Linux · Security advisory · September 8, 2025

ELSA-2025-20551: Security update for 35 packages

ELSA-2025-20551, released September 8, 2025, fixes 266 CVEs across 35 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
266
None rated Critical
Exploited
1
CVE-2025-38352
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0136
71st percentile

Priority of the 266 CVEs

Patch now 1 Urgent 0 High 164 Routine 101

Fixed package versions

ProductReleaseFixed in
kernel-uekol 100:6.12.0-103.40.4.1.el9uek
kernel-uekol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debugol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debugol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-debug-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-docol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-docol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek
kernel-uek-toolsol 100:6.12.0-103.40.4.1.el9uek
kernel-uek-toolsol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64kol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64kol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-develol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-develol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modulesol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modulesol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-coreol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-coreol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-deprecatedol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-deprecatedol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-desktopol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-desktopol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extraol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extraol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extra-netfilterol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-extra-netfilterol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-usbol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-usbol 90:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-wirelessol 100:6.12.0-103.40.4.1.el9uek
kernel-uek64k-modules-wirelessol 90:6.12.0-103.40.4.1.el9uek

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() 7.8 0.0136 KEVExploited
High CVE-2025-38488 kernel-livepatch-SLE15-SP7-RT_Update_0: This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.5 fixes various security issues The following security... 7.8 0.0077 None reported
High CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request 7.1 0.0059 None reported
High CVE-2025-38439 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT 7.8 0.0058 None reported
High CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). 7.0 0.0056 None reported
High CVE-2025-38399 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() 7.0 0.0051 None reported
High CVE-2025-38146 net: openvswitch: Fix the dead loop of MPLS parse 7.8 0.0049 None reported
High CVE-2025-38124 kernel-abi-stablelists: The kernel packages contain the Linux kernel, the core of any Linux operating system 7.0 0.0047 None reported
High CVE-2025-38471 tls: always refresh the queue when reading sock 7.8 0.0047 None reported
High CVE-2025-38472 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry 7.5 0.0046 None reported
High CVE-2025-38527 smb: client: fix use-after-free in cifs_oplock_break 7.8 0.0046 None reported
High CVE-2025-38264 nvme-tcp: sanitize request list handling 7.8 0.0045 None reported
High CVE-2025-38379 smb: client: fix warning when reconnecting channel 7.1 0.0041 None reported
High CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction 7.8 0.0041 None reported
High CVE-2025-38523 kernel: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercop... 7.3 0.0039 None reported
High CVE-2025-38495 HID: core: ensure the allocated report buffer can contain the reserved report ID 7.0 0.0038 None reported
High CVE-2025-38552 mptcp: plug races between subflow fail and subflow creation 7.8 0.0035 None reported
High CVE-2025-38293 wifi: ath11k: fix node corruption in ar->arvifs list 7.0 0.0034 None reported
High CVE-2025-38350 net/sched: Always pass notifications when child class becomes empty 7.8 0.0030 None reported
High CVE-2025-38236 af_unix: Don't leave consecutive consumed OOB skbs. 7.8 0.0030 None reported
High CVE-2025-38494 HID: core: do not bypass hid_hw_raw_request 7.8 0.0026 None reported
High CVE-2025-38244 smb: client: fix potential deadlock when reconnecting channels 7.0 0.0025 None reported
High CVE-2025-38512 wifi: prevent A-MSDU attacks in mesh networks 7.8 0.0025 None reported
High CVE-2025-38491 mptcp: make fallback action and fallback decision atomic 7.0 0.0024 None reported
High CVE-2025-38279 bpf: Do not include stack ptr register in precision backtracking bookkeeping 7.8 0.0024 None reported
Showing 1 to 25 of 266 1Next