Homepage

CVE-2025-38715 Affecting kernel-uek package, versions <0:5.4.17-2136.348.3.el8uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-KERNELUEK-13540524
  • published13 Oct 2025
  • disclosed4 Sept 2025
Report a new vulnerability Found a mistake?

Introduced: 4 Sep 2025

CVE-2025-38715  (opens in a new tab)

How to fix?

Upgrade Oracle:8 kernel-uek to version 0:5.4.17-2136.348.3.el8uek or higher.
This issue was patched in ELSA-2025-20663.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek package and not the kernel-uek package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

hfs: fix slab-out-of-bounds in hfs_bnode_read()

This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.