Linux · Security advisory · September 8, 2025

ELSA-2025-20552: Security update for 19 packages

ELSA-2025-20552, released September 8, 2025, fixes 116 CVEs across 19 products. One of them is being exploited (CVE-2025-38352); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
116
None rated Critical
Exploited
1
CVE-2025-38352
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0136
71st percentile

Priority of the 116 CVEs

Patch now 1 Urgent 0 High 82 Routine 33

Fixed package versions

ProductReleaseFixed in
bpftoolol 80:5.15.0-312.187.5.el9uek
bpftoolol 90:5.15.0-312.187.5.el9uek
kernel-uekol 80:5.15.0-312.187.5.el9uek
kernel-uekol 90:5.15.0-312.187.5.el9uek
kernel-uek-containerol 80:5.15.0-312.187.5.el9uek
kernel-uek-containerol 90:5.15.0-312.187.5.el9uek
kernel-uek-container-debugol 80:5.15.0-312.187.5.el9uek
kernel-uek-container-debugol 90:5.15.0-312.187.5.el9uek
kernel-uek-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek-debugol 80:5.15.0-312.187.5.el9uek
kernel-uek-debugol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-develol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-develol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek-debug-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek-debug-modules-extraol 90:5.15.0-312.187.5.el9uek
kernel-uek-develol 80:5.15.0-312.187.5.el9uek
kernel-uek-develol 90:5.15.0-312.187.5.el9uek
kernel-uek-docol 80:5.15.0-312.187.5.el9uek
kernel-uek-docol 90:5.15.0-312.187.5.el9uek
kernel-uek-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek-modules-extraol 90:5.15.0-312.187.5.el9uek
kernel-uek64kol 80:5.15.0-312.187.5.el9uek
kernel-uek64kol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-coreol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-coreol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-develol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-develol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-modulesol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-modulesol 90:5.15.0-312.187.5.el9uek
kernel-uek64k-modules-extraol 80:5.15.0-312.187.5.el9uek
kernel-uek64k-modules-extraol 90:5.15.0-312.187.5.el9uek

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() 7.8 0.0136 KEVExploited
High CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request 7.1 0.0059 None reported
High CVE-2025-38035 nvmet-tcp: don't restore null sk_state_change 7.5 0.0057 None reported
High CVE-2025-38181 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). 7.0 0.0056 None reported
High CVE-2025-38001 net_sched: hfsc: Address reentrant enqueue adding class to eltree twice 7.8 0.0056 None reported
High CVE-2025-38052 net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done 7.8 0.0055 None reported
High CVE-2025-38399 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() 7.0 0.0051 None reported
High CVE-2025-38146 net: openvswitch: Fix the dead loop of MPLS parse 7.8 0.0049 None reported
High CVE-2025-38075 scsi: target: iscsi: Fix timeout on deleted connection 7.0 0.0046 None reported
High CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction 7.8 0.0041 None reported
High CVE-2025-38293 wifi: ath11k: fix node corruption in ar->arvifs list 7.0 0.0034 None reported
High CVE-2025-38003 can: bcm: add missing rcu read protection for procfs content 7.0 0.0030 None reported
High CVE-2025-38350 net/sched: Always pass notifications when child class becomes empty 7.8 0.0030 None reported
High CVE-2025-38004 can: bcm: add locking for bcm_op runtime updates 7.8 0.0028 None reported
High CVE-2025-38000 sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() 7.8 0.0024 None reported
High CVE-2025-38298 linux: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault A... 7.8 0.0023 None reported
High CVE-2025-38103 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 7.1 0.0023 None reported
High CVE-2025-37958 mm/huge_memory: fix dereferencing invalid pmd migration entry 7.1 0.0023 None reported
High CVE-2025-38115 net_sched: sch_sfq: fix a potential crash on gso_skb handling 7.0 0.0023 None reported
High CVE-2025-38147 calipso: Don't call calipso functions for AF_INET sk. 7.8 0.0023 None reported
High CVE-2025-38111 net/mdiobus: Fix potential out-of-bounds read/write access 7.1 0.0023 None reported
High CVE-2025-38077 platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() 7.8 0.0023 None reported
High CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary 7.0 0.0022 None reported
High CVE-2025-38498 do_change_type(): refuse to operate on unmounted/not ours mounts 7.9 0.0022 None reported
High CVE-2025-38332 scsi: lpfc: Use memcpy() for BIOS version 7.8 0.0022 None reported
Showing 1 to 25 of 116 1Next