# ELSA-2025-28049: Security update for 8 packages

ELSA-2025-28049, released December 12, 2025, fixes 63 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/elsa-2025-28049
- Platform: Linux
- Released: Dec 12, 2025
- Priority: Urgent (Closes CVE-2025-39996, rated Critical)
- CVEs: 63, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2025-28049.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.4.17-2136.350.3.1.el8uek |
| [kernel-uek-tools](https://patchblox.com/security/data/product/linux/kernel-uek-tools.md) | ol 8 | 0:5.4.17-2136.350.3.1.el7uek |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-39996](https://patchblox.com/security/data/cve/CVE-2025-39996.md) | Urgent | media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove | 9.8 | 0.0023 |  |
| [CVE-2025-39967](https://patchblox.com/security/data/cve/CVE-2025-39967.md) | Urgent | fbcon: fix integer overflow in fbcon_do_set_font | 9.8 | 0.0017 |  |
| [CVE-2025-39994](https://patchblox.com/security/data/cve/CVE-2025-39994.md) | Urgent | media: tuner: xc5000: Fix use-after-free in xc5000_release | 9.8 | 0.0016 |  |
| [CVE-2025-39970](https://patchblox.com/security/data/cve/CVE-2025-39970.md) | Urgent | i40e: fix input validation logic for action_meta | 9.8 | 0.0016 |  |
| [CVE-2025-39971](https://patchblox.com/security/data/cve/CVE-2025-39971.md) | Urgent | i40e: fix idx validation in config queues msg | 9.8 | 0.0016 |  |
| [CVE-2025-39972](https://patchblox.com/security/data/cve/CVE-2025-39972.md) | Urgent | i40e: fix idx validation in i40e_validate_queue_map | 9.8 | 0.0016 |  |
| [CVE-2025-39968](https://patchblox.com/security/data/cve/CVE-2025-39968.md) | Urgent | i40e: add max boundary check for VF filters | 9.8 | 0.0015 |  |
| [CVE-2025-40240](https://patchblox.com/security/data/cve/CVE-2025-40240.md) | High | sctp: avoid NULL dereference when chunk data buffer is missing | 8.6 | 0.0064 |  |
| [CVE-2025-40048](https://patchblox.com/security/data/cve/CVE-2025-40048.md) | High | uio_hv_generic: Let userspace take care of interrupt mask | 8.4 | 0.0064 |  |
| [CVE-2025-40187](https://patchblox.com/security/data/cve/CVE-2025-40187.md) | High | net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() | 7.5 | 0.0064 |  |
| [CVE-2025-40186](https://patchblox.com/security/data/cve/CVE-2025-40186.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  tcp: Don't call reqsk_fastopen_remove() in tcp_c... | 8.1 | 0.0059 |  |
| [CVE-2025-40087](https://patchblox.com/security/data/cve/CVE-2025-40087.md) | High | NFSD: Define a proc_layoutcommit for the FlexFiles layout type | 7.5 | 0.0050 |  |
| [CVE-2025-40204](https://patchblox.com/security/data/cve/CVE-2025-40204.md) | High | sctp: Fix MAC comparison to be constant-time | 8.1 | 0.0047 |  |
| [CVE-2025-40140](https://patchblox.com/security/data/cve/CVE-2025-40140.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: usb: Remove disruptive netif_wake_queue in... | 8.8 | 0.0032 |  |
| [CVE-2025-40001](https://patchblox.com/security/data/cve/CVE-2025-40001.md) | High | scsi: mvsas: Fix use-after-free bugs in mvs_work_queue | 7.8 | 0.0026 |  |
| [CVE-2025-39995](https://patchblox.com/security/data/cve/CVE-2025-39995.md) | High | media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe | 7.1 | 0.0023 |  |
| [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: u... | 7.3 | 0.0023 |  |
| [CVE-2025-40035](https://patchblox.com/security/data/cve/CVE-2025-40035.md) | High | Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak | 7.1 | 0.0023 |  |
| [CVE-2025-40055](https://patchblox.com/security/data/cve/CVE-2025-40055.md) | High | ocfs2: fix double free in user_cluster_connect() | 7.8 | 0.0023 |  |
| [CVE-2025-40020](https://patchblox.com/security/data/cve/CVE-2025-40020.md) | High | can: peak_usb: fix shift-out-of-bounds issue | 7.1 | 0.0021 |  |
| [CVE-2025-40006](https://patchblox.com/security/data/cve/CVE-2025-40006.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb: fix folio is still mapped when delet... | 7.8 | 0.0020 |  |
| [CVE-2025-39913](https://patchblox.com/security/data/cve/CVE-2025-39913.md) | High | tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. | 7.8 | 0.0019 |  |
| [CVE-2025-40190](https://patchblox.com/security/data/cve/CVE-2025-40190.md) | High | ext4: guard against EA inode refcount underflow in xattr update | 7.8 | 0.0018 |  |
| [CVE-2025-39998](https://patchblox.com/security/data/cve/CVE-2025-39998.md) | High | scsi: target: target_core_configfs: Add length check to avoid buffer overflow | 7.8 | 0.0018 |  |
| [CVE-2025-40044](https://patchblox.com/security/data/cve/CVE-2025-40044.md) | High | fs: udf: fix OOB read in lengthAllocDescs handling | 7.8 | 0.0017 |  |
| [CVE-2025-40026](https://patchblox.com/security/data/cve/CVE-2025-40026.md) | High | KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O | 7.9 | 0.0017 |  |
| [CVE-2025-40105](https://patchblox.com/security/data/cve/CVE-2025-40105.md) | High | vfs: Don't leak disconnected dentries on umount | 7.8 | 0.0017 |  |
| [CVE-2025-40118](https://patchblox.com/security/data/cve/CVE-2025-40118.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: pm80xx: Fix array-index-out-of-of-bounds o... | 7.8 | 0.0017 |  |
| [CVE-2025-40233](https://patchblox.com/security/data/cve/CVE-2025-40233.md) | High | ocfs2: clear extent cache after moving/defragmenting extents | 7.8 | 0.0017 |  |
| [CVE-2025-39955](https://patchblox.com/security/data/cve/CVE-2025-39955.md) | High | tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). | 7.8 | 0.0017 |  |
| [CVE-2025-40167](https://patchblox.com/security/data/cve/CVE-2025-40167.md) | High | ext4: detect invalid INLINE_DATA + EXTENTS flag combination | 7.8 | 0.0017 |  |
| [CVE-2025-40198](https://patchblox.com/security/data/cve/CVE-2025-40198.md) | High | ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() | 7.8 | 0.0017 |  |
| [CVE-2025-39911](https://patchblox.com/security/data/cve/CVE-2025-39911.md) | High | i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path | 7.8 | 0.0016 |  |
| [CVE-2025-39945](https://patchblox.com/security/data/cve/CVE-2025-39945.md) | High | cnic: Fix use-after-free bugs in cnic_delete_task | 7.8 | 0.0016 |  |
| [CVE-2025-40027](https://patchblox.com/security/data/cve/CVE-2025-40027.md) | High | net/9p: fix double req put in p9_fd_cancelled | 7.8 | 0.0016 |  |
| [CVE-2025-39993](https://patchblox.com/security/data/cve/CVE-2025-39993.md) | High | media: rc: fix races with imon_disconnect() | 7.8 | 0.0016 |  |
| [CVE-2025-39969](https://patchblox.com/security/data/cve/CVE-2025-39969.md) | High | i40e: fix validation of VF state in get resources | 8.8 | 0.0016 |  |
| [CVE-2025-39883](https://patchblox.com/security/data/cve/CVE-2025-39883.md) | High | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | 7.6 | 0.0016 |  |
| [CVE-2025-40081](https://patchblox.com/security/data/cve/CVE-2025-40081.md) | High | perf: arm_spe: Prevent overflow in PERF_IDX2OFF() | 7.8 | 0.0015 |  |
| [CVE-2025-40173](https://patchblox.com/security/data/cve/CVE-2025-40173.md) | High | net/ip6_tunnel: Prevent perpetual tunnel growth | 7.8 | 0.0015 |  |
| [CVE-2025-40205](https://patchblox.com/security/data/cve/CVE-2025-40205.md) | High | btrfs: avoid potential out-of-bounds in btrfs_encode_fh() | 7.8 | 0.0015 |  |
| [CVE-2025-40018](https://patchblox.com/security/data/cve/CVE-2025-40018.md) | High | ipvs: Defer ip_vs_ftp unregister during netns cleanup | 7.8 | 0.0015 |  |
| [CVE-2025-40111](https://patchblox.com/security/data/cve/CVE-2025-40111.md) | High | drm/vmwgfx: Fix Use-after-free in validation | 7.8 | 0.0015 |  |
| [CVE-2024-50022](https://patchblox.com/security/data/cve/CVE-2024-50022.md) | Routine | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system.  Security Fix(es):  * kernel: d... | 5.5 | 0.0027 |  |
| [CVE-2025-40011](https://patchblox.com/security/data/cve/CVE-2025-40011.md) | Routine | drm/gma500: Fix null dereference in hdmi teardown | 5.5 | 0.0026 |  |
| [CVE-2025-40078](https://patchblox.com/security/data/cve/CVE-2025-40078.md) | Routine | bpf: Explicitly check accesses to bpf_sock_addr | 5.5 | 0.0025 |  |
| [CVE-2025-40219](https://patchblox.com/security/data/cve/CVE-2025-40219.md) | Routine | PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV | 6.7 | 0.0024 |  |
| [CVE-2025-40070](https://patchblox.com/security/data/cve/CVE-2025-40070.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  pps: fix warning in pps_register_cdev when regis... | 5.5 | 0.0024 |  |
| [CVE-2025-40115](https://patchblox.com/security/data/cve/CVE-2025-40115.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Fix crash in transport port remov... | 5.5 | 0.0023 |  |
| [CVE-2025-40030](https://patchblox.com/security/data/cve/CVE-2025-40030.md) | Routine | pinctrl: check the return value of pinmux_ops::get_function_name() | 5.5 | 0.0023 |  |
| [CVE-2025-40042](https://patchblox.com/security/data/cve/CVE-2025-40042.md) | Routine | tracing: Fix race condition in kprobe initialization causing NULL pointer dereference | 5.5 | 0.0023 |  |
| [CVE-2025-40134](https://patchblox.com/security/data/cve/CVE-2025-40134.md) | Routine | kernel-64k-debug-modules-core: The kernel packages contain the Linux kernel, the core of any Linux operating system | 4.7 | 0.0023 |  |
| [CVE-2025-40049](https://patchblox.com/security/data/cve/CVE-2025-40049.md) | Routine | Squashfs: fix uninit-value in squashfs_get_parent | 5.5 | 0.0023 |  |
| [CVE-2025-40125](https://patchblox.com/security/data/cve/CVE-2025-40125.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  blk-mq: check kobject state_in_sysfs before dele... | 5.5 | 0.0023 |  |
| [CVE-2025-40178](https://patchblox.com/security/data/cve/CVE-2025-40178.md) | Routine | pid: Add a judgment for ns null in pid_nr_ns | 5.5 | 0.0023 |  |
| [CVE-2025-23143](https://patchblox.com/security/data/cve/CVE-2025-23143.md) | Routine | net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. | 6.4 | 0.0022 |  |
| [CVE-2025-40194](https://patchblox.com/security/data/cve/CVE-2025-40194.md) | Routine | cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() | 5.8 | 0.0021 |  |
| [CVE-2025-40153](https://patchblox.com/security/data/cve/CVE-2025-40153.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  mm: hugetlb: avoid soft lockup when mprotect to... | 5.5 | 0.0021 |  |
| [CVE-2025-40200](https://patchblox.com/security/data/cve/CVE-2025-40200.md) | Routine | Squashfs: reject negative file sizes in squashfs_read_inode() | 5.5 | 0.0021 |  |
| [CVE-2025-40197](https://patchblox.com/security/data/cve/CVE-2025-40197.md) | Routine | media: mc: Clear minor number before put device | 5.5 | 0.0021 |  |
| [CVE-2025-39953](https://patchblox.com/security/data/cve/CVE-2025-39953.md) | Routine | cgroup: split cgroup_destroy_wq into 3 workqueues | 5.5 | 0.0016 |  |
| [CVE-2025-39923](https://patchblox.com/security/data/cve/CVE-2025-39923.md) | Routine | dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees | 5.5 | 0.0015 |  |
| [CVE-2025-39885](https://patchblox.com/security/data/cve/CVE-2025-39885.md) | Routine | ocfs2: fix recursive semaphore deadlock in fiemap call | 5.5 | 0.0012 |  |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.