ELSA-2025-20470: Security update for 19 packages

ELSA-2025-20470, released July 14, 2025, fixes 144 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

144

None rated Critical

Exploited

None reported

Highest CVSS

8.4

Base score, 0 to 10

Highest EPSS

0.0090

59th percentile

Priority of the 144 CVEs

Patch now 0
                                Urgent 0
                                High 67
                                Routine 77

Fixed package versions

Product	Release	Fixed in
bpftool	ol 8	0:5.15.0-310.184.5.2.el9uek
bpftool	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-container	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-container	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-container-debug	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-container-debug	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-core	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-core	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-core	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-core	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-devel	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-devel	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-modules	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-modules	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-modules-extra	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-debug-modules-extra	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-devel	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-devel	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-doc	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-doc	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-modules	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-modules	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek-modules-extra	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek-modules-extra	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-core	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-core	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-devel	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-devel	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-modules	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-modules	ol 9	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-modules-extra	ol 8	0:5.15.0-310.184.5.2.el9uek
kernel-uek64k-modules-extra	ol 9	0:5.15.0-310.184.5.2.el9uek

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2024-38541	linux: In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_moda...	7.8	0.0090	None reported
High	CVE-2024-26952	linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial out-of-bounds when buffer o...	7.8	0.0073	None reported
High	CVE-2024-50047	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: d...	7.8	0.0052	None reported
High	CVE-2025-37749	net: ppp: Add bound checking for skb data on ppp_sync_txmung	7.8	0.0041	None reported
High	CVE-2024-50125	bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: B...	7.8	0.0034	None reported
High	CVE-2025-37839	jbd2: remove wrong sb->s_sequence check	7.8	0.0033	None reported
High	CVE-2025-37840	mtd: rawnand: brcmnand: fix PM resume warning	7.8	0.0033	None reported
High	CVE-2025-37885	KVM: x86: Reset IRTE to host control if new route isn't postable	7.8	0.0032	None reported
High	CVE-2025-37858	fs/jfs: Prevent integer overflow in AG size calculation	7.8	0.0031	None reported
High	CVE-2025-37927	iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid	7.8	0.0030	None reported
High	CVE-2024-49960	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: d...	7.8	0.0029	None reported
High	CVE-2024-26739	kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...	7.8	0.0028	None reported
High	CVE-2024-53203	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: d...	7.8	0.0027	None reported
High	CVE-2024-35867	kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...	7.8	0.0027	None reported
High	CVE-2024-46774	linux: In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construc...	7.1	0.0027	None reported
High	CVE-2024-54458	kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu...	7.8	0.0026	None reported
High	CVE-2024-49989	linux: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during am...	7.8	0.0026	None reported
High	CVE-2024-50280	linux: In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_wor...	7.8	0.0025	None reported
High	CVE-2025-37803	udmabuf: fix a buf size overflow issue during udmabuf creation	7.8	0.0025	None reported
High	CVE-2025-21853	kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system	7.8	0.0025	None reported
High	CVE-2025-37810	usb: dwc3: gadget: check that event count does not exceed event buffer length	7.8	0.0025	None reported
High	CVE-2025-37838	linux: In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerabil...	7.8	0.0025	None reported
High	CVE-2025-37923	tracing: Fix oob write in trace_seq_to_buffer()	7.8	0.0025	None reported
High	CVE-2024-35866	kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu...	7.8	0.0024	None reported
High	CVE-2023-52621	kernel-64k-debug-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: b...	7.8	0.0024	None reported

Also fixes CVE-2024-38541

SUSE-SU-2024:2973-1
kernel-livepatch-SLE15-SP6-RT_Update_1, kernel-rt, kernel-rt_debug and 2 more on opensuse-leap 15.6, sles 15.6
SUSE-SU-2024:2896-1
kernel-azure, kernel-source-azure, kernel-syms-azure on opensuse-leap 15.6, sles 15.6
SUSE-SU-2024:2571-1
dtb-aarch64, kernel-64kb, kernel-debug and 10 more on opensuse-leap 15.6, sles 15.6
RHSA-2025:6966
kernel, kernel-64k, kernel-64k-core and 71 more on RHEL 9
ELSA-2025-6966
bpftool, kernel, kernel-abi-stablelists and 27 more on ol 9
ELSA-2025-20521
kernel-uek, kernel-uek-container, kernel-uek-container-debug and 5 more on ol 8
ALSA-2024:8856
bpftool, kernel, kernel-abi-stablelists and 22 more on almalinux 8
RHSA-2024:8856
bpftool, kernel, kernel-abi-stablelists and 20 more on RHEL 8

Vendor advisory

https://linux.oracle.com/errata/ELSA-2025-20470.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/elsa-2025-20470">ELSA-2025-20470 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.