Linux · 
Amazon Linux · Security advisory · March 26, 2025
Amazon Linux · Security advisory · March 26, 2025ALAS2023-2025-915: Security update for 22 packages
ALAS2023-2025-915, released March 26, 2025, fixes 25 CVEs across 22 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
25
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.3800
98th percentile
Priority of the 25 CVEs
Patch now 0
Urgent 0
High 19
Routine 6
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| bpftool | amzn 2023 | 6.1.131-143.221.amzn2023 |
| bpftool-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-debuginfo-common-aarch64 | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-debuginfo-common-x86_64 | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-devel | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-headers | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-libbpf | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-libbpf-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-libbpf-devel | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-libbpf-static | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-livepatch-6.1.131-143.221 | amzn 2023 | 1.0-0.amzn2023 |
| kernel-modules-extra | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-modules-extra-common | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-tools | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-tools-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
| kernel-tools-devel | amzn 2023 | 6.1.131-143.221.amzn2023 |
| perf | amzn 2023 | 6.1.131-143.221.amzn2023 |
| perf-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
| python3-perf | amzn 2023 | 6.1.131-143.221.amzn2023 |
| python3-perf-debuginfo | amzn 2023 | 6.1.131-143.221.amzn2023 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-21760 | kernel-64kb: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763). | 8.1 | 0.3800 | None reported |
| High | CVE-2025-21756 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0089 | None reported |
| High | CVE-2025-21796 | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0067 | None reported |
| High | CVE-2025-21762 | kernel-64kb: arp: use RCU protection in arp_xmit() (bsc#1238780). | 8.1 | 0.0066 | None reported |
| High | CVE-2024-26982 | kernel-modules-extra: Important: kernel security and bug fix update | 7.1 | 0.0028 | None reported |
| High | CVE-2025-21764 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0027 | None reported |
| High | CVE-2024-57979 | kernel-64kb: kABI workaround for pps changes (bsc#1238521). | 7.8 | 0.0027 | None reported |
| High | CVE-2025-21791 | kernel-rt: kernel: vrf: use RCU protection in l3mdev_l3_out() | 7.8 | 0.0027 | None reported |
| High | CVE-2025-21761 | kernel-64kb: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775). | 7.8 | 0.0026 | None reported |
| High | CVE-2025-21763 | kernel-64kb: neighbour: use RCU protection in __neigh_notify() (bsc#1237897). | 7.8 | 0.0026 | None reported |
| High | CVE-2025-21753 | kernel-64kb: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875). | 7.8 | 0.0026 | None reported |
| High | CVE-2025-21926 | kernel-64kb: net: gso: fix ownership in __udp_gso_segment (bsc#1240712). | 7.1 | 0.0024 | None reported |
| High | CVE-2025-21731 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | None reported |
| High | CVE-2025-21919 | kernel-64kb: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593). | 7.8 | 0.0024 | None reported |
| High | CVE-2025-21726 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | None reported |
| High | CVE-2025-21928 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | None reported |
| High | CVE-2025-21920 | kernel-64kb: vlan: enforce underlying device type (bsc#1240686). | 7.1 | 0.0024 | None reported |
| High | CVE-2025-21700 | kernel-64kb: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159). | 7.8 | 0.0023 | None reported |
| High | CVE-2025-21727 | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0022 | None reported |
| Routine | CVE-2025-21758 | kernel-64kb: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737). | 5.5 | 0.1693 | None reported |
| Routine | CVE-2025-21938 | kernel-64kb: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723). | 5.9 | 0.0039 | None reported |
| Routine | CVE-2025-21913 | kernel-64kb: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591). | 5.5 | 0.0024 | None reported |
| Routine | CVE-2025-21948 | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-56549 | kernel-source-azure: cachefiles: Fix NULL pointer dereference in object->file (bsc#1234912). | 5.5 | 0.0023 | None reported |
| Routine | CVE-2025-21701 | kernel-64kb: net: avoid race between device unregistration and ethnl ops (bsc#1237164). | 4.7 | 0.0017 | None reported |
Showing 1 to 25 of 25
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.