# ELSA-2025-28048: Security update for 19 packages ELSA-2025-28048, released December 12, 2025, fixes 76 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2025-28048 - Platform: Linux - Released: Dec 12, 2025 - Priority: Urgent (Closes CVE-2025-39996, rated Critical) - CVEs: 76, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2025-28048.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-39996](https://patchblox.com/security/data/cve/CVE-2025-39996.md) | Urgent | media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove | 9.8 | 0.0023 | | | [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 | | | [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 | | | [CVE-2025-39970](https://patchblox.com/security/data/cve/CVE-2025-39970.md) | Urgent | i40e: fix input validation logic for action_meta | 9.8 | 0.0016 | | | [CVE-2025-39971](https://patchblox.com/security/data/cve/CVE-2025-39971.md) | Urgent | i40e: fix idx validation in config queues msg | 9.8 | 0.0016 | | | [CVE-2025-39972](https://patchblox.com/security/data/cve/CVE-2025-39972.md) | Urgent | i40e: fix idx validation in i40e_validate_queue_map | 9.8 | 0.0016 | | | [CVE-2025-39968](https://patchblox.com/security/data/cve/CVE-2025-39968.md) | Urgent | i40e: add max boundary check for VF filters | 9.8 | 0.0015 | | | [CVE-2025-40048](https://patchblox.com/security/data/cve/CVE-2025-40048.md) | High | uio_hv_generic: Let userspace take care of interrupt mask | 8.4 | 0.0064 | | | [CVE-2025-40187](https://patchblox.com/security/data/cve/CVE-2025-40187.md) | High | net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() | 7.5 | 0.0064 | | | [CVE-2025-40053](https://patchblox.com/security/data/cve/CVE-2025-40053.md) | High | net: dlink: handle copy_thresh allocation failure | 7.5 | 0.0063 | | | [CVE-2025-40183](https://patchblox.com/security/data/cve/CVE-2025-40183.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_... | 7.5 | 0.0063 | | | [CVE-2025-40186](https://patchblox.com/security/data/cve/CVE-2025-40186.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_c... | 8.1 | 0.0059 | | | [CVE-2025-40087](https://patchblox.com/security/data/cve/CVE-2025-40087.md) | High | NFSD: Define a proc_layoutcommit for the FlexFiles layout type | 7.5 | 0.0050 | | | [CVE-2025-40171](https://patchblox.com/security/data/cve/CVE-2025-40171.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_... | 7.5 | 0.0048 | | | [CVE-2025-40204](https://patchblox.com/security/data/cve/CVE-2025-40204.md) | High | sctp: Fix MAC comparison to be constant-time | 8.1 | 0.0047 | | | [CVE-2025-39880](https://patchblox.com/security/data/cve/CVE-2025-39880.md) | High | libceph: fix invalid accesses to ceph_connection_v1_info | 7.8 | 0.0033 | | | [CVE-2025-40140](https://patchblox.com/security/data/cve/CVE-2025-40140.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in... | 8.8 | 0.0032 | | | [CVE-2025-38678](https://patchblox.com/security/data/cve/CVE-2025-38678.md) | High | netfilter: nf_tables: reject duplicate device on updates | 7.1 | 0.0029 | | | [CVE-2025-40001](https://patchblox.com/security/data/cve/CVE-2025-40001.md) | High | scsi: mvsas: Fix use-after-free bugs in mvs_work_queue | 7.8 | 0.0026 | | | [CVE-2025-40022](https://patchblox.com/security/data/cve/CVE-2025-40022.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in... | n/a | 0.0024 | | | [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u... | 7.3 | 0.0024 | | | [CVE-2025-39980](https://patchblox.com/security/data/cve/CVE-2025-39980.md) | High | nexthop: Forbid FDB status change while nexthop is in a group | 7.1 | 0.0023 | | | [CVE-2025-40121](https://patchblox.com/security/data/cve/CVE-2025-40121.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk inp... | 7.0 | 0.0023 | | | [CVE-2025-40035](https://patchblox.com/security/data/cve/CVE-2025-40035.md) | High | Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak | 7.1 | 0.0023 | | | [CVE-2025-40055](https://patchblox.com/security/data/cve/CVE-2025-40055.md) | High | ocfs2: fix double free in user_cluster_connect() | 7.8 | 0.0023 | | | [CVE-2024-43877](https://patchblox.com/security/data/cve/CVE-2024-43877.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result... | 7.1 | 0.0022 | | | [CVE-2025-40154](https://patchblox.com/security/data/cve/CVE-2025-40154.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n... | 7.8 | 0.0021 | | | [CVE-2025-40020](https://patchblox.com/security/data/cve/CVE-2025-40020.md) | High | can: peak_usb: fix shift-out-of-bounds issue | 7.1 | 0.0021 | | | [CVE-2025-40006](https://patchblox.com/security/data/cve/CVE-2025-40006.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when delet... | 7.8 | 0.0021 | | | [CVE-2025-39913](https://patchblox.com/security/data/cve/CVE-2025-39913.md) | High | tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. | 7.8 | 0.0019 | | | [CVE-2025-40190](https://patchblox.com/security/data/cve/CVE-2025-40190.md) | High | ext4: guard against EA inode refcount underflow in xattr update | 7.8 | 0.0018 | | | [CVE-2025-39998](https://patchblox.com/security/data/cve/CVE-2025-39998.md) | High | scsi: target: target_core_configfs: Add length check to avoid buffer overflow | 7.8 | 0.0018 | | | [CVE-2025-40044](https://patchblox.com/security/data/cve/CVE-2025-40044.md) | High | fs: udf: fix OOB read in lengthAllocDescs handling | 7.8 | 0.0017 | | | [CVE-2025-40026](https://patchblox.com/security/data/cve/CVE-2025-40026.md) | High | KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O | 7.9 | 0.0017 | | | [CVE-2025-40105](https://patchblox.com/security/data/cve/CVE-2025-40105.md) | High | vfs: Don't leak disconnected dentries on umount | 7.8 | 0.0017 | | | [CVE-2025-40118](https://patchblox.com/security/data/cve/CVE-2025-40118.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds o... | 7.8 | 0.0017 | | | [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 | | | [CVE-2025-40167](https://patchblox.com/security/data/cve/CVE-2025-40167.md) | High | ext4: detect invalid INLINE_DATA + EXTENTS flag combination | 7.8 | 0.0017 | | | [CVE-2025-39911](https://patchblox.com/security/data/cve/CVE-2025-39911.md) | High | i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path | 7.8 | 0.0016 | | | [CVE-2025-39945](https://patchblox.com/security/data/cve/CVE-2025-39945.md) | High | cnic: Fix use-after-free bugs in cnic_delete_task | 7.8 | 0.0016 | | | [CVE-2025-40027](https://patchblox.com/security/data/cve/CVE-2025-40027.md) | High | net/9p: fix double req put in p9_fd_cancelled | 7.8 | 0.0016 | | | [CVE-2025-39993](https://patchblox.com/security/data/cve/CVE-2025-39993.md) | High | media: rc: fix races with imon_disconnect() | 7.8 | 0.0016 | | | [CVE-2025-39969](https://patchblox.com/security/data/cve/CVE-2025-39969.md) | High | i40e: fix validation of VF state in get resources | 8.8 | 0.0016 | | | [CVE-2025-39883](https://patchblox.com/security/data/cve/CVE-2025-39883.md) | High | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | 7.6 | 0.0016 | | | [CVE-2025-39949](https://patchblox.com/security/data/cve/CVE-2025-39949.md) | High | qed: Don't collect too many protection override GRC elements | 7.0 | 0.0016 | | | [CVE-2025-40081](https://patchblox.com/security/data/cve/CVE-2025-40081.md) | High | perf: arm_spe: Prevent overflow in PERF_IDX2OFF() | 7.8 | 0.0015 | | | [CVE-2025-40173](https://patchblox.com/security/data/cve/CVE-2025-40173.md) | High | net/ip6_tunnel: Prevent perpetual tunnel growth | 7.8 | 0.0015 | | | [CVE-2025-40205](https://patchblox.com/security/data/cve/CVE-2025-40205.md) | High | btrfs: avoid potential out-of-bounds in btrfs_encode_fh() | 7.8 | 0.0015 | | | [CVE-2025-40092](https://patchblox.com/security/data/cve/CVE-2025-40092.md) | High | usb: gadget: f_ncm: Refactor bind path to use __free() | 7.8 | 0.0015 | | | [CVE-2025-40094](https://patchblox.com/security/data/cve/CVE-2025-40094.md) | High | usb: gadget: f_acm: Refactor bind path to use __free() | 7.8 | 0.0015 | | | [CVE-2025-40018](https://patchblox.com/security/data/cve/CVE-2025-40018.md) | High | ipvs: Defer ip_vs_ftp unregister during netns cleanup | 7.8 | 0.0015 | | | [CVE-2025-40111](https://patchblox.com/security/data/cve/CVE-2025-40111.md) | High | drm/vmwgfx: Fix Use-after-free in validation | 7.8 | 0.0015 | | | [CVE-2025-40011](https://patchblox.com/security/data/cve/CVE-2025-40011.md) | Routine | drm/gma500: Fix null dereference in hdmi teardown | 5.5 | 0.0026 | | | [CVE-2025-40078](https://patchblox.com/security/data/cve/CVE-2025-40078.md) | Routine | bpf: Explicitly check accesses to bpf_sock_addr | 5.5 | 0.0025 | | | [CVE-2025-40070](https://patchblox.com/security/data/cve/CVE-2025-40070.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when regis... | 5.5 | 0.0024 | | | [CVE-2025-40115](https://patchblox.com/security/data/cve/CVE-2025-40115.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remov... | 5.5 | 0.0023 | | | [CVE-2025-40030](https://patchblox.com/security/data/cve/CVE-2025-40030.md) | Routine | pinctrl: check the return value of pinmux_ops::get_function_name() | 5.5 | 0.0023 | | | [CVE-2025-40042](https://patchblox.com/security/data/cve/CVE-2025-40042.md) | Routine | tracing: Fix race condition in kprobe initialization causing NULL pointer dereference | 5.5 | 0.0023 | | | [CVE-2025-40134](https://patchblox.com/security/data/cve/CVE-2025-40134.md) | Routine | kernel-64k-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 4.7 | 0.0023 | | | [CVE-2025-40049](https://patchblox.com/security/data/cve/CVE-2025-40049.md) | Routine | Squashfs: fix uninit-value in squashfs_get_parent | 5.5 | 0.0023 | | | [CVE-2025-40109](https://patchblox.com/security/data/cve/CVE-2025-40109.md) | Routine | crypto: rng - Ensure set_ent is always present | 5.5 | 0.0023 | | | [CVE-2025-40125](https://patchblox.com/security/data/cve/CVE-2025-40125.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before dele... | 5.5 | 0.0023 | | | [CVE-2025-40178](https://patchblox.com/security/data/cve/CVE-2025-40178.md) | Routine | pid: Add a judgment for ns null in pid_nr_ns | 5.5 | 0.0023 | | | [CVE-2025-23143](https://patchblox.com/security/data/cve/CVE-2025-23143.md) | Routine | net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. | 6.4 | 0.0022 | | | [CVE-2025-40179](https://patchblox.com/security/data/cve/CVE-2025-40179.md) | Routine | ext4: verify orphan file size is not too big | 5.5 | 0.0022 | | | [CVE-2025-40120](https://patchblox.com/security/data/cve/CVE-2025-40120.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MD... | 4.7 | 0.0022 | | | [CVE-2025-40194](https://patchblox.com/security/data/cve/CVE-2025-40194.md) | Routine | cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() | 5.8 | 0.0021 | | | [CVE-2025-40153](https://patchblox.com/security/data/cve/CVE-2025-40153.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to... | 5.5 | 0.0021 | | | [CVE-2025-40200](https://patchblox.com/security/data/cve/CVE-2025-40200.md) | Routine | Squashfs: reject negative file sizes in squashfs_read_inode() | 5.5 | 0.0021 | | | [CVE-2024-43876](https://patchblox.com/security/data/cve/CVE-2024-43876.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: PCI: rcar: Demote WARN() to dev_warn_ratelimited... | 5.5 | 0.0021 | | | [CVE-2025-40197](https://patchblox.com/security/data/cve/CVE-2025-40197.md) | Routine | media: mc: Clear minor number before put device | 5.5 | 0.0021 | | | [CVE-2025-40021](https://patchblox.com/security/data/cve/CVE-2025-40021.md) | Routine | tracing: dynevent: Add a missing lockdown check on dynevent | 5.5 | 0.0021 | | | [CVE-2025-40085](https://patchblox.com/security/data/cve/CVE-2025-40085.md) | Routine | ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card | 5.8 | 0.0021 | | | [CVE-2025-39953](https://patchblox.com/security/data/cve/CVE-2025-39953.md) | Routine | cgroup: split cgroup_destroy_wq into 3 workqueues | 5.5 | 0.0016 | | | [CVE-2025-39923](https://patchblox.com/security/data/cve/CVE-2025-39923.md) | Routine | dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees | 5.5 | 0.0015 | | | [CVE-2025-39885](https://patchblox.com/security/data/cve/CVE-2025-39885.md) | Routine | ocfs2: fix recursive semaphore deadlock in fiemap call | 5.5 | 0.0012 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.