchblox.com/security/data/cve/CVE-2025-22033.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22046](https://patchblox.com/security/data/cve/CVE-2025-22046.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0021 | | | [CVE-2025-22076](https://patchblox.com/security/data/cve/CVE-2025-22076.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0021 | | | [CVE-2025-22030](https://patchblox.com/security/data/cve/CVE-2025-22030.md) | Routine | kernel-64kb: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376). | 5.5 | 0.0020 | | | [CVE-2025-22024](https://patchblox.com/security/data/cve/CVE-2025-22024.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0020 | | | [CVE-2025-22027](https://patchblox.com/security/data/cve/CVE-2025-22027.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0017 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.