Linux · Oracle Linux · Security advisory · September 8, 2025

ELSA-2025-20552: Security update for 19 packages

ELSA-2025-20552, released September 8, 2025, fixes 116 CVEs across 19 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
116
None rated Critical
Exploited
1
CVE-2025-38352
Highest CVSS
7.9
Base score, 0 to 10
Highest EPSS
0.0136
71st percentile

Priority of the 116 CVEs

Patch now 1 Urgent 0 High 82 Routine 33

Fixed package versions

ProductReleaseFixed in
bpftoolol 80:5.15.0-312.187.5.el9uek
bpftoolol 90:5.15.0-312.187.5.el9uek
kernel-uekol 80:5.15.0-312.187.5.el9uek
kernel-uekol 90:5.15.0-312.187.5.el9uek
kernel-uek-containerol 80:5.15.0-312.187.5.el9uek
kernel-uek-containerol 90:5.15.0-312.187.5.el9uek
kernel-uek-container-debugol 80:5.15.0-312.187.5.el9uek
kernel-uek-container-debugol 90:5.15.0-312.187.5.el9uek
kernel-uek-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek-debugol 80:5.15.0-312.187.5.el9uek
kernel-uek-debugol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-develol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-develol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-modules-extraol 90:5.15.0-312.187.5.el9uek
kernel-uek-develol 80:5.15.0-312.187.5.el9uek
kernel-uek-develol 90:5.15.0-312.187.5.el9uek
kernel-uek-docol 80:5.15.0-312.187.5.el9uek
kernel-uek-docol 90:5.15.0-312.187.5.el9uek
kernel-uek-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek-modules-extraol 90:5.15.0-312.187.5.el9uek
kernel-uek64kol 80:5.15.0-312.187.5.el9uek
kernel-uek64kol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-develol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-develol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-modules-extraol 90:5.15.0-312.187.5.el9uek

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()7.8 0.0136 KEVExploited
High CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request7.1 0.0059 None reported
High CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().7.0 0.0058 None reported
High CVE-2025-38035 nvmet-tcp: don't restore null sk_state_change7.5 0.0057 None reported
High CVE-2025-38001 net_sched: hfsc: Address reentrant enqueue adding class to eltree twice7.8 0.0056 None reported
High CVE-2025-38052 net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done7.8 0.0055 None reported
High CVE-2025-38399 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()7.0 0.0051 None reported
High CVE-2025-38146 net: openvswitch: Fix the dead loop of MPLS parse7.8 0.0049 None reported
High CVE-2025-38075 scsi: target: iscsi: Fix timeout on deleted connection7.0 0.0046 None reported
High CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction7.8 0.0042 None reported
High CVE-2025-38293 wifi: ath11k: fix node corruption in ar->arvifs list7.0 0.0034 None reported
High CVE-2025-38003 can: bcm: add missing rcu read protection for procfs content7.0 0.0030 None reported
High CVE-2025-38350 net/sched: Always pass notifications when child class becomes empty7.8 0.0030 None reported
High CVE-2025-38004 can: bcm: add locking for bcm_op runtime updates7.8 0.0028 None reported
High CVE-2025-38000 sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()7.8 0.0024 None reported
High CVE-2025-38298 linux: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault A...7.8 0.0023 None reported
High CVE-2025-38103 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()7.1 0.0023 None reported
High CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary7.0 0.0023 None reported
High CVE-2025-37958 mm/huge_memory: fix dereferencing invalid pmd migration entry7.1 0.0023 None reported
High CVE-2025-38115 net_sched: sch_sfq: fix a potential crash on gso_skb handling7.0 0.0023 None reported
High CVE-2025-38147 calipso: Don't call calipso functions for AF_INET sk.7.8 0.0023 None reported
High CVE-2025-38111 net/mdiobus: Fix potential out-of-bounds read/write access7.1 0.0023 None reported
High CVE-2025-38077 platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()7.8 0.0023 None reported
High CVE-2025-38415 Squashfs: check return result of sb_min_blocksize7.8 0.0023 None reported
High CVE-2025-38184 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer7.0 0.0022 None reported
Showing 1 to 25 of 116 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.