CVE-2025-38500

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1].

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

[1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK>

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.17%Up 0.2 points since Aug 13, 2025

What each source reports

CVE List Score used 7.8

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2025-24267 7.8

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: EUVD-2025-24267
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7qhg-wpc6-3ff5 7.8

In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use...

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: GHSA-7qhg-wpc6-3ff5
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2025-38500 7.8

Record: BELL-CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 46 moreShow less

OSVDEBIAN-CVE-2025-38500 7.8

In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached. Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1]. Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces. [1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK>

Record: DEBIAN-CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2120 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

[0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)

WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work…

Record: OESA-2025-2120
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2121 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

Record: OESA-2025-2121
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2122 8.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns.

Record: OESA-2025-2122
CVSS 3.1: 8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15011 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:15011
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:15782 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:15782
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:17241 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:17241
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2025:15011 7.8

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:15011
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-38500 7.8

CVE-2025-38500 in linux - Patched by Root

Root has patched CVE-2025-38500 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-38500 7.8

CVE-2025-38500 in linux - Patched by Root

Root has patched CVE-2025-38500 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-38500 7.8

Record: UBUNTU-CVE-2025-38500
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2025:15011 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:15011
Updated: 2026-11-02

OSVALSA-2025:15782 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068)
kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392)
kernel: tcp: Correct signedness in skb remaining space calculation (CVE-2025-38463)
kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)
kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)
kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:15782
Updated: 2026-11-02

OSVASB-A-436201996 No score

In xfrmi_changelink of xfrm_interface_core.c, there is a possible use after free due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record: ASB-A-436201996
Updated: 2026-11-05

OSVAZL-66246 No score

CVE-2025-38500 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved:

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached.

Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces.

Record: AZL-66246
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20081-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

Record: openSUSE-SU-2025:20081-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03272-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to…

Record: SUSE-SU-2025:03272-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03290-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data()…

Record: SUSE-SU-2025:03290-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03301-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data()…

Record: SUSE-SU-2025:03301-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03382-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY…

Record: SUSE-SU-2025:03382-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03602-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-39782: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526).
CVE-2025-39773: net: bridge: fix soft lockup in br_multicast_query_expired() (bsc#1249504).
CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516).
CVE-2025-39718: vsock/virtio: Validate length in packet header before skb_put() (bsc#1249305).
CVE-2025-39705: drm/amd/display: fix a Null pointer dereference vulnerability (bsc#1249295).
CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315).
CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374).
CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1249284).
CVE-2025-39678: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290).
CVE-2025-38732: netfilter: nf_reject: do not leak dst refcount for loopback packets (bsc#1249262).
CVE-2025-38730: io_uring/net: commit partial buffers on retry (bsc#1249172).
CVE-2025-38722: habanalabs: fix UAF in export_dmabuf() (bsc#1249163).
CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump (bsc#1249176).
CVE-2025-38709: loop: Avoid updating block size under exclusive owner (bsc#1249199).
CVE-2025-38705: drm/amd/pm: fix null pointer access (bsc#1249334).
CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (bsc#1249258).
CVE-2025-38679: media: venus: Fix OOB read due to missing payload bound check (bsc#1249202).
CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126).
CVE-2025-38676: iommu/amd: Avoid stack buffer overflow from kernel cmdline (bsc#1248775).
CVE-2025-38668: regulator: core: fix NULL dereference on unbind due to stale coupling data (bsc#1248647).
CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string (bsc#1248634).
CVE-2025-38659: gfs2: No more self recovery (bsc#1248639).
CVE-2025-38645: net/mlx5: Check device memory pointer before usage (bsc#1248626).
CVE-2025-38643: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (bsc#1248681).
CVE-2025-38640: bpf: Disable migration in nf_hook_run_bpf() (bsc#1248622).
CVE-2025-38639: netfilter: xt_nfacct: do not assume acct name is null-terminated (bsc#1248674).
CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery (bsc#1248610).
CVE-2025-38622: net: drop UFO packets in udp_rcv_segment() (bsc#1248619).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
CVE-2025-38614: eventpoll: Fix semi-unbounded recursion (bsc#1248392).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38605: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (bsc#1248334).
CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port (bsc#1248378).
CVE-2025-38595: xen: fix UAF in dmabuf_exp_from_pages() (bsc#1248380).
CVE-2025-38593: kABI workaround for bluetooth discovery_state change (bsc#1248357).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found (bsc#1248360).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit() (bsc#1248365).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38556: HID: core: Harden s32ton() against conversion to 0 bits (bsc#1248296).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38544: rxrpc:…

Record: SUSE-SU-2025:03602-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03633-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38440: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38490: net: libwx: remove duplicate…

Record: SUSE-SU-2025:03633-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03634-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53261: coresight: Fix memory leak in acpi_buffer->pointer (bsc#1249770).
CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
CVE-2025-22022: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38263: bcache: fix NULL pointer in cache_set_flush() (bsc#1246248).
CVE-2025-38351: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (bsc#1246782).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38402: idpf: return 0 size for RSS key if not supported (bsc#1247262).
CVE-2025-38408: genirq/irq_sim: Initialize work context pointers properly (bsc#1247126).
CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails (bsc#1247137).
CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (bsc#1247136).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (bsc#1247099).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38466: perf: Revert to requiring CAP_SYS_ADMIN for uprobes (bsc#1247442).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision…

Record: SUSE-SU-2025:03634-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20653-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).

The following non-security bugs were fixed:

ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (stable-fixes).
ACPI: pfr_update: Fix the driver update version check (git-fixes).
ACPI: processor: fix…

Record: SUSE-SU-2025:20653-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20669-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).

The following non-security bugs were fixed:

ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (stable-fixes).
ACPI: pfr_update: Fix the driver update version check (git-fixes).
ACPI: processor: fix…

Record: SUSE-SU-2025:20669-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20739-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).

The following non-security bugs were fixed:

ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (stable-fixes).
ACPI: pfr_update: Fix the driver update version check (git-fixes).
ACPI: processor: fix…

Record: SUSE-SU-2025:20739-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20756-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-46733: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38245: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister() (bsc#1246193).
CVE-2025-38251: atm: clip: prevent NULL deref in clip_push() (bsc#1246181).
CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (bsc#1247155).
CVE-2025-38441: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167).
CVE-2025-38444: raid10: cleanup memleak at raid10_make_request (bsc#1247162).
CVE-2025-38445: md/raid1: Fix stack memory use after return in raid1_reshape (bsc#1247229).
CVE-2025-38458: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (bsc#1247116).
CVE-2025-38459: atm: clip: Fix infinite recursive call of clip_push() (bsc#1247119).
CVE-2025-38464: tipc: Fix use-after-free in tipc_conn_close() (bsc#1247112).
CVE-2025-38472: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (bsc#1247313).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38491: mptcp: make fallback action and fallback decision atomic (bsc#1247280).
CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248088).
CVE-2025-38506: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186).
CVE-2025-38520: drm/amdkfd: Do not call mmput from MMU notifier callback (bsc#1248217).
CVE-2025-38524: rxrpc: Fix recv-recv race of completed call (bsc#1248194).
CVE-2025-38528: bpf: Reject %p% format string in bprintf-like helpers (bsc#1248198).
CVE-2025-38531: iio: common: st_sensors: Fix use of uninitialize device structs (bsc#1248205).
CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
CVE-2025-38560: x86/sev: Evict cache lines during SNP memory validation (bsc#1248312).
CVE-2025-38585: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (bsc#1248355).
CVE-2025-38591: bpf: Reject narrower access to pointer ctx fields (bsc#1248363).
CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).

The following non-security bugs were fixed:

ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (stable-fixes).
ACPI: pfr_update: Fix the driver update version check (git-fixes).
ACPI: processor: fix…

Record: SUSE-SU-2025:20756-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21074-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

Record: SUSE-SU-2025:21074-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21085-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_3

This update for kernel-livepatch-MICRO-6-0-RT_Update_3 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1245778)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21085-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21086-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_4

This update for kernel-livepatch-MICRO-6-0-RT_Update_4 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1245778)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21086-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21087-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_5

This update for kernel-livepatch-MICRO-6-0-RT_Update_5 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21087-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21088-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_6

This update for kernel-livepatch-MICRO-6-0-RT_Update_6 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21088-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21089-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_7

This update for kernel-livepatch-MICRO-6-0-RT_Update_7 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21089-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21090-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_8

This update for kernel-livepatch-MICRO-6-0-RT_Update_8 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21090-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21091-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_9

This update for kernel-livepatch-MICRO-6-0-RT_Update_9 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21091-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21092-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_3

This update for kernel-livepatch-MICRO-6-0_Update_3 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1245778)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21092-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21093-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_4

This update for kernel-livepatch-MICRO-6-0_Update_4 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1245778)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21093-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21094-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_5

This update for kernel-livepatch-MICRO-6-0_Update_5 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21094-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21095-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_6

This update for kernel-livepatch-MICRO-6-0_Update_6 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21095-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21096-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_7

This update for kernel-livepatch-MICRO-6-0_Update_7 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21096-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21097-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_8

This update for kernel-livepatch-MICRO-6-0_Update_8 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21097-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21098-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_9

This update for kernel-livepatch-MICRO-6-0_Update_9 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21098-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21099-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_10

This update for kernel-livepatch-MICRO-6-0-RT_Update_10 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21099-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21100-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_10

This update for kernel-livepatch-MICRO-6-0_Update_10 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21100-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21103-1 No score

Security update for kernel-livepatch-MICRO-6-0-RT_Update_11

This update for kernel-livepatch-MICRO-6-0-RT_Update_11 fixes the following issues:

CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21103-1
Updated: 2026-11-02

OSVSUSE-SU-2025:21107-1 No score

Security update for kernel-livepatch-MICRO-6-0_Update_4

This update for kernel-livepatch-MICRO-6-0_Update_4 fixes the following issues:

CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242882)
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1245778)
CVE-2025-38500: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (bsc#1248672)
CVE-2025-38616: tls: handle data disappearing from under the TLS ULP (bsc#1249537)

Record: SUSE-SU-2025:21107-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`kernel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-devel-matched` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6

Show 290 moreShow less

Affected packages
Package	Affected	Fixed
`kernel-64k-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-devel-matched` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-64k-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-abi-stablelists` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-cross-headers` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-devel-matched` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-debug-uki-virt` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-devel-matched` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-doc` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-headers` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-64k-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-kvm` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-debug-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-kvm` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-modules` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-modules-core` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-rt-modules-extra` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-tools` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-tools-libs` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-tools-libs-devel` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`kernel-uki-virt` AlmaLinux:9 From an advisory covering 8 CVEs	before 5.14.0-570.39.1.el9_6	5.14.0-570.39.1.el9_6
`:linux_kernel:` Android	:0 up to :2025-12-05, plus listed versions Kernel	:2025-12-05
`kernel` Azure Linux:3	before 6.6.104.2-1	6.6.104.2-1
`linux-lts` Alpaquita:23	6.1.147-r0 up to 6.1.151-r0	6.1.151-r0
`linux-lts` Alpaquita:25	6.6.89-r0 up to 6.12.41-r0	6.12.41-r0
`linux-lts` Alpaquita:stream	6.12.92-r1 up to 6.18.35-r1	6.18.35-r1
`Kernel` Linux	6.1.0 up to 6.1.148, 6.2.0 up to 6.6.101, 6.7.0 up to 6.12.41, 6.13.0 up to 6.15.9	6.1.1486.6.1016.12.416.15.9
`linux` Debian:12	before 6.1.148-1, plus listed versions 6.1.106-16.1.106-26.1.106-36.1.112-16.1.115-1 Show 37 moreShow less 6.1.119-16.1.123-16.1.124-16.1.128-16.1.129-16.1.133-16.1.135-16.1.137-16.1.139-16.1.140-16.1.147-16.1.27-16.1.37-16.1.38-16.1.38-26.1.38-2~bpo11+16.1.38-36.1.38-46.1.38-4~bpo11+16.1.52-16.1.55-16.1.55-1~bpo11+16.1.64-16.1.66-16.1.67-16.1.69-16.1.69-1~bpo11+16.1.76-16.1.76-1~bpo11+16.1.82-16.1.85-16.1.90-16.1.90-1~bpo11+16.1.94-16.1.94-1~bpo11+16.1.98-16.1.99-1	6.1.148-1
`linux` Debian:13	before 6.12.41-1, plus listed versions 6.12.38-1	6.12.41-1
`linux` Debian:14	before 6.16.3-1, plus listed versions 6.12.100-16.12.101-16.12.105-16.12.107-16.12.38-1 Show 45 moreShow less 6.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp16.14.5-1~exp16.14.6-1~exp1	6.16.3-1
`linux-6.1` Debian:11 From an advisory covering 465 CVEs	before 6.1.153-1~deb11u1, plus listed versions 6.1.106-3~deb11u16.1.106-3~deb11u26.1.106-3~deb11u36.1.112-1~deb11u16.1.119-1~deb11u1 Show 6 moreShow less 6.1.128-1~deb11u16.1.129-1~deb11u16.1.137-1~deb11u16.1.140-1~deb11u16.1.147-1~deb11u16.1.148-1~deb11u1	6.1.153-1~deb11u1
`linux` Debian:13 From an advisory covering 66 CVEs	before 6.12.41-1, plus listed versions 6.12.38-1	6.12.41-1
`kernel` openEuler:24.03-LTS From an advisory covering 66 CVEs	before 6.6.0-108.0.0.100.oe2403	6.6.0-108.0.0.100.oe2403
`kernel` openEuler:24.03-LTS-SP1 From an advisory covering 69 CVEs	before 6.6.0-108.0.0.111.oe2403sp1	6.6.0-108.0.0.111.oe2403sp1
`kernel` openEuler:24.03-LTS-SP2 From an advisory covering 67 CVEs	before 6.6.0-108.0.0.114.oe2403sp2	6.6.0-108.0.0.114.oe2403sp2
`kernel-64k-debug-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-devel-matched` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-devel-matched` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-devel-matched` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-aarch64` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-ppc64le` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-s390x` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-x86_64` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-devel-matched` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-doc` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-rt-64k-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-rt-debug-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-rt-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-tools-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-zfcpdump-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-zfcpdump-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-zfcpdump-devel-matched` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`libperf-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`perf` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`perf-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`python3-perf` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`python3-perf-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`rtla` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`rv` Red Hat:enterprise_linux:9::appstream From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debug-modules-extra` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-modules` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-modules-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-64k-modules-extra` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-abi-stablelists` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-modules` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-modules-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-modules-extra` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debug-uki-virt` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-aarch64` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-ppc64le` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-s390x` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-debuginfo-common-x86_64` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-modules` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-modules-core` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-modules-extra` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel-rt-64k-debug-debuginfo` Red Hat:enterprise_linux:9::baseos From an advisory covering 8 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`kernel` Rocky Linux:9 From an advisory covering 7 CVEs	before 0:5.14.0-570.39.1.el9_6	0:5.14.0-570.39.1.el9_6
`linux` Root:Debian:12	before 6.1.190-1.aikido.167	6.1.190-1.aikido.167
`rootio-linux` Root:Debian:12	before 6.1.190-1.aikido.167	6.1.190-1.aikido.167
`linux` Root:Ubuntu:24.04	before 6.8.0-149.149.aikido.91	6.8.0-149.149.aikido.91
`rootio-linux` Root:Ubuntu:24.04	before 6.8.0-149.149.aikido.91	6.8.0-149.149.aikido.91
`kernel-livepatch-SLE15-SP6-RT_Update_15` SUSE:Linux Enterprise Live Patching 15 SP6 From an advisory covering 98 CVEs	before 1-150600.1.3.1	1-150600.1.3.1
`kernel-rt` SUSE:Real Time Module 15 SP6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-rt_debug` SUSE:Real Time Module 15 SP6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-source-rt` SUSE:Real Time Module 15 SP6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-syms-rt` SUSE:Real Time Module 15 SP6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-rt` openSUSE:Leap 15.6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-rt_debug` openSUSE:Leap 15.6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-source-rt` openSUSE:Leap 15.6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-syms-rt` openSUSE:Leap 15.6 From an advisory covering 98 CVEs	before 6.4.0-150600.10.52.1	6.4.0-150600.10.52.1
`kernel-64kb` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-default` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-default-base` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1.150700.17.11.2	6.4.0-150700.53.16.1.150700.17.11.2
`kernel-source` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-zfcpdump` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-docs` SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-obs-build` SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-source` SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-syms` SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-default` SUSE:Linux Enterprise Module for Legacy 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-default` SUSE:Linux Enterprise Live Patching 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-livepatch-SLE15-SP7_Update_4` SUSE:Linux Enterprise Live Patching 15 SP7 From an advisory covering 103 CVEs	before 1-150700.15.3.2	1-150700.15.3.2
`kernel-default` SUSE:Linux Enterprise High Availability Extension 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-default` SUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.53.16.1	6.4.0-150700.53.16.1
`kernel-64kb` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default-base` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1.150600.12.30.2	6.4.0-150600.23.70.1.150600.12.30.2
`kernel-source` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-zfcpdump` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-docs` SUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-obs-build` SUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-source` SUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-syms` SUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default` SUSE:Linux Enterprise Module for Legacy 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default` SUSE:Linux Enterprise Live Patching 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-livepatch-SLE15-SP6_Update_15` SUSE:Linux Enterprise Live Patching 15 SP6 From an advisory covering 99 CVEs	before 1-150600.13.3.2	1-150600.13.3.2
`kernel-default` SUSE:Linux Enterprise High Availability Extension 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default` SUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`dtb-aarch64` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-64kb` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-debug` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-default-base` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1.150600.12.30.2	6.4.0-150600.23.70.1.150600.12.30.2
`kernel-docs` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-kvmsmall` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-obs-build` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-obs-qa` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-source` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-syms` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-zfcpdump` openSUSE:Leap 15.6 From an advisory covering 99 CVEs	before 6.4.0-150600.23.70.1	6.4.0-150600.23.70.1
`kernel-livepatch-SLE15-SP7-RT_Update_4` SUSE:Linux Enterprise Live Patching 15 SP7 From an advisory covering 103 CVEs	before 1-150700.1.3.2	1-150700.1.3.2
`kernel-rt` SUSE:Real Time Module 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.7.16.1	6.4.0-150700.7.16.1
`kernel-source-rt` SUSE:Real Time Module 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.7.16.1	6.4.0-150700.7.16.1
`kernel-syms-rt` SUSE:Real Time Module 15 SP7 From an advisory covering 103 CVEs	before 6.4.0-150700.7.16.1	6.4.0-150700.7.16.1
`kernel-coco` SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 From an advisory covering 149 CVEs	before 6.4.0-15061.32.coco15sp6.1	6.4.0-15061.32.coco15sp6.1
`kernel-coco_debug` SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 From an advisory covering 149 CVEs	before 6.4.0-15061.32.coco15sp6.1	6.4.0-15061.32.coco15sp6.1
`kernel-source-coco` SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 From an advisory covering 149 CVEs	before 6.4.0-15061.32.coco15sp6.1	6.4.0-15061.32.coco15sp6.1
`kernel-syms-coco` SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 From an advisory covering 149 CVEs	before 6.4.0-15061.32.coco15sp6.1	6.4.0-15061.32.coco15sp6.1
`kernel-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 196 CVEs	before 6.4.0-150700.20.15.2	6.4.0-150700.20.15.2
`kernel-source-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 196 CVEs	before 6.4.0-150700.20.15.2	6.4.0-150700.20.15.2
`kernel-syms-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 196 CVEs	before 6.4.0-150700.20.15.1	6.4.0-150700.20.15.1
`kernel-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-source-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-syms-azure` SUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-azure` openSUSE:Leap 15.6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-source-azure` openSUSE:Leap 15.6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-syms-azure` openSUSE:Leap 15.6 From an advisory covering 445 CVEs	before 6.4.0-150600.8.52.1	6.4.0-150600.8.52.1
`kernel-default` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-default-base` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-34.1.21.11	6.4.0-34.1.21.11
`kernel-kvmsmall` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-source` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-default` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-default-base` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-34.1.21.11	6.4.0-34.1.21.11
`kernel-kvmsmall` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-source` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-34.1	6.4.0-34.1
`kernel-rt` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-36.1	6.4.0-36.1
`kernel-source-rt` SUSE:Linux Micro 6.0 From an advisory covering 96 CVEs	before 6.4.0-36.1	6.4.0-36.1
`kernel-rt` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-36.1	6.4.0-36.1
`kernel-source-rt` SUSE:Linux Micro 6.1 From an advisory covering 96 CVEs	before 6.4.0-36.1	6.4.0-36.1
`kernel-64kb` SUSE:Linux Micro 6.2 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-default` SUSE:Linux Micro 6.2 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-default-base` SUSE:Linux Micro 6.2 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1.160000.2.4	6.12.0-160000.6.1.160000.2.4
`linux-hwe-edge` Ubuntu:16.04:LTS	All versions, plus listed versions 4.8.0-28.30~16.04.14.8.0-30.32~16.04.14.8.0-32.34~16.04.14.8.0-34.36~16.04.14.10.0-14.16~16.04.1 Show 18 moreShow less 4.10.0-19.21~16.04.14.10.0-20.22~16.04.14.10.0-21.23~16.04.14.10.0-22.24~16.04.14.10.0-24.28~16.04.14.10.0-26.30~16.04.14.11.0-13.19~16.04.14.11.0-14.20~16.04.14.13.0-16.19~16.04.34.13.0-17.20~16.04.14.13.0-19.22~16.04.14.13.0-21.24~16.04.14.13.0-25.29~16.04.24.15.0-13.14~16.04.14.15.0-15.16~16.04.14.15.0-20.21~16.04.14.15.0-22.24~16.04.14.15.0-23.25~16.04.1	None known
`linux-aws-5.0` Ubuntu:18.04:LTS	All versions, plus listed versions 5.0.0-1021.24~18.04.15.0.0-1022.25~18.04.15.0.0-1023.26~18.04.15.0.0-1024.27~18.04.15.0.0-1025.285.0.0-1027.30	None known
`linux-aws-5.3` Ubuntu:18.04:LTS	All versions, plus listed versions 5.3.0-1016.17~18.04.15.3.0-1017.18~18.04.15.3.0-1019.21~18.04.15.3.0-1023.25~18.04.15.3.0-1028.30~18.04.1 Show 5 moreShow less 5.3.0-1030.32~18.04.15.3.0-1032.34~18.04.25.3.0-1033.355.3.0-1034.365.3.0-1035.37	None known
`linux-azure` Ubuntu:18.04:LTS	All versions, plus listed versions 4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.9 Show 39 moreShow less 4.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.194.15.0-1021.214.15.0-1022.234.15.0-1023.244.15.0-1025.264.15.0-1028.294.15.0-1030.314.15.0-1031.324.15.0-1032.334.15.0-1035.364.15.0-1036.384.15.0-1037.394.18.0-1011.11~18.04.14.18.0-1013.13~18.04.14.18.0-1014.14~18.04.14.18.0-1018.18~18.04.14.18.0-1019.19~18.04.14.18.0-1020.20~18.04.14.18.0-1023.24~18.04.14.18.0-1024.25~18.04.14.18.0-1025.27~18.04.15.0.0-1014.14~18.04.15.0.0-1016.17~18.04.15.0.0-1018.19~18.04.15.0.0-1020.21~18.04.15.0.0-1022.23~18.04.15.0.0-1023.24~18.04.15.0.0-1025.27~18.04.15.0.0-1027.29~18.04.15.0.0-1028.30~18.04.15.0.0-1029.31~18.04.15.0.0-1031.335.0.0-1032.345.0.0-1035.375.0.0-1036.38	None known
`linux-azure-5.3` Ubuntu:18.04:LTS	All versions, plus listed versions 5.3.0-1007.8~18.04.15.3.0-1008.9~18.04.15.3.0-1009.10~18.04.15.3.0-1010.11~18.04.15.3.0-1012.13~18.04.1 Show 11 moreShow less 5.3.0-1013.14~18.04.15.3.0-1016.17~18.04.15.3.0-1018.19~18.04.15.3.0-1019.20~18.04.15.3.0-1020.21~18.04.15.3.0-1022.23~18.04.15.3.0-1028.29~18.04.15.3.0-1031.32~18.04.15.3.0-1032.33~18.04.15.3.0-1034.35~18.04.15.3.0-1035.36	None known
`linux-azure-edge` Ubuntu:18.04:LTS	All versions, plus listed versions 4.18.0-1006.6~18.04.14.18.0-1007.7~18.04.14.18.0-1008.8~18.04.15.0.0-1012.12~18.04.2	None known
`linux-gcp` Ubuntu:18.04:LTS	All versions, plus listed versions 4.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.8 Show 33 moreShow less 4.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.184.15.0-1018.194.15.0-1019.204.15.0-1021.224.15.0-1023.244.15.0-1024.254.15.0-1025.264.15.0-1026.274.15.0-1027.284.15.0-1028.294.15.0-1029.314.15.0-1030.324.15.0-1032.344.15.0-1033.354.15.0-1034.364.15.0-1036.384.15.0-1037.394.15.0-1040.424.15.0-1042.454.15.0-1044.705.0.0-1020.20~18.04.15.0.0-1021.21~18.04.15.0.0-1025.26~18.04.15.0.0-1026.27~18.04.15.0.0-1028.29~18.04.15.0.0-1029.30~18.04.15.0.0-1031.325.0.0-1033.345.0.0-1034.35	None known
`linux-gcp-5.3` Ubuntu:18.04:LTS	All versions, plus listed versions 5.3.0-1008.9~18.04.15.3.0-1009.10~18.04.15.3.0-1010.11~18.04.15.3.0-1012.13~18.04.15.3.0-1014.15~18.04.1 Show 8 moreShow less 5.3.0-1016.17~18.04.15.3.0-1017.18~18.04.15.3.0-1018.19~18.04.15.3.0-1020.22~18.04.15.3.0-1026.28~18.04.15.3.0-1029.31~18.04.15.3.0-1030.32~18.04.15.3.0-1032.34~18.04.1	None known
`linux-gke-4.15` Ubuntu:18.04:LTS	All versions, plus listed versions 4.15.0-1030.324.15.0-1032.344.15.0-1033.354.15.0-1034.364.15.0-1036.38 Show 28 moreShow less 4.15.0-1037.394.15.0-1040.424.15.0-1041.434.15.0-1042.444.15.0-1044.464.15.0-1045.484.15.0-1046.494.15.0-1048.514.15.0-1049.524.15.0-1050.534.15.0-1052.554.15.0-1055.584.15.0-1057.604.15.0-1058.614.15.0-1059.624.15.0-1063.664.15.0-1064.674.15.0-1066.694.15.0-1067.704.15.0-1069.724.15.0-1070.734.15.0-1072.764.15.0-1073.784.15.0-1074.794.15.0-1076.814.15.0-1077.824.15.0-1078.834.15.0-1079.84	None known
`linux-gke-5.4` Ubuntu:18.04:LTS	All versions, plus listed versions 5.4.0-1025.25~18.04.15.4.0-1027.28~18.04.15.4.0-1029.31~18.04.15.4.0-1030.32~18.04.15.4.0-1032.34~18.04.1 Show 32 moreShow less 5.4.0-1033.35~18.04.15.4.0-1035.37~18.04.15.4.0-1036.38~18.04.15.4.0-1037.39~18.04.15.4.0-1039.41~18.04.15.4.0-1040.42~18.04.15.4.0-1042.44~18.04.15.4.0-1043.45~18.04.15.4.0-1044.46~18.04.15.4.0-1046.48~18.04.15.4.0-1049.52~18.04.15.4.0-1051.54~18.04.15.4.0-1052.55~18.04.15.4.0-1053.56~18.04.15.4.0-1054.57~18.04.15.4.0-1055.58~18.04.15.4.0-1056.59~18.04.15.4.0-1057.60~18.04.15.4.0-1059.62~18.04.15.4.0-1061.64~18.04.15.4.0-1062.65~18.04.15.4.0-1063.66~18.04.15.4.0-1065.68~18.04.15.4.0-1066.69~18.04.15.4.0-1067.70~18.04.15.4.0-1068.71~18.04.15.4.0-1071.76~18.04.35.4.0-1072.77~18.04.15.4.0-1074.79~18.04.15.4.0-1076.82~18.04.15.4.0-1078.84~18.04.15.4.0-1080.86~18.04.1	None known
`linux-gkeop-5.4` Ubuntu:18.04:LTS	All versions, plus listed versions 5.4.0-1001.15.4.0-1003.35.4.0-1004.55.4.0-1005.65.4.0-1007.8~18.04.1 Show 32 moreShow less 5.4.0-1008.9~18.04.15.4.0-1009.10~18.04.15.4.0-1010.11~18.04.15.4.0-1011.12~18.04.25.4.0-1012.13~18.04.15.4.0-1013.14~18.04.15.4.0-1014.15~18.04.15.4.0-1015.16~18.04.15.4.0-1016.17~18.04.15.4.0-1018.19~18.04.15.4.0-1021.22~18.04.15.4.0-1022.23~18.04.15.4.0-1023.24~18.04.15.4.0-1024.25~18.04.15.4.0-1025.26~18.04.15.4.0-1026.27~18.04.15.4.0-1027.28~18.04.15.4.0-1029.30~18.04.25.4.0-1031.32~18.04.15.4.0-1032.33~18.04.15.4.0-1033.34~18.04.15.4.0-1034.35~18.04.15.4.0-1036.37~18.04.15.4.0-1037.38~18.04.15.4.0-1038.39~18.04.15.4.0-1039.40~18.04.15.4.0-1040.41~18.04.15.4.0-1043.44~18.04.15.4.0-1046.48~18.04.15.4.0-1048.51~18.04.15.4.0-1049.52~18.04.15.4.0-1051.54~18.04.1	None known
`linux-hwe` Ubuntu:18.04:LTS	All versions, plus listed versions 4.18.0-13.14~18.04.14.18.0-14.15~18.04.14.18.0-15.16~18.04.14.18.0-16.17~18.04.14.18.0-17.18~18.04.1 Show 38 moreShow less 4.18.0-18.19~18.04.14.18.0-20.21~18.04.14.18.0-21.22~18.04.14.18.0-22.23~18.04.14.18.0-24.25~18.04.14.18.0-25.26~18.04.15.0.0-23.24~18.04.15.0.0-25.26~18.04.15.0.0-27.28~18.04.15.0.0-29.31~18.04.15.0.0-31.33~18.04.15.0.0-32.34~18.04.25.0.0-35.38~18.04.15.0.0-36.39~18.04.15.0.0-37.40~18.04.15.3.0-26.28~18.04.15.3.0-28.30~18.04.15.3.0-40.32~18.04.15.3.0-42.34~18.04.15.3.0-45.37~18.04.15.3.0-46.38~18.04.15.3.0-51.44~18.04.25.3.0-53.47~18.04.15.3.0-59.53~18.04.15.3.0-61.55~18.04.15.3.0-62.56~18.04.15.3.0-64.58~18.04.15.3.0-65.595.3.0-66.605.3.0-67.615.3.0-68.635.3.0-69.655.3.0-70.665.3.0-72.685.3.0-73.695.3.0-74.705.3.0-75.715.3.0-76.72	None known
`linux-hwe-edge` Ubuntu:18.04:LTS	All versions, plus listed versions 5.0.0-15.16~18.04.15.0.0-16.17~18.04.15.0.0-17.18~18.04.15.0.0-19.20~18.04.15.0.0-20.21~18.04.1 Show 5 moreShow less 5.3.0-19.20~18.04.25.3.0-22.24~18.04.15.3.0-23.25~18.04.15.3.0-23.25~18.04.25.3.0-24.26~18.04.2	None known
`linux-oem` Ubuntu:18.04:LTS	All versions, plus listed versions 4.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.12 Show 45 moreShow less 4.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.204.15.0-1018.214.15.0-1021.244.15.0-1024.294.15.0-1026.314.15.0-1028.334.15.0-1030.354.15.0-1033.384.15.0-1034.394.15.0-1035.404.15.0-1036.414.15.0-1038.434.15.0-1039.444.15.0-1043.484.15.0-1045.504.15.0-1050.574.15.0-1056.654.15.0-1057.664.15.0-1059.684.15.0-1063.724.15.0-1064.734.15.0-1065.754.15.0-1066.764.15.0-1067.774.15.0-1069.794.15.0-1073.834.15.0-1076.864.15.0-1079.894.15.0-1080.904.15.0-1081.914.15.0-1087.974.15.0-1090.1004.15.0-1091.1014.15.0-1093.1034.15.0-1094.1044.15.0-1096.1064.15.0-1097.1074.15.0-1099.1094.15.0-1100.1104.15.0-1101.1124.15.0-1102.1134.15.0-1103.114	None known
`linux-oracle-5.0` Ubuntu:18.04:LTS	All versions, plus listed versions 5.0.0-1007.12~18.04.15.0.0-1008.13~18.04.15.0.0-1009.14~18.04.15.0.0-1010.15~18.04.15.0.0-1011.165.0.0-1013.185.0.0-1014.19	None known
`linux-oracle-5.3` Ubuntu:18.04:LTS	All versions, plus listed versions 5.3.0-1011.12~18.04.15.3.0-1013.14~18.04.15.3.0-1014.15~18.04.15.3.0-1016.18~18.04.15.3.0-1018.20~18.04.1 Show 4 moreShow less 5.3.0-1024.26~18.04.15.3.0-1027.29~18.04.15.3.0-1028.30~18.04.15.3.0-1030.32~18.04.1	None known
`linux-aws-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-1009.9~20.04.25.11.0-1014.15~20.04.15.11.0-1016.17~20.04.15.11.0-1017.18~20.04.15.11.0-1019.20~20.04.1 Show 7 moreShow less 5.11.0-1020.21~20.04.25.11.0-1021.22~20.04.25.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.1	None known
`linux-aws-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1008.9~20.04.25.13.0-1011.12~20.04.15.13.0-1012.13~20.04.15.13.0-1014.15~20.04.15.13.0-1017.19~20.04.1 Show 8 moreShow less 5.13.0-1019.21~20.04.15.13.0-1021.23~20.04.25.13.0-1022.24~20.04.15.13.0-1023.25~20.04.15.13.0-1025.27~20.04.15.13.0-1028.31~20.04.15.13.0-1029.32~20.04.15.13.0-1031.35~20.04.1	None known
`linux-aws-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-1035.37~20.04.15.8.0-1038.40~20.04.15.8.0-1041.43~20.04.15.8.0-1042.44~20.04.1	None known
`linux-azure-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-1007.7~20.04.25.11.0-1012.13~20.04.15.11.0-1013.14~20.04.15.11.0-1015.16~20.04.15.11.0-1017.18~20.04.1 Show 8 moreShow less 5.11.0-1019.20~20.04.15.11.0-1020.21~20.04.15.11.0-1021.22~20.04.15.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.2	None known
`linux-azure-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1009.10~20.04.25.13.0-1012.14~20.04.15.13.0-1013.15~20.04.15.13.0-1014.16~20.04.15.13.0-1017.19~20.04.1 Show 7 moreShow less 5.13.0-1021.24~20.04.15.13.0-1022.26~20.04.15.13.0-1023.27~20.04.15.13.0-1025.29~20.04.15.13.0-1028.33~20.04.15.13.0-1029.34~20.04.15.13.0-1031.37~20.04.1	None known
`linux-azure-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-1033.35~20.04.15.8.0-1036.38~20.04.15.8.0-1039.42~20.04.15.8.0-1040.43~20.04.15.8.0-1041.44~20.04.15.8.0-1042.45~20.04.15.8.0-1043.46~20.04.1	None known
`linux-azure-fde` Ubuntu:20.04:LTS	All versions, plus listed versions 5.4.0-1063.66+cvm2.25.4.0-1063.66+cvm3.25.4.0-1064.67+cvm1.15.4.0-1065.68+cvm2.15.4.0-1067.70+cvm1.1 Show 21 moreShow less 5.4.0-1068.71+cvm1.15.4.0-1069.72+cvm1.15.4.0-1070.73+cvm1.15.4.0-1072.75+cvm1.15.4.0-1073.76+cvm1.15.4.0-1074.77+cvm1.15.4.0-1076.79+cvm1.15.4.0-1078.81+cvm1.15.4.0-1080.83+cvm1.15.4.0-1083.87+cvm1.15.4.0-1085.90+cvm1.15.4.0-1085.90+cvm2.15.4.0-1086.91+cvm1.15.4.0-1089.94+cvm1.25.4.0-1090.95+cvm1.15.4.0-1091.96+cvm1.15.4.0-1092.97+cvm1.15.4.0-1095.101+cvm1.15.4.0-1098.104+cvm1.15.4.0-1100.106+cvm1.15.4.0-1103.109+cvm1.1	None known
`linux-gcp-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-1009.10~20.04.15.11.0-1014.16~20.04.15.11.0-1017.19~20.04.15.11.0-1018.20~20.04.25.11.0-1020.22~20.04.1 Show 7 moreShow less 5.11.0-1021.23~20.04.15.11.0-1022.24~20.04.15.11.0-1023.25~20.04.15.11.0-1024.26~20.04.15.11.0-1026.29~20.04.15.11.0-1028.32~20.04.15.11.0-1029.33~20.04.3	None known
`linux-gcp-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1008.9~20.04.35.13.0-1012.15~20.04.15.13.0-1013.16~20.04.15.13.0-1015.18~20.04.15.13.0-1019.23~20.04.1 Show 8 moreShow less 5.13.0-1021.25~20.04.15.13.0-1023.28~20.04.15.13.0-1024.29~20.04.15.13.0-1025.30~20.04.15.13.0-1027.32~20.04.15.13.0-1030.36~20.04.15.13.0-1031.37~20.04.15.13.0-1033.40~20.04.1	None known
`linux-gcp-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-1032.34~20.04.15.8.0-1035.37~20.04.15.8.0-1038.40~20.04.15.8.0-1039.41	None known
`linux-gke` Ubuntu:20.04:LTS	All versions, plus listed versions 5.4.0-1033.355.4.0-1035.375.4.0-1036.385.4.0-1037.395.4.0-1039.41 Show 45 moreShow less 5.4.0-1041.435.4.0-1042.445.4.0-1043.455.4.0-1044.465.4.0-1046.485.4.0-1049.525.4.0-1051.545.4.0-1052.555.4.0-1053.565.4.0-1054.575.4.0-1055.585.4.0-1056.595.4.0-1057.605.4.0-1059.625.4.0-1061.645.4.0-1062.655.4.0-1063.665.4.0-1065.685.4.0-1066.695.4.0-1067.705.4.0-1068.715.4.0-1071.765.4.0-1072.775.4.0-1074.795.4.0-1076.825.4.0-1078.845.4.0-1080.865.4.0-1081.875.4.0-1083.895.4.0-1084.905.4.0-1086.935.4.0-1087.945.4.0-1090.975.4.0-1091.985.4.0-1094.1015.4.0-1095.1025.4.0-1096.1035.4.0-1097.1045.4.0-1098.1055.4.0-1099.1065.4.0-1100.1075.4.0-1101.1085.4.0-1102.1095.4.0-1103.1105.4.0-1104.111	None known
`linux-gke-5.15` Ubuntu:20.04:LTS	All versions, plus listed versions 5.15.0-1011.14~20.04.15.15.0-1014.17~20.04.15.15.0-1015.18~20.04.15.15.0-1016.19~20.04.15.15.0-1019.23~20.04.1 Show 13 moreShow less 5.15.0-1020.25~20.04.15.15.0-1023.28~20.04.25.15.0-1027.32~20.04.15.15.0-1028.33~20.04.15.15.0-1029.34~20.04.15.15.0-1031.36~20.04.15.15.0-1032.37~20.04.15.15.0-1033.38~20.04.15.15.0-1034.39~20.04.15.15.0-1036.41~20.04.15.15.0-1037.42~20.04.15.15.0-1038.43~20.04.15.15.0-1039.44~20.04.1	None known
`linux-gkeop` Ubuntu:20.04:LTS	All versions, plus listed versions 5.4.0-1008.95.4.0-1009.105.4.0-1010.115.4.0-1011.125.4.0-1012.13 Show 45 moreShow less 5.4.0-1013.145.4.0-1014.155.4.0-1015.165.4.0-1016.175.4.0-1018.195.4.0-1021.225.4.0-1022.235.4.0-1023.245.4.0-1024.255.4.0-1025.265.4.0-1026.275.4.0-1027.285.4.0-1029.305.4.0-1031.325.4.0-1032.335.4.0-1033.345.4.0-1034.355.4.0-1036.375.4.0-1037.385.4.0-1038.395.4.0-1039.405.4.0-1040.415.4.0-1043.445.4.0-1046.485.4.0-1048.515.4.0-1049.525.4.0-1051.545.4.0-1052.555.4.0-1053.565.4.0-1054.575.4.0-1056.605.4.0-1057.615.4.0-1060.645.4.0-1061.655.4.0-1062.665.4.0-1064.685.4.0-1065.695.4.0-1066.705.4.0-1067.715.4.0-1068.725.4.0-1069.735.4.0-1070.745.4.0-1071.755.4.0-1072.765.4.0-1073.77	None known
`linux-gkeop-5.15` Ubuntu:20.04:LTS	All versions, plus listed versions 5.15.0-1003.5~20.04.25.15.0-1005.7~20.04.15.15.0-1007.10~20.04.15.15.0-1008.12~20.04.15.15.0-1011.15~20.04.2 Show 40 moreShow less 5.15.0-1012.16~20.04.15.15.0-1013.17~20.04.15.15.0-1015.19~20.04.15.15.0-1016.21~20.04.15.15.0-1017.22~20.04.15.15.0-1018.23~20.04.15.15.0-1019.24~20.04.15.15.0-1020.25~20.04.15.15.0-1021.26~20.04.15.15.0-1022.27~20.04.15.15.0-1023.28~20.04.15.15.0-1024.29~20.04.15.15.0-1025.30~20.04.15.15.0-1026.31~20.04.15.15.0-1027.32~20.04.15.15.0-1028.33~20.04.15.15.0-1030.35~20.04.15.15.0-1031.37~20.04.15.15.0-1032.38~20.04.15.15.0-1033.39~20.04.15.15.0-1034.40~20.04.15.15.0-1035.41~20.04.15.15.0-1036.42~20.04.15.15.0-1037.43~20.04.15.15.0-1038.44~20.04.15.15.0-1039.45~20.04.15.15.0-1040.46~20.04.15.15.0-1043.50~20.04.15.15.0-1044.51~20.04.15.15.0-1045.52~20.04.15.15.0-1046.53~20.04.15.15.0-1047.54~20.04.15.15.0-1048.55~20.04.15.15.0-1049.56~20.04.15.15.0-1050.57~20.04.15.15.0-1051.58~20.04.15.15.0-1052.59~20.04.15.15.0-1053.60~20.04.15.15.0-1054.61~20.04.15.15.0-1055.62~20.04.1	None known
`linux-hwe-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-22.23~20.04.15.11.0-25.27~20.04.15.11.0-27.29~20.04.15.11.0-34.36~20.04.15.11.0-36.40~20.04.1 Show 7 moreShow less 5.11.0-37.41~20.04.25.11.0-38.42~20.04.15.11.0-40.44~20.04.25.11.0-41.45~20.04.15.11.0-43.47~20.04.25.11.0-44.48~20.04.25.11.0-46.51~20.04.1	None known
`linux-hwe-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-21.21~20.04.15.13.0-22.22~20.04.15.13.0-23.23~20.04.25.13.0-25.26~20.04.15.13.0-27.29~20.04.1 Show 11 moreShow less 5.13.0-28.31~20.04.15.13.0-30.33~20.04.15.13.0-35.40~20.04.15.13.0-37.42~20.04.15.13.0-39.44~20.04.15.13.0-40.45~20.04.15.13.0-41.46~20.04.15.13.0-44.49~20.04.15.13.0-48.54~20.04.15.13.0-51.58~20.04.15.13.0-52.59~20.04.1	None known
`linux-hwe-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-23.24~20.04.15.8.0-25.26~20.04.15.8.0-28.30~20.04.15.8.0-29.31~20.04.15.8.0-31.33~20.04.1 Show 16 moreShow less 5.8.0-33.36~20.04.15.8.0-34.37~20.04.25.8.0-36.40~20.04.15.8.0-38.43~20.04.15.8.0-40.45~20.04.15.8.0-41.46~20.04.15.8.0-43.49~20.04.15.8.0-44.50~20.04.15.8.0-45.51~20.04.15.8.0-48.54~20.04.15.8.0-49.55~20.04.15.8.0-50.56~20.04.15.8.0-53.60~20.04.15.8.0-55.62~20.04.15.8.0-59.66~20.04.15.8.0-63.71~20.04.1	None known
`linux-intel-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1007.75.13.0-1008.85.13.0-1009.95.13.0-1010.105.13.0-1011.115.13.0-1014.155.13.0-1017.19	None known
`linux-oem-5.10` Ubuntu:20.04:LTS	All versions, plus listed versions 5.10.0-1008.95.10.0-1011.125.10.0-1013.145.10.0-1014.155.10.0-1016.17 Show 21 moreShow less 5.10.0-1017.185.10.0-1019.205.10.0-1021.225.10.0-1022.235.10.0-1023.245.10.0-1025.265.10.0-1026.275.10.0-1029.305.10.0-1032.335.10.0-1033.345.10.0-1034.355.10.0-1038.405.10.0-1044.465.10.0-1045.475.10.0-1049.515.10.0-1050.525.10.0-1051.535.10.0-1052.545.10.0-1053.555.10.0-1055.585.10.0-1057.61	None known
`linux-oem-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1009.105.13.0-1010.115.13.0-1012.165.13.0-1014.185.13.0-1017.21 Show 7 moreShow less 5.13.0-1019.235.13.0-1020.245.13.0-1021.255.13.0-1022.265.13.0-1026.325.13.0-1028.355.13.0-1029.36	None known
`linux-oem-5.14` Ubuntu:20.04:LTS	All versions, plus listed versions 5.14.0-1004.45.14.0-1005.55.14.0-1007.75.14.0-1008.85.14.0-1010.10 Show 30 moreShow less 5.14.0-1011.115.14.0-1013.135.14.0-1018.195.14.0-1020.225.14.0-1022.245.14.0-1024.265.14.0-1027.305.14.0-1029.325.14.0-1031.345.14.0-1032.355.14.0-1033.365.14.0-1034.375.14.0-1036.405.14.0-1038.425.14.0-1042.475.14.0-1044.495.14.0-1045.515.14.0-1046.535.14.0-1047.545.14.0-1048.555.14.0-1049.565.14.0-1050.575.14.0-1051.585.14.0-1052.595.14.0-1054.615.14.0-1055.625.14.0-1056.635.14.0-1057.645.14.0-1058.665.14.0-1059.67	None known
`linux-oem-5.6` Ubuntu:20.04:LTS	All versions, plus listed versions 5.6.0-1007.75.6.0-1008.85.6.0-1010.105.6.0-1011.115.6.0-1013.13 Show 24 moreShow less 5.6.0-1017.175.6.0-1018.185.6.0-1020.205.6.0-1021.215.6.0-1023.235.6.0-1026.265.6.0-1027.275.6.0-1028.285.6.0-1031.325.6.0-1032.335.6.0-1033.355.6.0-1034.365.6.0-1035.375.6.0-1036.395.6.0-1039.435.6.0-1042.465.6.0-1047.515.6.0-1048.525.6.0-1050.545.6.0-1052.565.6.0-1053.575.6.0-1054.585.6.0-1055.595.6.0-1056.60	None known
`linux-oracle-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-1008.8~20.04.15.11.0-1013.14~20.04.15.11.0-1016.17~20.04.15.11.0-1017.18~20.04.15.11.0-1019.20~20.04.1 Show 7 moreShow less 5.11.0-1020.21~20.04.15.11.0-1021.22~20.04.15.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1025.27~20.04.15.11.0-1027.30~20.04.15.11.0-1028.31~20.04.1	None known
`linux-oracle-5.13` Ubuntu:20.04:LTS	All versions, plus listed versions 5.13.0-1011.13~20.04.25.13.0-1015.19~20.04.15.13.0-1016.20~20.04.15.13.0-1018.22~20.04.15.13.0-1021.26~20.04.1 Show 7 moreShow less 5.13.0-1025.30~20.04.15.13.0-1027.32~20.04.15.13.0-1028.33~20.04.15.13.0-1030.35~20.04.15.13.0-1033.39~20.04.15.13.0-1034.40~20.04.15.13.0-1036.43~20.04.1	None known
`linux-oracle-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-1031.32~20.04.25.8.0-1033.34~20.04.15.8.0-1034.35~20.04.25.8.0-1037.38~20.04.15.8.0-1038.39~20.04.1	None known
`linux-raspi2` Ubuntu:20.04:LTS	All versions, plus listed versions 5.3.0-1007.85.3.0-1014.165.3.0-1015.175.3.0-1017.195.4.0-1004.45.4.0-1006.6	None known
`linux-riscv` Ubuntu:20.04:LTS	All versions, plus listed versions 5.4.0-24.285.4.0-26.305.4.0-27.315.4.0-28.325.4.0-30.34 Show 7 moreShow less 5.4.0-31.355.4.0-33.375.4.0-34.385.4.0-36.415.4.0-37.425.4.0-39.445.4.0-40.45	None known
`linux-riscv-5.11` Ubuntu:20.04:LTS	All versions, plus listed versions 5.11.0-1015.16~20.04.15.11.0-1017.18~20.04.15.11.0-1018.19~20.04.25.11.0-1020.21~20.04.15.11.0-1021.22~20.04.1 Show 8 moreShow less 5.11.0-1022.23~20.04.15.11.0-1023.24~20.04.15.11.0-1024.25~20.04.15.11.0-1026.28~20.04.15.11.0-1028.31~20.04.15.11.0-1029.32~20.04.15.11.0-1030.345.11.0-1031.35	None known
`linux-riscv-5.8` Ubuntu:20.04:LTS	All versions, plus listed versions 5.8.0-14.16~20.04.15.8.0-14.16~20.04.35.8.0-16.18~20.04.15.8.0-17.19~20.04.15.8.0-18.20~20.04.1 Show 5 moreShow less 5.8.0-20.22~20.04.15.8.0-22.24~20.04.15.8.0-25.27~20.04.15.8.0-26.28~20.04.15.8.0-29.31~20.04.1	None known
`linux-allwinner-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-1007.7~22.04.15.19.0-1009.9~22.04.15.19.0-1010.10~22.04.15.19.0-1011.11~22.04.15.19.0-1012.12~22.04.15.19.0-1013.13~22.04.15.19.0-1014.14~22.04.15.19.0-1015.15~22.04.1	None known
`linux-aws-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-1019.20~22.04.15.19.0-1020.21~22.04.15.19.0-1022.23~22.04.15.19.0-1023.24~22.04.15.19.0-1024.25~22.04.1 Show 5 moreShow less 5.19.0-1025.26~22.04.15.19.0-1026.27~22.04.15.19.0-1027.28~22.04.15.19.0-1028.29~22.04.15.19.0-1029.30~22.04.1	None known
`linux-aws-6.2` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.0-1005.5~22.04.16.2.0-1006.6~22.04.16.2.0-1007.7~22.04.16.2.0-1008.8~22.04.16.2.0-1009.9~22.04.3 Show 9 moreShow less 6.2.0-1010.10~22.04.16.2.0-1011.11~22.04.16.2.0-1012.12~22.04.16.2.0-1013.13~22.04.16.2.0-1014.14~22.04.16.2.0-1015.15~22.04.16.2.0-1016.16~22.04.16.2.0-1017.17~22.04.16.2.0-1018.18~22.04.1	None known
`linux-aws-6.5` Ubuntu:22.04:LTS	All versions, plus listed versions 6.5.0-1008.8~22.04.16.5.0-1010.10~22.04.16.5.0-1011.11~22.04.16.5.0-1012.12~22.04.16.5.0-1014.14~22.04.1 Show 9 moreShow less 6.5.0-1015.15~22.04.16.5.0-1016.16~22.04.16.5.0-1017.17~22.04.26.5.0-1018.18~22.04.16.5.0-1020.20~22.04.16.5.0-1021.21~22.04.16.5.0-1022.22~22.04.16.5.0-1023.23~22.04.16.5.0-1024.24~22.04.1	None known
`linux-aws-6.8` Ubuntu:22.04:LTS	before 6.8.0-1040.42~22.04.1, plus listed versions 6.8.0-1009.9~22.04.26.8.0-1010.10~22.04.26.8.0-1011.12~22.04.16.8.0-1013.14~22.04.16.8.0-1014.15~22.04.1 Show 19 moreShow less 6.8.0-1015.16~22.04.16.8.0-1016.17~22.04.26.8.0-1017.18~22.04.16.8.0-1018.19~22.04.16.8.0-1019.21~22.04.16.8.0-1020.22~22.04.16.8.0-1021.23~22.04.16.8.0-1023.25~22.04.16.8.0-1024.26~22.04.16.8.0-1027.29~22.04.16.8.0-1028.30~22.04.16.8.0-1029.31~22.04.16.8.0-1030.32~22.04.16.8.0-1031.33~22.04.16.8.0-1032.34~22.04.16.8.0-1033.35~22.04.16.8.0-1035.37~22.04.16.8.0-1036.38~22.04.16.8.0-1039.41~22.04.1	6.8.0-1040.42~22.04.1
`linux-azure-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-1020.21~22.04.15.19.0-1021.22~22.04.15.19.0-1022.23~22.04.15.19.0-1023.24~22.04.15.19.0-1025.28~22.04.15.19.0-1026.29~22.04.15.19.0-1027.30~22.04.2	None known
`linux-azure-6.2` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.0-1005.5~22.04.16.2.0-1006.6~22.04.16.2.0-1007.7~22.04.16.2.0-1008.8~22.04.16.2.0-1009.9~22.04.3 Show 8 moreShow less 6.2.0-1011.11~22.04.16.2.0-1012.12~22.04.16.2.0-1014.14~22.04.16.2.0-1015.15~22.04.16.2.0-1016.16~22.04.16.2.0-1017.17~22.04.16.2.0-1018.18~22.04.16.2.0-1019.19~22.04.1	None known
`linux-azure-6.5` Ubuntu:22.04:LTS	All versions, plus listed versions 6.5.0-1007.7~22.04.16.5.0-1009.9~22.04.16.5.0-1010.10~22.04.16.5.0-1011.11~22.04.16.5.0-1015.15~22.04.1 Show 9 moreShow less 6.5.0-1016.16~22.04.16.5.0-1017.17~22.04.16.5.0-1018.19~22.04.26.5.0-1019.20~22.04.16.5.0-1021.22~22.04.16.5.0-1022.23~22.04.16.5.0-1023.24~22.04.16.5.0-1024.25~22.04.16.5.0-1025.26~22.04.1	None known
`linux-azure-6.8` Ubuntu:22.04:LTS	before 6.8.0-1040.46~22.04.1, plus listed versions 6.8.0-1008.8~22.04.16.8.0-1009.9~22.04.16.8.0-1010.10~22.04.16.8.0-1012.14~22.04.16.8.0-1013.15~22.04.1 Show 15 moreShow less 6.8.0-1014.16~22.04.16.8.0-1015.17~22.04.26.8.0-1017.20~22.04.16.8.0-1018.21~22.04.16.8.0-1020.23~22.04.16.8.0-1021.25~22.04.16.8.0-1025.30~22.04.16.8.0-1026.31~22.04.16.8.0-1027.32~22.04.16.8.0-1028.33~22.04.16.8.0-1029.34~22.04.16.8.0-1030.35~22.04.16.8.0-1031.36~22.04.16.8.0-1034.39~22.04.16.8.0-1036.42~22.04.1	6.8.0-1040.46~22.04.1
`linux-azure-fde-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-1025.28~22.04.1.15.19.0-1026.29~22.04.1.15.19.0-1027.30~22.04.2.1	None known
`linux-azure-fde-6.2` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.0-1008.8~22.04.1.16.2.0-1009.9~22.04.3.16.2.0-1011.11~22.04.1.16.2.0-1012.12~22.04.1.16.2.0-1014.14~22.04.1.1 Show 5 moreShow less 6.2.0-1015.15~22.04.1.16.2.0-1016.16~22.04.1.16.2.0-1017.17~22.04.1.16.2.0-1018.18~22.04.1.16.2.0-1019.19~22.04.1.1	None known
`linux-gcp-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-1020.22~22.04.25.19.0-1021.23~22.04.15.19.0-1022.24~22.04.15.19.0-1024.26~22.04.15.19.0-1025.27~22.04.15.19.0-1026.28~22.04.15.19.0-1027.29~22.04.15.19.0-1030.32~22.04.1	None known
`linux-gcp-6.2` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.0-1009.9~22.04.36.2.0-1010.10~22.04.16.2.0-1011.11~22.04.16.2.0-1011.11~22.04.36.2.0-1012.12~22.04.1 Show 7 moreShow less 6.2.0-1013.13~22.04.16.2.0-1014.14~22.04.16.2.0-1016.18~22.04.16.2.0-1017.19~22.04.16.2.0-1018.20~22.04.16.2.0-1019.21~22.04.16.2.0-1021.23~22.04.1	None known
`linux-gcp-6.5` Ubuntu:22.04:LTS	All versions, plus listed versions 6.5.0-1010.10~22.04.36.5.0-1011.11~22.04.16.5.0-1013.13~22.04.16.5.0-1014.14~22.04.16.5.0-1015.15~22.04.1 Show 8 moreShow less 6.5.0-1016.16~22.04.16.5.0-1017.17~22.04.16.5.0-1018.18~22.04.16.5.0-1020.20~22.04.16.5.0-1022.24~22.04.16.5.0-1023.25~22.04.16.5.0-1024.26~22.04.16.5.0-1025.27~22.04.1	None known
`linux-gcp-6.8` Ubuntu:22.04:LTS	before 6.8.0-1041.43~22.04.1, plus listed versions 6.8.0-1010.11~22.04.16.8.0-1011.12~22.04.16.8.0-1012.13~22.04.16.8.0-1013.14~22.04.16.8.0-1014.16~22.04.1 Show 21 moreShow less 6.8.0-1015.17~22.04.16.8.0-1016.18~22.04.16.8.0-1017.19~22.04.16.8.0-1018.20~22.04.16.8.0-1019.21~22.04.16.8.0-1020.22~22.04.16.8.0-1021.23~22.04.16.8.0-1024.26~22.04.16.8.0-1025.27~22.04.16.8.0-1026.28~22.04.16.8.0-1027.29~22.04.16.8.0-1028.30~22.04.16.8.0-1029.31~22.04.16.8.0-1030.32~22.04.16.8.0-1031.33~22.04.16.8.0-1032.34~22.04.16.8.0-1033.35~22.04.16.8.0-1034.36~22.04.26.8.0-1036.38~22.04.16.8.0-1037.39~22.04.16.8.0-1040.42~22.04.1	6.8.0-1041.43~22.04.1
`linux-hwe-5.19` Ubuntu:22.04:LTS	All versions, plus listed versions 5.19.0-28.29~22.04.15.19.0-32.33~22.04.15.19.0-35.36~22.04.15.19.0-38.39~22.04.15.19.0-40.41~22.04.1 Show 6 moreShow less 5.19.0-41.42~22.04.15.19.0-42.43~22.04.15.19.0-43.44~22.04.15.19.0-45.46~22.04.15.19.0-46.47~22.04.15.19.0-50.50	None known
`linux-hwe-6.2` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.0-25.25~22.04.26.2.0-26.26~22.04.16.2.0-31.31~22.04.16.2.0-32.32~22.04.16.2.0-33.33~22.04.1 Show 5 moreShow less 6.2.0-34.34~22.04.16.2.0-35.35~22.04.16.2.0-36.37~22.04.16.2.0-37.38~22.04.16.2.0-39.40~22.04.1	None known
`dtb-aarch64` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-64kb` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-default` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-default-base` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1.160000.2.4	6.12.0-160000.6.1.160000.2.4
`kernel-docs` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-kvmsmall` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-obs-build` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-obs-qa` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-rt` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-source` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-syms` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1
`kernel-zfcpdump` openSUSE:Leap 16.0 From an advisory covering 573 CVEs	before 6.12.0-160000.6.1	6.12.0-160000.6.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 6, 2026	affected	OSV
Nov 3, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-38500 is a high vulnerability (CVSS 7.8) in Debian Linux, published August 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in :linux_kernel: :2025-12-05.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 522 package rows, 41 versions, 1,945 references and the rest of 16 source descriptions. The JSON record has them. Also not on the record: 4 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 52 source records.