Skip to content
OpenAdvisories
High 1 exploited CVE ELSA-2025-20608 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

Published Sep 22, 2025 · Updated Sep 22, 2025

Ecosystem: Oracle Linux

Summary

[6.12.0-103.40.4.3]
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38453836] {CVE-2025-38560}
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38453837] {CVE-2025-38500}
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38453835] {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38453834] {CVE-2025-38571}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38453833] {CVE-2025-38618}
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38453832] {CVE-2025-39682}

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 9 kernel-uek 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-devel 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-deprecated 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-desktop 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra-netfilter 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-usb 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-wireless 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-devel 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-doc 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-deprecated 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-desktop 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-extra 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-extra-netfilter 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-usb 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-modules-wireless 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek-tools 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-devel 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-core 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-deprecated 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-desktop 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra-netfilter 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-usb 0:6.12.0-103.40.4.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-wireless 0:6.12.0-103.40.4.3.el10uek

Vulnerabilities 6

  • Critical 9.8
    CVE-2025-39682 Exploited Public exploit

    tls: fix handling of zero-length records on the rx_list

    In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • Critical 9.8
    CVE-2025-38566

    sunrpc: fix handling of server side tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2025-38560

    x86/sev: Evict cache lines during SNP memory validation

    In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to priv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2025-38571

    sunrpc: fix client side handling of tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38500

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface

    In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38618

    vsock: Do not allow binding to VMADDR_PORT_ANY

    In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux