CVE-2025-21735

NFC: nci: Add bounds checking in nci_hci_create_pipe()

8.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.38%Up 0.3 points since Feb 27, 2025

What each source reports

CVE List Score used 8.8

NFC: nci: Add bounds checking in nci_hci_create_pipe()

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: CVE-2025-21735
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-5189 8.8

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: EUVD-2025-5189
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-63p9-c49j-px3q 7.8

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds...

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: GHSA-63p9-c49j-px3q
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 8.8

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: CVE-2025-21735
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2025-21735 7.8

Record: BELL-CVE-2025-21735
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.8

NFC: nci: Add bounds checking in nci_hci_create_pipe()

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: CVE-2025-21735
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 46 moreShow less

OSVDEBIAN-CVE-2025-21735 7.8

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in nci_hci_create_pipe() The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Record: DEBIAN-CVE-2025-21735
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1283 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: sfc: add missing xdp queue reinitialization

After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT.

When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (tx_queue->buffer). But it misses reinitializing xdp queues(efx->xdp_tx_queues). So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer.

A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues.

Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueue_task_fair+0x95/0x550 efx_poll+0xc4/0x360 sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - add param check for DH

Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer.(CVE-2022-49564)

In the Linux kernel, the following vulnerability has been resolved:

srcu: Tighten cleanup_srcu_struct() GP checks

Currently, cleanup_srcu_struct() checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation could result in a use-after-free bug, so this commit adds a check for a grace period that is needed but not yet started to cleanup_srcu_struct().(CVE-2022-49651)

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix UAF in cifs_demultiplex_thread()

There is a UAF when xfstests on cifs:

BUG: KASAN:…

Record: OESA-2025-1283
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1284 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: sfc: add missing xdp queue reinitialization

After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT.

A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues.

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - add param check for DH

In the Linux kernel, the following vulnerability has been resolved:

srcu: Tighten cleanup_srcu_struct() GP checks

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix TCP timers deadlock after rmmod

Commit ef7134c7fc48 ("smb: client: Fix…

Record: OESA-2025-1284
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1446 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.(CVE-2024-53162)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of signing key

Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:

task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() UAF

Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.(CVE-2024-53179)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.(CVE-2024-54458)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN:

------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat…

Record: OESA-2025-1446
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1450 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to shrink read extent node in batches

We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue.

This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold.(CVE-2024-41935)

In the Linux kernel, the following vulnerability has been resolved:

vrf: revert "vrf: Remove unnecessary RCU-bh critical section"

This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.

dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:

    /* Disable soft irqs for various locks below. Also
     * stops preemption for RCU.
     */
    rcu_read_lock_bh();

VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:

================================
WARNING: inconsistent lock state
6.11.0 #1 Tainted: G        W
--------------------------------
inconsistent {IN-SOFTIRQ-W} -&gt; {SOFTIRQ-ON-W} usage.
btserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30
{IN-SOFTIRQ-W} state was registered at:
  lock_acquire+0x19a/0x4f0
  _raw_spin_lock+0x27/0x40
  packet_rcv+0xa33/0x1320
  __netif_receive_skb_core.constprop.0+0xcb0/0x3a90
  __netif_receive_skb_list_core+0x2c9/0x890
  netif_receive_skb_list_internal+0x610/0xcc0
      [...]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(rlock-AF_PACKET);
  &lt;Interrupt&gt;
    lock(rlock-AF_PACKET);

 *** DEADLOCK ***

Call Trace:
 &lt;TASK&gt;
 dump_stack_lvl+0x73/0xa0
 mark_lock+0x102e/0x16b0
 __lock_acquire+0x9ae/0x6170
 lock_acquire+0x19a/0x4f0
 _raw_spin_lock+0x27/0x40
 tpacket_rcv+0x863/0x3b30
 dev_queue_xmit_nit+0x709/0xa40
 vrf_finish_direct+0x26e/0x340 [vrf]
 vrf_l3_out+0x5f4/0xe80 [vrf]
 __ip_local_out+0x51e/0x7a0
      [...](CVE-2024-49980)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to…

Record: OESA-2025-1450
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-21735 7.8

CVE-2025-21735 in linux - Patched by Root

Root has patched CVE-2025-21735 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-21735
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-21735 7.8

Record: UBUNTU-CVE-2025-21735
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2025-1744213128 No score

Fix of 55 CVEs

CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2025-21791
- vrf: use RCU protection in l3mdev_l3_out()
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
CVE-url: https://ubuntu.com/security/CVE-2025-21782
- orangefs: fix a oob in orangefs_debug_write
CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2024-47696
- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
CVE-url: https://ubuntu.com/security/CVE-2024-50074
- parport: Proper fix for array out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-57889
- regmap: allow to disable all locking mechanisms
- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe list first function
CVE-url: https://ubuntu.com/security/CVE-2024-56594
- drm/amdgpu: set the right AMDGPU sg segment limitation
CVE-url: https://ubuntu.com/security/CVE-2024-56681
- crypto: bcm - add error check in the ahash_hmac_init function
CVE-url: https://ubuntu.com/security/CVE-2024-52332
- igb: Fix potential invalid memory access in igb_init_module()
CVE-url:…

Record: CLSA-2025-1744213128
Updated: 2026-11-02

OSVCLSA-2025-1744624441 No score

Fix of 56 CVEs

[ Ubuntu: 4.15.0-246.257 ]

CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2025-21791
- vrf: use RCU protection in l3mdev_l3_out()
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
CVE-url: https://ubuntu.com/security/CVE-2025-21782
- orangefs: fix a oob in orangefs_debug_write
CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2024-47696
- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
CVE-url: https://ubuntu.com/security/CVE-2024-50074
- parport: Proper fix for array out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-57889
- regmap: allow to disable all locking mechanisms
- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe list first function
CVE-url: https://ubuntu.com/security/CVE-2024-56594
- drm/amdgpu: set the right AMDGPU sg segment limitation
CVE-url: https://ubuntu.com/security/CVE-2024-56681
- crypto: bcm - add error check in the ahash_hmac_init function
CVE-url: https://ubuntu.com/security/CVE-2024-52332
- igb: Fix potential invalid memory access in…

Record: CLSA-2025-1744624441
Updated: 2026-11-02

OSVCLSA-2025-1744713316 No score

Fix of 50 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26872
- RDMA/srpt: Do not register event handler until srpt device is fully setup
CVE-url: https://ubuntu.com/security/CVE-2024-53179
- smb: client: fix use-after-free of signing key
CVE-url: https://ubuntu.com/security/CVE-2021-47357
- atm: iphase: fix possible use-after-free in ia_module_exit()
Bionic update: upstream stable patchset 2022-11-15 (LP: #1996650) // CVE- url: https://ubuntu.com/security/CVE-2021-47103
- inet: fully convert sk->sk_rx_dst to RCU rules
CVE-url: https://ubuntu.com/security/CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
CVE-url: https://ubuntu.com/security/CVE-2024-36921
- wifi: iwlwifi: mvm: guard against invalid STA ID on removal
Bionic update: upstream stable patchset 2022-07-25 (LP: #1982782) // CVE- url: https://ubuntu.com/security/CVE-2022-49478
- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
CVE-url: https://ubuntu.com/security/CVE-2023-52621
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
CVE-url: https://ubuntu.com/security/CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
CVE-url: https://ubuntu.com/security/CVE-2021-47110
- x86/kvm: Disable kvmclock on all CPUs on shutdown
CVE-url: https://ubuntu.com/security/CVE-2024-57980
- media: uvcvideo: Fix double free in error path
CVE-url: https://ubuntu.com/security/CVE-2025-21718
- net: rose: fix timer races against user threads
CVE-url: https://ubuntu.com/security/CVE-2025-21735
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-url: https://ubuntu.com/security/CVE-2023-52805
- jfs: fix array-index-out-of-bounds in diAlloc
CVE-url: https://ubuntu.com/security/CVE-2023-52847
- media: bttv: fix use after free error due to btv->timeout timer
CVE-url: https://ubuntu.com/security/CVE-2024-41014
- xfs: add bounds checking to xlog_recover_process_data
Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48702
- ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48701
- ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
CVE-url: https://ubuntu.com/security/CVE-2024-26982
- Squashfs: check the inode number is not the invalid value of zero
CVE-url: https://ubuntu.com/security/CVE-2024-56548
- hfsplus: don't query the device logical block size multiple times
CVE-url: https://ubuntu.com/security/CVE-2024-57850
- jffs2: Prevent rtime decompress memory corruption
CVE-url: https://ubuntu.com/security/CVE-2024-49982
- aoe: fix the potential use-after-free problem in more places
CVE-url: https://ubuntu.com/security/CVE-2025-21687
- vfio/platform: check the bounds of read/write syscalls
CVE-url: https://ubuntu.com/security/CVE-2024-56539
- wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
CVE-url: https://ubuntu.com/security/CVE-2024-53680
- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
CVE-url: https://ubuntu.com/security/CVE-2024-56630
- ocfs2: free inode when ocfs2_get_init_inode() fails
CVE-url: https://ubuntu.com/security/CVE-2024-53184
- um: ubd: Do not use drvdata in release
CVE-url: https://ubuntu.com/security/CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-url: https://ubuntu.com/security/CVE-2024-56597
- jfs: fix shift-out-of-bounds in dbSplit
CVE-url: https://ubuntu.com/security/CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe…

Record: CLSA-2025-1744713316
Updated: 2026-11-02

OSVSUSE-SU-2025:01600-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840).
CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139).
CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244).
CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937).
CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors…

Record: SUSE-SU-2025:01600-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

Record: SUSE-SU-2025:01919-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1177-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775).
CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
CVE-2025-21763:…

Record: SUSE-SU-2025:1177-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1178-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

Record: SUSE-SU-2025:1178-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1180-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

Record: SUSE-SU-2025:1180-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20190-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20190-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20192-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20192-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20260-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20260-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20270-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20270-1
Updated: 2026-11-02

OSVUSN-7510-1 No score

linux, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15 vulnerabilities