vulnerability
Amazon Linux AMI 2: CVE-2025-22005: Security patch for kernel (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | Apr 3, 2025 | Jun 23, 2025 | May 20, 2026 |
Description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything
when it fails.
Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh")
moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()
but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in
case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.
Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the
error path.
Note that we can remove the fib6_nh_release() call in nh_create_ipv6()
later in net-next.git.
Solutions
References
- AMAZON-AL2/ALAS2KERNEL-5.10-2025-090
- AMAZON-AL2/ALAS2KERNEL-5.15-2025-070
- AMAZON-AL2/ALAS2KERNEL-5.4-2025-100
- AMAZON-AL2/ALASKERNEL-5.10-2025-090
- AMAZON-AL2/ALASKERNEL-5.15-2025-070
- AMAZON-AL2/ALASKERNEL-5.4-2025-100
- CVE-2025-22005
- https://attackerkb.com/topics/CVE-2025-22005
- CWE-401
- EUVD-EUVD-2025-9596
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9596
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.