Linux · Amazon Linux · Security advisory · March 13, 2025

ALAS2023-2025-901: Security update for 21 packages

ALAS2023-2025-901, released March 13, 2025, fixes 18 CVEs across 21 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
18
1 rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0062
50th percentile

Priority of the 18 CVEs

Patch now 0 Urgent 1 High 10 Routine 7

Fixed package versions

ProductReleaseFixed in
bpftoolamzn 20236.1.130-139.222.amzn2023
bpftool-debuginfoamzn 20236.1.130-139.222.amzn2023
kernelamzn 20236.1.130-139.222.amzn2023
kernel-debuginfoamzn 20236.1.130-139.222.amzn2023
kernel-debuginfo-common-aarch64amzn 20236.1.130-139.222.amzn2023
kernel-debuginfo-common-x86_64amzn 20236.1.130-139.222.amzn2023
kernel-develamzn 20236.1.130-139.222.amzn2023
kernel-headersamzn 20236.1.130-139.222.amzn2023
kernel-libbpfamzn 20236.1.130-139.222.amzn2023
kernel-libbpf-develamzn 20236.1.130-139.222.amzn2023
kernel-libbpf-staticamzn 20236.1.130-139.222.amzn2023
kernel-livepatch-6.1.130-139.222amzn 20231.0-0.amzn2023
kernel-modules-extraamzn 20236.1.130-139.222.amzn2023
kernel-modules-extra-commonamzn 20236.1.130-139.222.amzn2023
kernel-toolsamzn 20236.1.130-139.222.amzn2023
kernel-tools-debuginfoamzn 20236.1.130-139.222.amzn2023
kernel-tools-develamzn 20236.1.130-139.222.amzn2023
perfamzn 20236.1.130-139.222.amzn2023
perf-debuginfoamzn 20236.1.130-139.222.amzn2023
python3-perfamzn 20236.1.130-139.222.amzn2023
python3-perf-debuginfoamzn 20236.1.130-139.222.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2025-21858 kernel-64kb: Security update for the Linux Kernel8.8 0.0025 None reported
High CVE-2025-21844 kernel-64kb: smb: client: Add check for next_buffer in receive_encrypted_standard() (bsc#1239512).7.8 0.0062 None reported
High CVE-2024-53179 kernel-azure: smb: client: fix use-after-free of signing key (bsc#1234921).7.8 0.0062 None reported
High CVE-2023-52927 kernel-64kb: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).7.8 0.0032 None reported
High CVE-2025-21702 kernel-64kb: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).7.8 0.0028 None reported
High CVE-2025-21864 kernel-64kb: kABI fix for tcp: drop secpath at the same time as we currently drop (bsc#1239482).7.8 0.0028 None reported
High CVE-2024-58005 kernel-64k-debug-modules-extra: kernel: tpm: Change to kvalloc() in eventlog/acpi.c7.8 0.0025 None reported
High CVE-2025-21846 kernel-64kb: Security update for the Linux Kernel7.8 0.0025 None reported
High CVE-2025-21887 kernel-64kb: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).7.8 0.0022 None reported
High CVE-2025-21867 kernel-64kb: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).7.8 0.0021 None reported
High CVE-2024-57977 kernel-64k-modules-core: kernel: memcg: fix soft lockup in the OOM process7.8 0.0020 None reported
Routine CVE-2025-21875 kernel-64kb: mptcp: always handle address removal under msk socket lock (bsc#1240168).5.5 0.0026 None reported
Routine CVE-2024-58090 kernel-64kb: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).5.5 0.0023 None reported
Routine CVE-2025-21899 tracing: Fix bad hist from corrupting named_triggers list6.0 0.0023 None reported
Routine CVE-2025-21898 kernel-64kb: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).5.5 0.0023 None reported
Routine CVE-2025-21712 md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime5.5 0.0022 None reported
Routine CVE-2025-21881 uprobes: Reject the shared zeropage in uprobe_write_opcode()5.5 0.0022 None reported
Routine CVE-2025-21891 ipvlan: ensure network headers are in skb linear part5.5 0.0021 None reported
Showing 1 to 18 of 18 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.