CVE-2025-38147

calipso: Don't call calipso functions for AF_INET sk.

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

[0]: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Jul 3, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

CVE List No score

calipso: Don't call calipso functions for AF_INET sk.

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: CVE-2025-38147
Updated: 2026-11-05

EUVDEUVD-2025-19796 No score

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: EUVD-2025-19796
Updated: 2026-11-05

GitHub AdvisoriesGHSA-j6gx-m3wp-hf2m 5.5

In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso...

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: GHSA-j6gx-m3wp-hf2m
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2025-38147 5.5

Record: BELL-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-38147 5.5

In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:

Record: DEBIAN-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVOESA-2025-2310 7.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix kernel panic when alloc_page failed

We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.

This is because we don't reset full_len in tls_strp_flush_anchor_copy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset full_len.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tls_strp_check_rcv+0x128/0x27c tls_strp_data_ready+0x34/0x44 tls_data_ready+0x3c/0x1f0 tcp_data_ready+0x9c/0xe4 tcp_data_queue+0xf6c/0x12d0 tcp_rcv_established+0x52c/0x798(CVE-2025-38018)

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: OESA-2025-2310
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2311 7.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix kernel panic when alloc_page failed

We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: OESA-2025-2311
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2315 7.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/tls: fix kernel panic when alloc_page failed

We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: OESA-2025-2315
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:87805 7.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

RTLA segfaults on freed memory access on double SIGINT [rhel-9.8.z] (JIRA:Rocky Linux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:87805
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:88477 7.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

Bug Fix(es) and Enhancement(s):

Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z] (JIRA:Rocky Linux-179066)
RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:Rocky Linux-193031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:88477
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-38147 5.5

CVE-2025-38147 in linux - Patched by Root

Root has patched CVE-2025-38147 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-38147 5.5

CVE-2025-38147 in linux - Patched by Root

Root has patched CVE-2025-38147 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-38147 5.5

CVE-2025-38147 in linux - Patched by Root

Root has patched CVE-2025-38147 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2025-38147 5.5

CVE-2025-38147 in linux - Patched by Root

Root has patched CVE-2025-38147 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-38147
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-38147 5.7

Record: UBUNTU-CVE-2025-38147
CVSS 4.0: 5.7 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVALSA-2026:87805 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:87805
Updated: 2026-11-02

OSVALSA-2026:88477 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

Bug Fix(es) and Enhancement(s):

Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [almalinux-10.2.z] (JIRA:AlmaLinux-179066)
RTLA segfaults on freed memory access on double SIGINT [almalinux-10.2.z] (JIRA:AlmaLinux-193031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:88477
Updated: 2026-11-02

OSVAZL-64526 No score

CVE-2025-38147 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: AZL-64526
Updated: 2026-11-02

OSVCLSA-2025-1757963029 No score

kernel-uek: Fix of 195 CVEs

rds: tcp: block BH in TCP callbacks
kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
module: potential uninitialized return in module_kallsyms_on_each_symbol()
module: use RCU to synchronize find_module
kallsyms: refactor {,module_}kallsyms_on_each_symbol
LTS tag: v5.4.295
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
perf: Fix sample vs do_exit() {CVE-2025-38424}
s390/pci: Fix __pcilg_mio_inuser() inline assembly
rtc: test: Fix invalid format specifier.
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
rtc: Make rtc_time64_to_tm() support dates before 1970
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
net: atm: add lec_mutex {CVE-2025-38323}
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
hwmon: (occ) fix unaligned accesses
drm/nouveau/bl: increase buffer size to avoid truncate warning
erofs: remove unused trace event erofs_destroy_inode
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
Input: sparcspkr - avoid unannotated fall-through
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
scsi: s390: zfcp: Ensure synchronous unit_add
scsi: storvsc: Increase the timeouts to storvsc_timeout
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
platform/x86: dell_rbu: Stop overwriting data buffer
platform: Add Surface platform directory
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
tee: Prevent size calculation wraparound on 32-bit kernels
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
watchdog: da9052_wdt: respect TWDMIN
i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
sock: Correct error checking condition for (assign|release)_proto_idx()
scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
vxlan: Do not treat dst cache initialization errors as fatal
clk: rockchip: rk3036: mark ddrphy as critical
wifi: mac80211: do not offer a mesh path if forwarding is disabled
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
pinctrl: armada-37xx:…

Record: CLSA-2025-1757963029
Updated: 2026-11-02

OSVCLSA-2026-1780052998 No score

kernel: Fix of 102 CVEs

smb: client: reject userspace cifs.spnego descriptions
usb: ulpi: fix memory leak on ulpi_register() error paths
usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
mptcp: consolidate suboption status {CVE-2025-21707}
blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
net: usb: asix: validate PHY address before use {CVE-2025-71094}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT {CVE-2025-38335}
spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
mm/userfaultfd: fix hugetlb fault mutex hash calculation {CVE-2026-31575}
RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
calipso: Don't call calipso functions for AF_INET sk. {CVE-2025-38147}
mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
espintcp: fix skb leaks {CVE-2025-38057}
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
memcg: fix soft lockup in the OOM process {CVE-2024-57977}
futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
dm-verity: disable recursive forward error correction {CVE-2025-71161}
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
vfs: Don't evict inode under the inode lru traversing context {CVE-2024-45003}
ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
net: phy: leds: fix memory leak {CVE-2025-37989}
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}
io_uring: check if iowq is killed before queuing {CVE-2024-56709}
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
io_uring/tctx: work around xa_store() allocation error issue {CVE-2024-56584}
objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234} -…

Record: CLSA-2026-1780052998
Updated: 2026-11-02

OSV No score

calipso: Don't call calipso functions for AF_INET sk.

In the Linux kernel, the following vulnerability has been resolved:

calipso: Don't call calipso functions for AF_INET sk.

syzkaller reported a null-ptr-deref in txopt_get(). [0]

The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.

However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.

The root cause is missing validation in netlbl_conn_setattr().

netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket.

The syzkaller must have called connect() for an IPv6 address on an IPv4 socket.

We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage.

Let's copy the validation to netlbl_conn_setattr().

Record: CVE-2025-38147
Updated: 2026-11-06

OSVMGASA-2025-0218 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.101 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2025-0218
Updated: 2026-11-02

OSVMGASA-2025-0219 No score

Updated kernel, kmod-virtualbox, kmod-xtables-addons & wireless-regdb packages fix security vulnerabilities

Upstream kernel version 6.6.101 fixes bugs and vulnerabilities. The kmod-virtualbox, kmod-xtables-addons & wireless-regdb packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2025-0219
Updated: 2026-11-02

OSVSUSE-SU-2025:02846-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
CVE-2021-46987: btrfs: fix deadlock when cloning inline extents and using qgroups (bsc#1220704).
CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference (bsc#1205711).
CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
CVE-2022-49319: iommu/arm-smmu-v3: check return value after calling platform_get_resource() (bsc#1238374).
CVE-2022-49323: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (bsc#1238400).
CVE-2022-49768: 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (bsc#1242446).
CVE-2022-49825: ata: libata-transport: fix error handling in ata_tport_add() (bsc#1242548).
CVE-2022-49934: wifi: mac80211: Fix UAF in ieee80211_scan_rx() (bsc#1245051).
CVE-2022-49948: vt: Clear selection before changing the font (bsc#1245058).
CVE-2022-49969: drm/amd/display: clear optc underflow before turn off odm clock (bsc#1245060).
CVE-2022-49993: loop: Check for overflow while configuring loop (bsc#1245121).
CVE-2022-50025: cxl: Fix a memory leak in an error handling path (bsc#1245132).
CVE-2022-50027: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1245073).
CVE-2022-50030: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1245265).
CVE-2022-50033: usb: host: ohci-ppc-of: Fix refcount leak bug (bsc#1245139).
CVE-2022-50103: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (bsc#1244840).
CVE-2022-50149: driver core: fix potential deadlock in __driver_attach (bsc#1244883).
CVE-2022-50226: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak (bsc#1244860).
CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA (bsc#1210629).
CVE-2023-52878: can: dev: can_put_echo_skb(): do not crash kernel if can_priv::echo_skb is accessed out of bounds (bsc#1225000).
CVE-2023-53020: l2tp: close all race conditions in l2tp_tunnel_register() (bsc#1240224).
CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
CVE-2023-53118: scsi: core: Fix a procfs host directory removal regression (bsc#1242365).
CVE-2024-26974: crypto: qat - resolve race condition during AER recovery (bsc#1223638).
CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2025-21731: nbd: do not allow reconnect after disconnect (bsc#1237881).
CVE-2025-21928: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (bsc#1240722).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38040: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (bsc#1245078).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for…

Record: SUSE-SU-2025:02846-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02853-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

Record: SUSE-SU-2025:02853-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02923-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition (bsc#1139073).
CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (bsc#1235728).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
CVE-2024-58053: rxrpc: Fix handling of received connection abort (bsc#1238982).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
CVE-2025-38371: drm/v3d: Disable interrupts before resetting the GPU (bsc#1247178).
CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).
CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).
CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).
CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).
CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
CVE-2025-21720: xfrm: delete intermediate secpath entry in packet offload mode (bsc#1238859).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
CVE-2025-21899: tracing: Fix bad hist from corrupting named_triggers list (bsc#1240577).
CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
CVE-2025-21959: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (bsc#1240814).
CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-22111: kABI fix for net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF (bsc#1241572).
CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
CVE-2025-23163: net:…

Record: SUSE-SU-2025:02923-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02969-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

Record: SUSE-SU-2025:02969-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02996-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (1230216).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

Record: SUSE-SU-2025:02996-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02997-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695)
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).
CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma…

Record: SUSE-SU-2025:02997-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03011-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695).
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).
CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147:…

Record: SUSE-SU-2025:03011-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03023-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may (bsc#1139073)
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
CVE-2025-38188:…

Record: SUSE-SU-2025:03023-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20577-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
CVE-2025-38188:…

Record: SUSE-SU-2025:20577-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20586-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
CVE-2025-38188:…

Record: SUSE-SU-2025:20586-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20601-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
CVE-2025-38188:…

Record: SUSE-SU-2025:20601-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20602-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may
CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
CVE-2025-38188:…

Record: SUSE-SU-2025:20602-1
Updated: 2026-11-02

OSVUSN-7769-1 No score

linux, linux-aws, linux-gcp, linux-gcp-6.14, linux-oracle, linux-realtime vulnerabilities