vulnerability

Oracle Linux: CVE-2025-39847: ELSA-2025-25754: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Severity
6
CVSS
(AV:A/AC:M/Au:N/C:N/I:N/A:C)
Published
Sep 19, 2025
Added
Nov 11, 2025
Modified
Feb 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:
ppp: fix memory leak in pad_compress_skb
If alloc_skb() fails in pad_compress_skb(), it returns NULL without
releasing the old skb. The caller does:
skb = pad_compress_skb(ppp, skb);
if (!skb)
goto drop;
drop:
kfree_skb(skb);
When pad_compress_skb() returns NULL, the reference to the old skb is
lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.
Align pad_compress_skb() semantics with realloc(): only free the old
skb if allocation and compression succeed. At the call site, use the
new_skb variable so the original skb is not lost when pad_compress_skb()
fails.

Solution

oracle-linux-upgrade-kernel-uek
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.