AWS AL2 high security documentation change

Service: AL2 · 2025-08-10 · Security-related high

File: AL2/latest/relnotes/relnotes-20250804.md

Summary

Added recall notice for kernel versions causing soft lockup issues with auditd, including mitigation steps to downgrade kernels

Security assessment

The change documents a critical system stability issue (kernel soft lockups) that leads to instance launch failures when using auditd. It provides specific vulnerable kernel versions and mitigation steps, indicating an active security/stability vulnerability requiring immediate action.

Diff

diff --git a/AL2/latest/relnotes/relnotes-20250804.md b/AL2/latest/relnotes/relnotes-20250804.md
index 6a9e14c79..e1e89aa6a 100644
--- a//AL2/latest/relnotes/relnotes-20250804.md
+++ b//AL2/latest/relnotes/relnotes-20250804.md
@@ -3 +3 @@
-Release SummaryRepository UpdatesImage Updates
+Important: This release was recalledRelease SummaryRepository UpdatesImage Updates
@@ -10,0 +11,4 @@ These are the release notes for Amazon Linux 2 version 2.0.20250804.1.
+  * [Important: This release was recalled](./relnotes-20250804.html#kernel-soft-lockup-warning-20250804)
+
+    * [Solution and Mitigation](./relnotes-20250804.html#kernel-soft-lockup-mitigation-20250804)
+
@@ -45,0 +50,64 @@ These are the release notes for Amazon Linux 2 version 2.0.20250804.1.
+## Important: This release was recalled
+
+###### Warning
+
+Versions of Amazon Linux released on August 6, 2025 (2.0.20250804.1) may experience soft lockup issues and instance launch failures when using `auditd`. Customers are recommended to avoid using the affected AMI versions or updating to the affected kernels while also running `auditd`. Amazon is working on providing an update that addresses this issue.
+
+This issue affects AL2 version 2.0.20250804.1 with the following kernel versions:
+
+  * `kernel-5.4.296-217.423.amzn2`
+
+  * `kernel-5.10.240-238.955.amzn2`
+
+  * `kernel-5.15.189-131.202.amzn2`
+
+
+
+
+To check if the instance current kernel version in any of the above kernel version using `uname -r` command.
+
+### Solution and Mitigation
+
+To downgrade to the previous version you can run these commands:
+
+If your system is running kernel version `kernel-5.4.296-217.423.amzn2`:
+
+  1. Install and reinstall the previous kernel:
+    
+        sudo yum -y install kernel-5.4.295-216.421.amzn2 && sudo yum -y reinstall kernel-5.4.295-216.421.amzn2
+
+  2. Reboot to the installed kernel:
+    
+        sudo reboot
+
+
+
+
+If your system is running kernel version `kernel-5.10.240-238.955.amzn2`:
+
+  1. Install and reinstall the previous kernel:
+    
+        sudo yum -y install kernel-5.10.239-236.958.amzn2 && sudo yum -y reinstall kernel-5.10.239-236.958.amzn2
+
+  2. Reboot to the installed kernel:
+    
+        sudo reboot
+
+
+
+
+If your system is running kernel version `kernel-5.15.189-131.202.amzn2`:
+
+  1. Install and reinstall the previous kernel:
+    
+        sudo yum -y install kernel-5.15.187-130.192.amzn2 && sudo yum -y reinstall kernel-5.15.187-130.192.amzn2
+
+  2. Reboot to the installed kernel:
+    
+        sudo reboot
+
+
+
+
+The Amazon Linux team is actively working on this kernel issue and customers can expect the updated kernel in the week of August 11 2025.
+
@@ -177 +245 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Release notes for 2025
+2.0.20250808