Linux · Security advisory · November 10, 2025

ELSA-2025-25755: Security update for 8 packages

ELSA-2025-25755, released November 10, 2025, fixes 9 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
9
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0048
41st percentile

Priority of the 9 CVEs

Patch now 0 Urgent 1 High 7 Routine 1

Fixed package versions

ProductReleaseFixed in
kernel-uekol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-containerol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-container-debugol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-debugol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-debug-develol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-develol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-docol 80:5.4.17-2136.349.3.1.el7uek
kernel-uek-toolsol 80:5.4.17-2136.349.3.1.el7uek

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2025-39898 e1000e: fix heap overflow in e1000_set_eeprom 9.8 n/a None reported
High CVE-2025-39841 scsi: lpfc: Fix buffer free/clear order in deferred receive path 7.8 0.0048 None reported
High CVE-2025-39864 wifi: cfg80211: fix use-after-free in cmp_bss() 7.8 0.0024 None reported
High CVE-2025-39860 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() 7.8 0.0023 None reported
High CVE-2025-39902 mm/slub: avoid accessing metadata when pointer is invalid in object_err() 7.8 0.0017 None reported
High CVE-2025-39853 i40e: Fix potential invalid access when MAC list is empty 7.1 0.0017 None reported
High CVE-2025-39891 wifi: mwifiex: Initialize the chan_stats array to zero 7.1 0.0017 None reported
High CVE-2025-37968 iio: light: opt3001: fix deadlock due to concurrent flag access 7.0 0.0016 None reported
Routine CVE-2025-39847 ppp: fix memory leak in pad_compress_skb 5.5 0.0016 None reported
Showing 1 to 9 of 9 1