CVE-2025-21996

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value.

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Apr 3, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-908
Updated: 2026-11-02

CVE List 5.5

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-908
Updated: 2026-11-02

EUVDEUVD-2025-9590 5.5

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: EUVD-2025-9590
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p42v-4mrm-3j3g 5.5

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix...

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: GHSA-p42v-4mrm-3j3g
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-908
Updated: 2026-11-02

OSVAZL-60252 5.5

CVE-2025-21996 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: AZL-60252
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-60258 5.5

CVE-2025-21996 affecting package kernel for versions less than 6.6.85.1-2

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: AZL-60258
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVBELL-CVE-2025-21996 5.5

Record: BELL-CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-21996 5.5

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

Record: DEBIAN-CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-1729 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()irq_find_at_or_after() dereferences the interrupt descriptor which isreturned by mt_find() while neither holding sparse_irq_lock nor RCU readlock, which means the descriptor can be freed between mt_find() and thedereference: CPU0 CPU1 desc = mt_find() delayed_free_desc(desc) irq_desc_get_irq(desc)The use-after-free is reported by KASAN: Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_read_iter+0x158/0x4ec proc_reg_read_iter+0x94/0x12c vfs_read+0x1e0/0x2c8 Freed by task 4471: slab_free_freelist_hook+0x174/0x1e0 __kmem_cache_free+0xa4/0x1dc kfree+0x64/0x128 irq_kobj_release+0x28/0x3c kobject_put+0xcc/0x1e0 delayed_free_desc+0x14/0x2c rcu_do_batch+0x214/0x720Guard the access with a RCU read lock section.(CVE-2024-38385)

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: fix shared irq handling on driver remove

lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are disabled early and the interrupts stay registered until the very end of the remove process due to the devm usage. This is potentially a bug as the interrupts access device registers which assumes clocks are enabled. A crash can be triggered by removing the driver in a kernel with CONFIG_DEBUG_SHIRQ enabled. This patch frees the interrupts at each lima device finishing callback so that the handlers are already unregistered by the time we fully disable clocks.(CVE-2024-42127)

In the Linux kernel, the following vulnerability has been resolved:mm: avoid overflows in dirty throttling logicThe dirty throttling logic is interspersed with assumptions that dirtylimits in PAGE_SIZE units fit into 32-bit (so that various multiplicationsfit into 64-bits). If limits end up being larger, we will hit overflows,possible divisions by 0 etc. Fix these problems by never allowing solarge dirty limits as they have dubious practical value anyway. Fordirty_bytes / dirty_background_bytes interfaces we can just refuse to setso large limits. For dirty_ratio / dirty_background_ratio it isn t sosimple as the dirty limit is computed from the amount of available memorywhich can change due to memory hotplug etc. So when converting dirtylimits from ratios to numbers of pages, we just don t allow the result toexceed UINT_MAX.This is root-only triggerable problem which occurs when the operatorsets dirty limits to >16 TB.(CVE-2024-42131)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()

For cases where the crtc's connectors_changed was set without enable/active getting toggled , there is an atomic_enable() call followed by an atomic_disable() but without an atomic_mode_set().

This results in a NULL ptr access for the dpu_encoder_get_drm_fmt() call in the atomic_enable() as the dpu_encoder's connector was cleared in the atomic_disable() but not re-assigned as there was no atomic_mode_set() call.

Fix the NULL ptr access by moving the assignment for atomic_enable() and also use drm_atomic_get_new_connector_for_encoder() to get the connector from the atomic_state.

Patchwork: https://patchwork.freedesktop.org/patch/606729/(CVE-2024-45015)

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free()…

Record: OESA-2025-1729
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1730 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)(CVE-2024-47732)

In the Linux kernel, the following vulnerability has been resolved:

tomoyo: don't emit warning in tomoyo_write_control()

syzbot is reporting too large allocation warning at tomoyo_write_control(), for one can write a very very long line without new line character. To fix this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE, for practically a valid line should be always shorter than 32KB where the "too small to fail" memory-allocation rule applies.

One might try to write a valid line that is longer than 32KB, but such request will likely fail with -ENOMEM. Therefore, I feel that separately returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant. There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.(CVE-2024-58085)

In the Linux kernel, the following vulnerability has been resolved:

sockmap, vsock: For connectible sockets allow only connected

sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there is an edge case where an unconnected (connectible) socket may lose its previously assigned transport. This is handled with a NULL check in the vsock/BPF recv path.

Another design detail is that listening vsocks are not supposed to have any transport assigned at all. Which implies they are not supported by the sockmap. But this is complicated by the fact that a socket, before switching to TCP_LISTEN, may have had some transport assigned during a failed connect() attempt. Hence, we may end up with a listening vsock in a sockmap, which blows up quickly:

KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_read_skb+0x4b/0x90 Call Trace: sk_psock_verdict_data_ready+0xa4/0x2e0 virtio_transport_recv_pkt+0x1ca8/0x2acc vsock_loopback_work+0x27d/0x3f0 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x35a/0x700 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30

For connectible sockets, instead of relying solely on the state of vsk->transport, tell sockmap to only allow those representing established connections. This aligns with the behaviour for AF_INET and AF_UNIX.(CVE-2025-21854)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0.

Similarly, if migration failed, memcg_data of the dst folio is left unset.

If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests:

./hmm-tests

...

RUN hmm.hmm_device_private.migrate ...

Record: OESA-2025-1730
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1870 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0.

Similarly, if migration failed, memcg_data of the dst folio is left unset.

If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests:

./hmm-tests

...

RUN hmm.hmm_device_private.migrate ...

[ 102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00 [ 102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff) [ 102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9 [ 102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000 [ 102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 102.087230][T14893] ------------[ cut here ]------------ [ 102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.090478][T14893] Modules linked in: [ 102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151 [ 102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.096104][T14893] Code: ... [ 102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293 [ 102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426 [ 102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880 [ 102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8 [ 102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000 [ 102.108830][T14893] FS: 00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 [ 102.110643][T14893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0 [ 102.113478][T14893] PKRU: 55555554 [ 102.114172][T14893] Call Trace: [ 102.114805][T14893] <TASK> [ 102.115397][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.116547][T14893] ? __warn.cold+0x110/0x210 [ 102.117461][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.118667][T14893] ? report_bug+0x1b9/0x320 [ 102.119571][T14893] ? handle_bug+0x54/0x90 [ 102.120494][T14893] ? exc_invalid_op+0x17/0x50 [ 102.121433][T14893] ? asm_exc_invalid_op+0x1a/0x20 [ 102.122435][T14893] ? __wake_up_klogd.part.0+0x76/0xd0 [ 102.123506][T14893] ? dump_page+0x4f/0x60 [ 102.124352][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.125500][T14893] folio_batch_move_lru+0xd4/0x200 [ 102.126577][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.127505][T14893] …

Record: OESA-2025-1870
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-21996 5.5

CVE-2025-21996 in linux - Patched by Root

Root has patched CVE-2025-21996 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-21996
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-21996 0.0

Record: UBUNTU-CVE-2025-21996
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVCLSA-2025-1747430034 No score

Fix of 54 CVEs

Bionic update: upstream stable patchset 2022-04-13 (LP: #1968932) // CVE- url: https://ubuntu.com/security/CVE-2022-23041
- xen/gnttab: fix gnttab_end_foreign_access() without page specified
Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49850
- nilfs2: fix deadlock in nilfs_count_free_blocks()
CVE-url: https://ubuntu.com/security/CVE-2024-42305
- ext4: check dot and dotdot of dx_root before making dir indexed
CVE-url: https://ubuntu.com/security/CVE-2024-53168
- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
CVE-url: https://ubuntu.com/security/CVE-2024-26915
- drm/amdgpu: Add check to prevent IH overflow
- drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
CVE-url: https://ubuntu.com/security/CVE-2024-56770
- net/sched: netem: account for backlog updates from child qdisc
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
Bionic update: upstream stable patchset 2022-01-14 (LP: #1957957) // CVE- url: https://ubuntu.com/security/CVE-2021-47587
- net: systemport: Add global locking for descriptor lifecycle
Bionic update: upstream stable patchset 2021-06-01 (LP: #1930472) // CVE- url: https://ubuntu.com/security/CVE-2021-46959
- spi: Fix use-after-free with devm_spi_alloc_*
CVE-url: https://ubuntu.com/security/CVE-2024-26689
- ceph: prevent use-after-free in encode_cap_msg()
CVE-url: https://ubuntu.com/security/CVE-2024-53066
- nfs: Fix KMSAN warning in decode_getfattr_attrs()
CVE-url: https://ubuntu.com/security/CVE-2024-49944
- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
CVE-url: https://ubuntu.com/security/CVE-2024-50237
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
CVE-url: https://ubuntu.com/security/CVE-2024-46780
- nilfs2: protect references to superblock parameters exposed in sysfs
CVE-url: https://ubuntu.com/security/CVE-2024-53063
- media: dvbdev: prevent the risk of out of memory access
- media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
CVE-url: https://ubuntu.com/security/CVE-2021-47150
- net: fec: fix the potential memory leak in fec_enet_init()
CVE-url: https://ubuntu.com/security/CVE-2024-53140
- netlink: terminate outstanding dump on socket close
CVE-url: https://ubuntu.com/security/CVE-2025-21971
- net_sched: Prevent creation of classes with TC_H_ROOT
CVE-url: https://ubuntu.com/security/CVE-2023-52572
- cifs: Fix UAF in cifs_demultiplex_thread()
CVE-url: https://ubuntu.com/security/CVE-2025-37785
- ext4: fix OOB read when checking dotdot dir
Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47277
- kvm: avoid speculation-based attacks from out-of-range memslot accesses
CVE-url: https://ubuntu.com/security/CVE-2022-49740
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49404
- RDMA/hfi1: Fix potential integer multiplication overflow errors
Bionic update: upstream stable patchset 2023-03-03 (LP: #2009237) // CVE- url: https://ubuntu.com/security/CVE-2022-49757
- EDAC/highbank: Fix memory leak in highbank_mc_probe()
Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49395
- um: Fix out-of-bounds read in LDT setup
CVE-url: https://ubuntu.com/security/CVE-2022-49738
- f2fs: fix to do sanity check on summary info
- f2fs: should put a page when checking the summary info
- f2fs: fix to do sanity check on i_extra_isize in is_alive()
CVE-url:…

Record: CLSA-2025-1747430034
Updated: 2026-11-02

OSVCLSA-2025-1747430081 No score

Fix of 47 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47352
- virtio-net: Add validation for used length
CVE-url: https://ubuntu.com/security/CVE-2024-46745
- Input: uinput - reject requests with unreasonable number of slots
CVE-url: https://ubuntu.com/security/CVE-2024-44952
- driver core: Fix uevent_show() vs driver detach race
CVE-url: https://ubuntu.com/security/CVE-2024-42304
- ext4: make sure the first directory block is not a hole
CVE-url: https://ubuntu.com/security/CVE-2024-42305
- ext4: check dot and dotdot of dx_root before making dir indexed
CVE-url: https://ubuntu.com/security/CVE-2024-53168
- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
CVE-url: https://ubuntu.com/security/CVE-2024-49925
- driver core: add dev_groups to all drivers
- driver core: Fix error return code in really_probe()
- fbdev: efifb: Register sysfs groups through driver core
CVE-url: https://ubuntu.com/security/CVE-2024-56661
- tipc: fix NULL deref in cleanup_bearer()
CVE-url: https://ubuntu.com/security/CVE-2024-56642
- tipc: Fix use-after-free of kernel socket in cleanup_bearer().
CVE-url: https://ubuntu.com/security/CVE-2021-47163
- tipc: wait and exit until all work queues are done
CVE-url: https://ubuntu.com/security/CVE-2024-26915
- drm/amdgpu: fix IH overflow on Vega10 v2
- drm/amdgpu: Add check to prevent IH overflow
- drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
CVE-url: https://ubuntu.com/security/CVE-2024-56770
- net/sched: netem: account for backlog updates from child qdisc
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
CVE-url: https://ubuntu.com/security/CVE-2024-50296
- net: hns3: fix kernel crash when uninstalling driver
CVE-url: https://ubuntu.com/security/CVE-2024-53066
- nfs: Fix KMSAN warning in decode_getfattr_attrs()
CVE-url: https://ubuntu.com/security/CVE-2024-49944
- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
CVE-url: https://ubuntu.com/security/CVE-2024-50237
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
CVE-url: https://ubuntu.com/security/CVE-2024-46780
- nilfs2: protect references to superblock parameters exposed in sysfs
CVE-url: https://ubuntu.com/security/CVE-2024-53063
- media: dvbdev: prevent the risk of out of memory access
- media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
CVE-url: https://ubuntu.com/security/CVE-2023-52927
- netfilter: allow exp not to be removed in nf_ct_find_expectation
CVE-url: https://ubuntu.com/security/CVE-2021-47150
- net: fec: fix the potential memory leak in fec_enet_init()
CVE-url: https://ubuntu.com/security/CVE-2024-53140
- netlink: terminate outstanding dump on socket close
CVE-url: https://ubuntu.com/security/CVE-2025-21971
- net_sched: Prevent creation of classes with TC_H_ROOT
CVE-url: https://ubuntu.com/security/CVE-2025-37785
- ext4: fix OOB read when checking dotdot dir
CVE-url: https://ubuntu.com/security/CVE-2023-52572
- cifs: Fix UAF in cifs_demultiplex_thread()
CVE-url: https://ubuntu.com/security/CVE-2022-49738
- f2fs: fix to do sanity check on summary info
- f2fs: should put a page when checking the summary info
- f2fs: fix to do sanity check on i_extra_isize in is_alive()
CVE-url: https://ubuntu.com/security/CVE-2022-49740
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
CVE-url: https://ubuntu.com/security/
- ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules
CVE-url: https://ubuntu.com/security/CVE-2023-53020
- l2tp: close all race conditions in l2tp_tunnel_register()
CVE-url: https://ubuntu.com/security/CVE-2025-21957
- scsi: qla1280: Fix kernel oops when debug level > 2 *…

Record: CLSA-2025-1747430081
Updated: 2026-11-02

OSVCLSA-2025-1747431461 No score

Fix of 39 CVEs

[ Ubuntu: 4.15.0-247.258 ]

CVE-url: https://ubuntu.com/security/CVE-2021-47352
- virtio-net: Add validation for used length
CVE-url: https://ubuntu.com/security/CVE-2024-46745
- Input: uinput - reject requests with unreasonable number of slots
CVE-url: https://ubuntu.com/security/CVE-2024-44952
- driver core: Fix uevent_show() vs driver detach race
CVE-url: https://ubuntu.com/security/CVE-2024-42304
- ext4: make sure the first directory block is not a hole
CVE-url: https://ubuntu.com/security/CVE-2024-42305
- ext4: check dot and dotdot of dx_root before making dir indexed
CVE-url: https://ubuntu.com/security/CVE-2024-53168
- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
CVE-url: https://ubuntu.com/security/CVE-2024-49925
- driver core: add dev_groups to all drivers
- driver core: Fix error return code in really_probe()
- fbdev: efifb: Register sysfs groups through driver core
CVE-url: https://ubuntu.com/security/CVE-2024-56661
- tipc: fix NULL deref in cleanup_bearer()
CVE-url: https://ubuntu.com/security/CVE-2024-56642
- tipc: Fix use-after-free of kernel socket in cleanup_bearer().
CVE-url: https://ubuntu.com/security/CVE-2021-47163
- tipc: wait and exit until all work queues are done
CVE-url: https://ubuntu.com/security/CVE-2024-26915
- drm/amdgpu: fix IH overflow on Vega10 v2
- drm/amdgpu: Add check to prevent IH overflow
- drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
CVE-url: https://ubuntu.com/security/CVE-2024-56770
- net/sched: netem: account for backlog updates from child qdisc
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
CVE-url: https://ubuntu.com/security/CVE-2024-50296
- net: hns3: fix kernel crash when uninstalling driver
CVE-url: https://ubuntu.com/security/CVE-2024-53066
- nfs: Fix KMSAN warning in decode_getfattr_attrs()
CVE-url: https://ubuntu.com/security/CVE-2024-49944
- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
CVE-url: https://ubuntu.com/security/CVE-2024-50237
- wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
CVE-url: https://ubuntu.com/security/CVE-2024-46780
- nilfs2: protect references to superblock parameters exposed in sysfs
CVE-url: https://ubuntu.com/security/CVE-2024-53063
- media: dvbdev: prevent the risk of out of memory access
- media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
CVE-url: https://ubuntu.com/security/CVE-2023-52927
- netfilter: allow exp not to be removed in nf_ct_find_expectation
CVE-url: https://ubuntu.com/security/CVE-2021-47150
- net: fec: fix the potential memory leak in fec_enet_init()
CVE-url: https://ubuntu.com/security/CVE-2024-53140
- netlink: terminate outstanding dump on socket close
CVE-url: https://ubuntu.com/security/CVE-2025-21971
- net_sched: Prevent creation of classes with TC_H_ROOT
CVE-url: https://ubuntu.com/security/CVE-2025-37785
- ext4: fix OOB read when checking dotdot dir
CVE-url: https://ubuntu.com/security/CVE-2023-52572
- cifs: Fix UAF in cifs_demultiplex_thread()
CVE-url: https://ubuntu.com/security/CVE-2022-49738
- f2fs: fix to do sanity check on summary info
- f2fs: should put a page when checking the summary info
- f2fs: fix to do sanity check on i_extra_isize in is_alive()
CVE-url: https://ubuntu.com/security/CVE-2022-49740
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of- bounds reads
CVE-url: https://ubuntu.com/security/
- ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules
CVE-url: https://ubuntu.com/security/CVE-2023-53020
- l2tp: close all race conditions in l2tp_tunnel_register()
CVE-url: https://ubuntu.com/security/CVE-2025-21957
- scsi: qla1280: Fix kernel oops…

Record: CLSA-2025-1747431461
Updated: 2026-11-02

OSVCLSA-2025-1757963029 No score

kernel-uek: Fix of 195 CVEs

rds: tcp: block BH in TCP callbacks
kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
module: potential uninitialized return in module_kallsyms_on_each_symbol()
module: use RCU to synchronize find_module
kallsyms: refactor {,module_}kallsyms_on_each_symbol
LTS tag: v5.4.295
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
perf: Fix sample vs do_exit() {CVE-2025-38424}
s390/pci: Fix __pcilg_mio_inuser() inline assembly
rtc: test: Fix invalid format specifier.
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
rtc: Make rtc_time64_to_tm() support dates before 1970
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
net: atm: add lec_mutex {CVE-2025-38323}
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
hwmon: (occ) fix unaligned accesses
drm/nouveau/bl: increase buffer size to avoid truncate warning
erofs: remove unused trace event erofs_destroy_inode
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
Input: sparcspkr - avoid unannotated fall-through
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
scsi: s390: zfcp: Ensure synchronous unit_add
scsi: storvsc: Increase the timeouts to storvsc_timeout
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
platform/x86: dell_rbu: Stop overwriting data buffer
platform: Add Surface platform directory
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
tee: Prevent size calculation wraparound on 32-bit kernels
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
watchdog: da9052_wdt: respect TWDMIN
i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
sock: Correct error checking condition for (assign|release)_proto_idx()
scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
vxlan: Do not treat dst cache initialization errors as fatal
clk: rockchip: rk3036: mark ddrphy as critical
wifi: mac80211: do not offer a mesh path if forwarding is disabled
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
pinctrl: armada-37xx:…

Record: CLSA-2025-1757963029
Updated: 2026-11-02

OSVCLSA-2026-1778266904 No score

kernel: Fix of 189 CVEs

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
xfrm: esp: avoid in-place decrypt on shared skb frags
clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
thermal: int340x: Add NULL check for adev {CVE-2025-23136}
wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
dma: fix call order in dmam_free_coherent {CVE-2024-43856}
scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
filemap: Fix bounds checking in filemap_read()…

Record: CLSA-2026-1778266904
Updated: 2026-11-02

OSVCLSA-2026-1778787063 No score

kernel: Fix of 123 CVEs

net: skbuff: propagate shared-frag marker through pskb_copy()
mptcp: always handle address removal under msk socket lock {CVE-2025-21875}
uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() {CVE-2025-21744}
mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
ice: fix memory leak in aRFS after reset {CVE-2025-21981}
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
net: decrease cached dst counters in dst_release {CVE-2025-22057}
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params {CVE-2025-21941}
drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities {CVE-2025-39707}
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
usb: net: sierra: check for no status endpoint {CVE-2025-38474}
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
thermal: int340x: Add NULL check for adev {CVE-2025-23136}
Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
dm-stripe: fix a possible integer overflow {CVE-2025-39940}
usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
usbnet: fix memory leak in error case {CVE-2022-49657}
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
posix-clock: Fix missing timespec64 check in pc_clock_settime() {CVE-2024-50195}
net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow…

Record: CLSA-2026-1778787063
Updated: 2026-11-02

OSVMGASA-2025-0142 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.87 fixes bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2025-0142
Updated: 2026-11-02

OSVMGASA-2025-0146 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.88 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2025-0146
Updated: 2026-11-02

OSVSUSE-SU-2025:01614-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720). -…

Record: SUSE-SU-2025:01614-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01707-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-27415: netfilter: bridge: confirm multicast packets before passing them up the stack (bsc#1224757).
CVE-2024-28956: Intel CPU: Indirect Target Selection (ITS) (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-46763: fou: Fix null-ptr-deref in GRO (bsc#1230764).
CVE-2024-50038: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (bsc#1231910).
CVE-2024-50162: bpf: devmap: provide rxq after redirect (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: sockmap, vsock: For connectible sockets allow only connected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).…

Record: SUSE-SU-2025:01707-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

Record: SUSE-SU-2025:01919-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01951-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

Record: SUSE-SU-2025:01951-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01964-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not…

Record: SUSE-SU-2025:01964-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01967-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

Record: SUSE-SU-2025:01967-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1293-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com (bsc#1237767).
CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname() (bsc#1237932).
CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729). -…

Record: SUSE-SU-2025:1293-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20192-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20192-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20206-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).

The following non-security bugs were fixed:

ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (stable-fixes).
ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (git-fixes).
ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (git-fixes).
ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (git-fixes).
ASoC: imx-card: Add NULL check in imx_card_probe() (git-fixes).
ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns (git-fixes).
ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment (git-fixes).
ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (git-fixes).
HID:…

Record: SUSE-SU-2025:20206-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20270-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20270-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20283-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).

The following non-security bugs were fixed:

ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (stable-fixes).
ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (git-fixes).
ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (git-fixes).
ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (git-fixes).
ASoC: imx-card: Add NULL check in imx_card_probe() (git-fixes).
ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns (git-fixes).
ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment (git-fixes).
ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (git-fixes).
HID:…

Record: SUSE-SU-2025:20283-1
Updated: 2026-11-02

OSVUSN-7585-1 No score

linux, linux-aws, linux-aws-5.4, linux-azure, linux-gcp, linux-gcp-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)