CVE-2022-50073

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Fixes a NULL pointer derefence bug triggered from tap driver. When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null (in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb) virtio_net_hdr_to_skb calls dev_parse_header_protocol which needs skb->dev field to be valid.

The line that trigers the bug is in dev_parse_header_protocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->header_ops || !dev->header_ops->parse_protocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax

Setting skb->dev before the call in tap.c fixes the issue.

BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tap_get_user+0x3f1/0x540 [tap] tap_sendmsg+0x56/0x362 [tap] ? get_tx_bufs+0xc2/0x1e0 [vhost_net] handle_tx_copy+0x114/0x670 [vhost_net] handle_tx+0xb0/0xe0 [vhost_net] handle_tx_kick+0x15/0x20 [vhost_net] vhost_worker+0x7b/0xc0 [vhost] ? vhost_vring_call_reset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Jun 18, 2025

What each source reports

NVD Score used5.5

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: CVE-2022-50073
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

CVE ListNo score

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: CVE-2022-50073
Updated: 2026-11-05

EUVDEUVD-2022-55342No score

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: EUVD-2022-55342
Updated: 2026-11-05

GitHub AdvisoriesGHSA-j9xf-8j9q-6cvr5.5

In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer...

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: GHSA-j9xf-8j9q-6cvr
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-500735.5

In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Fixes a NULL pointer derefence bug triggered from tap driver. When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null (in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb) virtio_net_hdr_to_skb calls dev_parse_header_protocol which needs skb->dev field to be valid. The line that trigers the bug is in dev_parse_header_protocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->header_ops || !dev->header_ops->parse_protocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax Setting skb->dev before the call in tap.c fixes the issue. BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tap_get_user+0x3f1/0x540 [tap] tap_sendmsg+0x56/0x362 [tap] ? get_tx_bufs+0xc2/0x1e0 [vhost_net] handle_tx_copy+0x114/0x670 [vhost_net] handle_tx+0xb0/0xe0 [vhost_net] handle_tx_kick+0x15/0x20 [vhost_net] vhost_worker+0x7b/0xc0 [vhost] ? vhost_vring_call_reset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30

Record: DEBIAN-CVE-2022-50073
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVRHSA-2021:43567.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2021:4356
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 26 moreShow less

OSVRHSA-2024:93157.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:9315
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2022-500735.5

CVE-2022-50073 in linux - Patched by Root

Root has patched CVE-2022-50073 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2022-50073
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2022-500735.5

CVE-2022-50073 in linux - Patched by Root

Root has patched CVE-2022-50073 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2022-50073
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2022-500738.2

Record: UBUNTU-CVE-2022-50073
CVSS 4.0: 8.2 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-70355No score

CVE-2022-50073 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: AZL-70355
Updated: 2026-11-02

OSVCLSA-2026-1787304608No score

kernel-uek: Fix of 34 CVEs

Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
Squashfs: check metadata block offset is within range {CVE-2026-23388}
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
mm:…

Record: CLSA-2026-1787304608
Updated: 2026-11-02

OSVNo score

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

In the Linux kernel, the following vulnerability has been resolved:

net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null

Setting skb->dev before the call in tap.c fixes the issue.

Record: CVE-2022-50073
Updated: 2026-11-07

OSVSUSE-SU-2025:02264-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
kernel-source: Do not use multiple -r in sed parameters
kernel-source: Remove log.sh from sources
mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431).
mm/hugetlb: unshare…

Record: SUSE-SU-2025:02264-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02321-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
Use gcc-13 for build on SLE16 (jsc#PED-10028).
add…

Record: SUSE-SU-2025:02321-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02322-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
Test the correct macro to detect RT kernel build Fixes: 470cd1a41502 ('kernel-binary: Support livepatch_rt with merged RT branch')
Use gcc-13 for build on SLE16 (jsc#PED-10028).
add nf_tables for iptables non-legacy network…

Record: SUSE-SU-2025:02322-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02334-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes (bsc#1242301).
CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (bsc#1242262).
CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883).
CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (bsc#1242423).
CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length (bsc#1242906).
CVE-2025-37836: PCI: Fix reference…

Record: SUSE-SU-2025:02334-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02537-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
Use gcc-13 for build on SLE16 (jsc#PED-10028).
add nf_tables for iptables non-legacy network handling This is needed for example by docker on the Alpine Linux distribution, but can also be used on openSUSE.
bs-upload-kernel: Pass…

Record: SUSE-SU-2025:02537-1
Updated: 2026-11-02

OSVSUSE-SU-2025:2264-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361 bsc#1226552).
CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (bsc#1235464).
CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).

The following non-security bugs were fixed:

ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
Fix reference in 'net_sched: sch_sfq: use a temporary work area for validating configuration' (bsc#1242504)
MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).
kernel-source: Do not use multiple -r in sed parameters
kernel-source: Remove log.sh from sources
mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431).
mm/hugetlb: unshare…

Record: SUSE-SU-2025:2264-1
Updated: 2026-11-02

OSVUSN-8575-1No score

linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-realtime, linux-xilinx-zynqmp vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)