# ELSA-2025-28048: Security update for 19 packages ELSA-2025-28048, released December 12, 2025, fixes 76 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2025-28048 - Platform: Linux - Released: Dec 12, 2025 - Priority: Urgent (Closes CVE-2025-39996, rated Critical) - CVEs: 76, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2025-28048.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 8 | 0:5.15.0-315.196.5.1.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:5.15.0-315.196.5.1.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-39996](https://patchblox.com/security/data/cve/CVE-2025-39996.md) | Urgent | media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove | 9.8 | 0.0023 | | | [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 | | | [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 | | | [CVE-2025-39970](https://patchblox.com/security/data/cve/CVE-2025-39970.md) | Urgent | i40e: fix input validation logic for action_meta | 9.8 | 0.0016 | | | [CVE-2025-39971](https://patchblox.com/security/data/cve/CVE-2025-39971.md) | Urgent | i40e: fix idx validation in config queues msg | 9.8 | 0.0016 | | | [CVE-2025-39972](https://patchblox.com/security/data/cve/CVE-2025-39972.md) | Urgent | i40e: fix idx validation in i40e_validate_queue_map | 9.8 | 0.0016 | | | [CVE-2025-39968](https://patchblox.com/security/data/cve/CVE-2025-39968.md) | Urgent | i40e: add max boundary check for VF filters | 9.8 | 0.0015 | | | [CVE-2025-40048](https://patchblox.com/security/data/cve/CVE-2025-40048.md) | High | uio_hv_generic: Let userspace take care of interrupt mask | 8.4 | 0.0064 | | | [CVE-2025-40187](https://patchblox.com/security/data/cve/CVE-2025-40187.md) | High | net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() | 7.5 | 0.0064 | | | [CVE-2025-40053](https://patchblox.com/security/data/cve/CVE-2025-40053.md) | High | net: dlink: handle copy_thresh allocation failure | 7.5 | 0.0063 | | | [CVE-2025-40183](https://patchblox.com/security/data/cve/CVE-2025-40183.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_... | 7.5 | 0.0063 | | | [CVE-2025-40186](https://patchblox.com/security/data/cve/CVE-2025-40186.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_c... | 8.1 | 0.0059 | | | [CVE-2025-40087](https://patchblox.com/security/data/cve/CVE-2025-40087.md) | High | NFSD: Define a proc_layoutcommit for the FlexFiles layout type | 7.5 | 0.0050 | | | [CVE-2025-40171](https://patchblox.com/security/data/cve/CVE-2025-40171.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_... | 7.5 | 0.0048 | | | [CVE-2025-40204](https://patchblox.com/security/data/cve/CVE-2025-40204.md) | High | sctp: Fix MAC comparison to be constant-time | 8.1 | 0.0047 | | | [CVE-2025-39880](https://patchblox.com/security/data/cve/CVE-2025-39880.md) | High | libceph: fix invalid accesses to ceph_connection_v1_info | 7.8 | 0.0033 | | | [CVE-2025-40140](https://patchblox.com/security/data/cve/CVE-2025-40140.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in... | 8.8 | 0.0032 | | | [CVE-2025-38678](https://patchblox.com/security/data/cve/CVE-2025-38678.md) | High | netfilter: nf_tables: reject duplicate device on updates | 7.1 | 0.0029 | | | [CVE-2025-40001](https://patchblox.com/security/data/cve/CVE-2025-40001.md) | High | scsi: mvsas: Fix use-after-free bugs in mvs_work_queue | 7.8 | 0.0026 | | | [CVE-2025-40022](https://patchblox.com/security/data/cve/CVE-2025-40022.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in... | n/a | 0.0024 | | | [CVE-2025-39980](https://patchblox.com/security/data/cve/CVE-2025-39980.md) | High | nexthop: Forbid FDB status change while nexthop is in a group | 7.1 | 0.0023 | | | [CVE-2025-40121](https://patchblox.com/security/data/cve/CVE-2025-40121.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk inp... | 7.0 | 0.0023 | | | [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: u... | 7.3 | 0.0023 | | | [CVE-2025-40035](https://patchblox.com/security/data/cve/CVE-2025-40035.md) | High | Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak | 7.1 | 0.0023 | | | [CVE-2025-40055](https://patchblox.com/security/data/cve/CVE-2025-40055.md) | High | ocfs2: fix double free in user_cluster_connect() | 7.8 | 0.0023 | | | [CVE-2024-43877](https://patchblox.com/security/data/cve/CVE-2024-43877.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result... | 7.1 | 0.0022 | | | [CVE-2025-40154](https://patchblox.com/security/data/cve/CVE-2025-40154.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: n... | 7.8 | 0.0021 | | | [CVE-2025-40020](https://patchblox.com/security/data/cve/CVE-2025-40020.md) | High | can: peak_usb: fix shift-out-of-bounds issue | 7.1 | 0.0021 | | | [CVE-2025-40006](https://patchblox.com/security/data/cve/CVE-2025-40006.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when delet... | 7.8 | 0.0020 | | | [CVE-2025-39913](https://patchblox.com/security/data/cve/CVE-2025-39913.md) | High | tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. | 7.8 | 0.0019 | | | [CVE-2025-40190](https://patchblox.com/security/data/cve/CVE-2025-40190.md) | High | ext4: guard against EA inode refcount underflow in xattr update | 7.8 | 0.0018 | | | [CVE-2025-39998](https://patchblox.com/security/data/cve/CVE-2025-39998.md) | High | scsi: target: target_core_configfs: Add length check to avoid buffer overflow | 7.8 | 0.0018 | | | [CVE-2025-40044](https://patchblox.com/security/data/cve/CVE-2025-40044.md) | High | fs: udf: fix OOB read in lengthAllocDescs handling | 7.8 | 0.0017 | | | [CVE-2025-40026](https://patchblox.com/security/data/cve/CVE-2025-40026.md) | High | KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O | 7.9 | 0.0017 | | | [CVE-2025-40105](https://patchblox.com/security/data/cve/CVE-2025-40105.md) | High | vfs: Don't leak disconnected dentries on umount | 7.8 | 0.0017 | | | [CVE-2025-40118](https://patchblox.com/security/data/cve/CVE-2025-40118.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds o... | 7.8 | 0.0017 | | | [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 | | | [CVE-2025-40167](https://patchblox.com/security/data/cve/CVE-2025-40167.md) | High | ext4: detect invalid INLINE_DATA + EXTENTS flag combination | 7.8 | 0.0017 | | | [CVE-2025-39911](https://patchblox.com/security/data/cve/CVE-2025-39911.md) | High | i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path | 7.8 | 0.0016 | | | [CVE-2025-39945](https://patchblox.com/security/data/cve/CVE-2025-39945.md) | High | cnic: Fix use-after-free bugs in cnic_delete_task | 7.8 | 0.0016 | | | [CVE-2025-40027](https://patchblox.com/security/data/cve/CVE-2025-40027.md) | High | net/9p: fix double req put in p9_fd_cancelled | 7.8 | 0.0016 | | | [CVE-2025-39993](https://patchblox.com/security/data/cve/CVE-2025-39993.md) | High | media: rc: fix races with imon_disconnect() | 7.8 | 0.0016 | | | [CVE-2025-39969](https://patchblox.com/security/data/cve/CVE-2025-39969.md) | High | i40e: fix validation of VF state in get resources | 8.8 | 0.0016 | | | [CVE-2025-39883](https://patchblox.com/security/data/cve/CVE-2025-39883.md) | High | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | 7.6 | 0.0016 | | | [CVE-2025-39949](https://patchblox.com/security/data/cve/CVE-2025-39949.md) | High | qed: Don't collect too many protection override GRC elements | 7.0 | 0.0016 | | | [CVE-2025-40081](https://patchblox.com/security/data/cve/CVE-2025-40081.md) | High | perf: arm_spe: Prevent overflow in PERF_IDX2OFF() | 7.8 | 0.0015 | | | [CVE-2025-40173](https://patchblox.com/security/data/cve/CVE-2025-40173.md) | High | net/ip6_tunnel: Prevent perpetual tunnel growth | 7.8 | 0.0015 | | | [CVE-2025-40205](https://patchblox.com/security/data/cve/CVE-2025-40205.md) | High | btrfs: avoid potential out-of-bounds in btrfs_encode_fh() | 7.8 | 0.0015 | | | [CVE-2025-40092](https://patchblox.com/security/data/cve/CVE-2025-40092.md) | High | usb: gadget: f_ncm: Refactor bind path to use __free() | 7.8 | 0.0015 | | | [CVE-2025-40094](https://patchblox.com/security/data/cve/CVE-2025-40094.md) | High | usb: gadget: f_acm: Refactor bind path to use __free() | 7.8 | 0.0015 | | | [CVE-2025-40018](https://patchblox.com/security/data/cve/CVE-2025-40018.md) | High | ipvs: Defer ip_vs_ftp unregister during netns cleanup | 7.8 | 0.0015 | | | [CVE-2025-40111](https://patchblox.com/security/data/cve/CVE-2025-40111.md) | High | drm/vmwgfx: Fix Use-after-free in validation | 7.8 | 0.0015 | | | [CVE-2025-40011](https://patchblox.com/security/data/cve/CVE-2025-40011.md) | Routine | drm/gma500: Fix null dereference in hdmi teardown | 5.5 | 0.0026 | | | [CVE-2025-40078](https://patchblox.com/security/data/cve/CVE-2025-40078.md) | Routine | bpf: Explicitly check accesses to bpf_sock_addr | 5.5 | 0.0025 | | | [CVE-2025-40070](https://patchblox.com/security/data/cve/CVE-2025-40070.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when regis... | 5.5 | 0.0024 | | | [CVE-2025-40115](https://patchblox.com/security/data/cve/CVE-2025-40115.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remov... | 5.5 | 0.0023 | | | [CVE-2025-40030](https://patchblox.com/security/data/cve/CVE-2025-40030.md) | Routine | pinctrl: check the return value of pinmux_ops::get_function_name() | 5.5 | 0.0023 | | | [CVE-2025-40042](https://patchblox.com/security/data/cve/CVE-2025-40042.md) | Routine | tracing: Fix race condition in kprobe initialization causing NULL pointer dereference | 5.5 | 0.0023 | | | [CVE-2025-40134](https://patchblox.com/security/data/cve/CVE-2025-40134.md) | Routine | kernel-64k-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 4.7 | 0.0023 | | | [CVE-2025-40049](https://patchblox.com/security/data/cve/CVE-2025-40049.md) | Routine | Squashfs: fix uninit-value in squashfs_get_parent | 5.5 | 0.0023 | | | [CVE-2025-40109](https://patchblox.com/security/data/cve/CVE-2025-40109.md) | Routine | crypto: rng - Ensure set_ent is always present | 5.5 | 0.0023 | | | [CVE-2025-40125](https://patchblox.com/security/data/cve/CVE-2025-40125.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before dele... | 5.5 | 0.0023 | | | [CVE-2025-40178](https://patchblox.com/security/data/cve/CVE-2025-40178.md) | Routine | pid: Add a judgment for ns null in pid_nr_ns | 5.5 | 0.0023 | | | [CVE-2025-23143](https://patchblox.com/security/data/cve/CVE-2025-23143.md) | Routine | net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. | 6.4 | 0.0022 | | | [CVE-2025-40179](https://patchblox.com/security/data/cve/CVE-2025-40179.md) | Routine | ext4: verify orphan file size is not too big | 5.5 | 0.0022 | | | [CVE-2025-40120](https://patchblox.com/security/data/cve/CVE-2025-40120.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MD... | 4.7 | 0.0022 | | | [CVE-2025-40194](https://patchblox.com/security/data/cve/CVE-2025-40194.md) | Routine | cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() | 5.8 | 0.0021 | | | [CVE-2025-40153](https://patchblox.com/security/data/cve/CVE-2025-40153.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to... | 5.5 | 0.0021 | | | [CVE-2025-40200](https://patchblox.com/security/data/cve/CVE-2025-40200.md) | Routine | Squashfs: reject negative file sizes in squashfs_read_inode() | 5.5 | 0.0021 | | | [CVE-2024-43876](https://patchblox.com/security/data/cve/CVE-2024-43876.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: PCI: rcar: Demote WARN() to dev_warn_ratelimited... | 5.5 | 0.0021 | | | [CVE-2025-40197](https://patchblox.com/security/data/cve/CVE-2025-40197.md) | Routine | media: mc: Clear minor number before put device | 5.5 | 0.0021 | | | [CVE-2025-40021](https://patchblox.com/security/data/cve/CVE-2025-40021.md) | Routine | tracing: dynevent: Add a missing lockdown check on dynevent | 5.5 | 0.0021 | | | [CVE-2025-40085](https://patchblox.com/security/data/cve/CVE-2025-40085.md) | Routine | ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card | 5.8 | 0.0021 | | | [CVE-2025-39953](https://patchblox.com/security/data/cve/CVE-2025-39953.md) | Routine | cgroup: split cgroup_destroy_wq into 3 workqueues | 5.5 | 0.0016 | | | [CVE-2025-39923](https://patchblox.com/security/data/cve/CVE-2025-39923.md) | Routine | dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees | 5.5 | 0.0015 | | | [CVE-2025-39885](https://patchblox.com/security/data/cve/CVE-2025-39885.md) | Routine | ocfs2: fix recursive semaphore deadlock in fiemap call | 5.5 | 0.0012 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo