Linux · Oracle Linux · Security advisory · September 8, 2025

ELSA-2025-20551: Security update for 35 packages

ELSA-2025-20551, released September 8, 2025, fixes 266 CVEs across 35 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
266
None rated Critical
Exploited
1
CVE-2025-38352
Highest CVSS
8.4
Base score, 0 to 10
Highest EPSS
0.0136
71st percentile

Priority of the 266 CVEs

Patch now 1 Urgent 0 High 164 Routine 101

Fixed package versions

ProductReleaseFixed in
kernel-uekol 100:6.12.0-103.40.4.1.el9uek
kernel-uekol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debugol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debugol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-docol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-docol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-toolsol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-toolsol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64kol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64kol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()7.8 0.0136 KEVExploited
High CVE-2025-38488 kernel-livepatch-SLE15-SP7-RT_Update_0: This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.5 fixes various security issues The following security...7.8 0.0077 None reported
High CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request7.1 0.0059 None reported
High CVE-2025-38439 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT7.8 0.0058 None reported
High CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().7.0 0.0058 None reported
High CVE-2025-38399 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()7.0 0.0051 None reported
High CVE-2025-38146 net: openvswitch: Fix the dead loop of MPLS parse7.8 0.0049 None reported
High CVE-2025-38124 kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system7.0 0.0047 None reported
High CVE-2025-38471 tls: always refresh the queue when reading sock7.8 0.0047 None reported
High CVE-2025-38472 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry7.5 0.0046 None reported
High CVE-2025-38527 smb: client: fix use-after-free in cifs_oplock_break7.8 0.0046 None reported
High CVE-2025-38264 nvme-tcp: sanitize request list handling7.8 0.0045 None reported
High CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction7.8 0.0042 None reported
High CVE-2025-38379 smb: client: fix warning when reconnecting channel7.1 0.0041 None reported
High CVE-2025-38523 kernel: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercop...7.3 0.0039 None reported
High CVE-2025-38495 HID: core: ensure the allocated report buffer can contain the reserved report ID7.0 0.0038 None reported
High CVE-2025-38552 mptcp: plug races between subflow fail and subflow creation7.8 0.0035 None reported
High CVE-2025-38293 wifi: ath11k: fix node corruption in ar->arvifs list7.0 0.0034 None reported
High CVE-2025-38350 net/sched: Always pass notifications when child class becomes empty7.8 0.0030 None reported
High CVE-2025-38236 af_unix: Don't leave consecutive consumed OOB skbs.7.8 0.0030 None reported
High CVE-2025-38494 HID: core: do not bypass hid_hw_raw_request7.8 0.0026 None reported
High CVE-2025-38244 smb: client: fix potential deadlock when reconnecting channels7.0 0.0025 None reported
High CVE-2025-38512 wifi: prevent A-MSDU attacks in mesh networks7.8 0.0025 None reported
High CVE-2025-38491 mptcp: make fallback action and fallback decision atomic7.0 0.0024 None reported
High CVE-2025-38201 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX7.8 0.0024 None reported
Showing 1 to 25 of 266 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.