Every CVE Search/ Get API key

CVE-2024-5660

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C,...

9.8 CriticalFix available

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.55%Up 0.5 points since Dec 11, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
CVE-2024-5660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-668
Updated
2026-11-02
EUVDEUVD-2024-47147 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
EUVD-2024-47147
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-h32q-4pph-8pgm 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C,...

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection

Record
GHSA-h32q-4pph-8pgm
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-668
Updated
2026-11-02
NVD 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
CVE-2024-5660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-668
Updated
2026-11-02
OSVALPINE-CVE-2024-5660 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
ALPINE-CVE-2024-5660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-5660 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
DEBIAN-CVE-2024-5660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2024-5660 9.8

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
UBUNTU-CVE-2024-5660
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cortex-X1C, Cortex-X2, Cortex-X3, Cortex-X4, Cortex-X925, Neoverse V1, Neoverse V2, Neoverse V3, Neoverse V3AE, Neoverse N2 may permit bypass of Stage-2 translation and/or GPT protection.

Record
CVE-2024-5660
Updated
2026-11-02
OSVSUSE-SU-2025:0236-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2022-48742: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (bsc#1226694).
  • CVE-2022-49033: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (bsc#1232045).
  • CVE-2022-49035: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE (bsc#1215304).
  • CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).
  • CVE-2023-52922: can: bcm: Fix UAF in bcm_proc_show() (bsc#1233977).
  • CVE-2024-26976: KVM: Always flush async #PF workqueue when vCPU is being destroyed (bsc#1223635).
  • CVE-2024-35847: irqchip/gic-v3-its: Prevent double free on error (bsc#1224697).
  • CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
  • CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
  • CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
  • CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
  • CVE-2024-47141: pinmux: Use sequential access to access desc->pinmux data (bsc#1235708).
  • CVE-2024-47666: scsi: pm80xx: Set phy->enable_completion only when we wait for it (bsc#1231453).
  • CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
  • CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
  • CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
  • CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
  • CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
  • CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices (bsc#1233050).
  • CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
  • CVE-2024-50211: udf: refactor inode_bmap() to handle error (bsc#1233096).
  • CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
  • CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
  • CVE-2024-50287: media: v4l2-tpg: prevent the risk of a division by zero (bsc#1233476).
  • CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
  • CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
  • CVE-2024-53101: fs: Fix uninitialized value issue in from_kuid and from_kgid (bsc#1233769).
  • CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
  • CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234853).
  • CVE-2024-53150: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (bsc#1234834).
  • CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234846).
  • CVE-2024-53157: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware (bsc#1234827).
  • CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).
  • CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234891).
  • CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).
  • CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).
  • CVE-2024-53210: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (bsc#1234971).
  • CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).
  • CVE-2024-53224: RDMA/mlx5: Cancel pkey work before destroying device resources (bsc#1235009).
  • CVE-2024-53239: ALSA: 6fire: Release resources at card release (bsc#1235054).
  • CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).
  • CVE-2024-56531: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection (bsc#1235057).
  • CVE-2024-56548: hfsplus: do not query the device logical block size multiple times (bsc#1235073). -…
Record
SUSE-SU-2025:0236-1
Updated
2026-11-02
OSVSUSE-SU-2025:0289-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
  • CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events (bsc#1220355).
  • CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
  • CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
  • CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
  • CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
  • CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
  • CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
  • CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
  • CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
  • CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
  • CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
  • CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
  • CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
  • CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
  • CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
  • CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
  • CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
  • CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
  • CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
  • CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
  • CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
  • CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
  • CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
  • CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
  • CVE-2024-50252: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (bsc#1233201).
  • CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
  • CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
  • CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
  • CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
  • CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
  • CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
  • CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
  • CVE-2024-53043: mctp i2c: handle NULL header address (bsc#1233523).
  • CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
  • CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
  • CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
  • CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
  • CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
  • CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
  • CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
  • CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
  • CVE-2024-53105: mm: page_alloc: move mlocked flag…
Record
SUSE-SU-2025:0289-1
Updated
2026-11-02
OSVSUSE-SU-2025:0557-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
  • CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
  • CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
  • CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
  • CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
  • CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
  • CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
  • CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
  • CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
  • CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
  • CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
  • CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
  • CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
  • CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
  • CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
  • CVE-2024-53170: block: fix uaf for flush rq while iterating tags (bsc#1234888).
  • CVE-2024-53172: ubi: fastmap: Fix duplicate slab cache names while attaching (bsc#1234898).
  • CVE-2024-53175: ipc: fix memleak if msg_init_ns failed in create_ipc_ns (bsc#1234893).
  • CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey() (bsc#1234901).
  • CVE-2024-53187: io_uring: check for overflows in io_pin_pages (bsc#1234947).
  • CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use (bsc#1234957).
  • CVE-2024-53196: KVM: arm64: Do not retire aborted MMIO instruction (bsc#1234906).
  • CVE-2024-53198: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() (bsc#1234923).
  • CVE-2024-53203: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001).
  • CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit() (bsc#1235011).
  • CVE-2024-53232: iommu/s390: Implement blocking domain (bsc#1235050).
  • CVE-2024-53236: xsk: Free skb when TX metadata options are invalid (bsc#1235000).
  • CVE-2024-53685: ceph: give up on paths longer than PATH_MAX (bsc#1235720).
  • CVE-2024-55639: net: renesas: rswitch: avoid use-after-put for a device tree node (bsc#1235737).
  • CVE-2024-55881: KVM: x86: Play nice with protected guests in complete_hypercall_exit() (bsc#1235745).
  • CVE-2024-56372: net: tun: fix tun_napi_alloc_frags() (bsc#1235753).
  • CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
  • CVE-2024-56569: ftrace: Fix regression with module command in stack_trace_filter (bsc#1235031).
  • CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).
  • CVE-2024-56588: scsi: hisi_sas: Create all dump files during debugfs initialization (bsc#1235123).
  • CVE-2024-56589: scsi: hisi_sas: Add cond_resched() for no forced preemption model (bsc#1235241).
  • CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
  • CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217).
  • CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230).
  • CVE-2024-56602: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (bsc#1235521).
  • CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create() (bsc#1235415).
  • CVE-2024-56608: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487).
  • CVE-2024-56610: kcsan: Turn…
Record
SUSE-SU-2025:0557-1
Updated
2026-11-02
OSVSUSE-SU-2025:20166-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
  • CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
  • CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
  • CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
  • CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
  • CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
  • CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
  • CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
  • CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
  • CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
  • CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
  • CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
  • CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
  • CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
  • CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
  • CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
  • CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
  • CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
  • CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
  • CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
  • CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
  • CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
  • CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
  • CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
  • CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
  • CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
  • CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
  • CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
  • CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
  • CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
  • CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
  • CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
  • CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
  • CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
  • CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
  • CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
  • CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
  • CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
  • CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
  • CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
  • CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
  • CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
  • CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
  • CVE-2024-53161:…
Record
SUSE-SU-2025:20166-1
Updated
2026-11-02
OSVSUSE-SU-2025:20249-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
  • CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095).
  • CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
  • CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
  • CVE-2024-44934: net: bridge: mcast: wait for previous gc cycles when removing port (bsc#1229809).
  • CVE-2024-44996: vsock: fix recursive ->recvmsg calls (bsc#1230205).
  • CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (bsc#1235705).
  • CVE-2024-47678: icmp: change the order of rate limits (bsc#1231854).
  • CVE-2024-48881: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (bsc#1235727).
  • CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161).
  • CVE-2024-49951: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (bsc#1232158).
  • CVE-2024-49978: gso: fix udp gso fraglist segmentation after pull from frag_list (bsc#1232101).
  • CVE-2024-49998: net: dsa: improve shutdown sequence (bsc#1232087).
  • CVE-2024-50018: net: napi: Prevent overflow of napi_defer_hard_irqs (bsc#1232419).
  • CVE-2024-50039: kABI: Restore deleted EXPORT_SYMBOL(__qdisc_calculate_pkt_len) (bsc#1231909).
  • CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad (bsc#1233038).
  • CVE-2024-50151: smb: client: fix OOBs when building SMB2_IOCTL request (bsc#1233055).
  • CVE-2024-50199: mm/swapfile: skip HugeTLB pages for unuse_vma (bsc#1233112).
  • CVE-2024-50202: nilfs2: propagate directory read errors from nilfs_find_entry() (bsc#1233324).
  • CVE-2024-50256: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (bsc#1233200).
  • CVE-2024-50262: bpf: Fix out-of-bounds write in trie_get_next_key() (bsc#1233239).
  • CVE-2024-50278, CVE-2024-50280: dm cache: fix flushing uninitialized delayed_work on cache_ctr error (bsc#1233467 bsc#1233469).
  • CVE-2024-50278: dm cache: fix potential out-of-bounds access on the first resume (bsc#1233467).
  • CVE-2024-50299: sctp: properly validate chunk size in sctp_sf_ootb() (bsc#1233488).
  • CVE-2024-53050: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (bsc#1233546).
  • CVE-2024-53064: idpf: fix idpf_vc_core_init error path (bsc#1233558 bsc#1234464).
  • CVE-2024-53090: afs: Fix lock recursion (bsc#1233637).
  • CVE-2024-53091: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (bsc#1233638).
  • CVE-2024-53099: bpf: Check validity of link->type in bpf_link_show_fdinfo() (bsc#1233772).
  • CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (bsc#1234069).
  • CVE-2024-53111: mm/mremap: fix address wraparound in move_page_tables() (bsc#1234086).
  • CVE-2024-53113: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (bsc#1234077).
  • CVE-2024-53117: virtio/vsock: Improve MSG_ZEROCOPY error handling (bsc#1234079).
  • CVE-2024-53118: vsock: Fix sk_error_queue memory leak (bsc#1234071).
  • CVE-2024-53119: virtio/vsock: Fix accept_queue memory leak (bsc#1234073).
  • CVE-2024-53122: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (bsc#1234076).
  • CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
  • CVE-2024-53130: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (bsc#1234219).
  • CVE-2024-53131: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (bsc#1234220).
  • CVE-2024-53133: drm/amd/display: Handle dml allocation failure to avoid crash (bsc#1234221)
  • CVE-2024-53134: pmdomain: imx93-blk-ctrl: correct remove path (bsc#1234159).
  • CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
  • CVE-2024-53160: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (bsc#1234810).
  • CVE-2024-53161:…
Record
SUSE-SU-2025:20249-1
Updated
2026-11-02

Affected products

Show 20 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
arm-trusted-firmware
Alpine:v3.18
 before 2.8.32-r0
2.8.32-r0
arm-trusted-firmware
Alpine:v3.19
 before 2.8.32-r0
2.8.32-r0
arm-trusted-firmware
Alpine:v3.20
 before 2.8.32-r0
2.8.32-r0
arm-trusted-firmware
Alpine:v3.21
 before 2.8.32-r0
2.8.32-r0
arm-trusted-firmware
Debian:12
 All versions, plus listed versions
2.10.0+dfsg-12.10.10+dfsg-12.12.0+dfsg-12.12.0+dfsg-22.12.1+dfsg-1
Show 5 moreShow less
2.12.16+dfsg-12.8.0+dfsg-12.9.0+dfsg-12.9.0+dfsg-22.9.0+dfsg-3
 None known
arm-trusted-firmware
Debian:13
 before 2.12.1+dfsg-1
2.12.1+dfsg-1
arm-trusted-firmware
Debian:14
 before 2.12.1+dfsg-1
2.12.1+dfsg-1
kernel-default
SUSE:Linux Enterprise Live Patching 12 SP5
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kgraft-patch-SLE12-SP5_Update_64
SUSE:Linux Enterprise Live Patching 12 SP5
From an advisory covering 77 CVEs
 before 1-8.5.1
1-8.5.1
kernel-default
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
Show 30 moreShow less
Affected packages
PackageAffectedFixed
kernel-source
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kernel-syms
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kernel-default
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kernel-source
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kernel-syms
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 77 CVEs
 before 4.12.14-122.244.1
4.12.14-122.244.1
kernel-coco
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6
From an advisory covering 343 CVEs
 before 6.4.0-15061.12.coco15sp6.1
6.4.0-15061.12.coco15sp6.1
kernel-coco_debug
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6
From an advisory covering 343 CVEs
 before 6.4.0-15061.12.coco15sp6.1
6.4.0-15061.12.coco15sp6.1
kernel-source-coco
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6
From an advisory covering 343 CVEs
 before 6.4.0-15061.12.coco15sp6.1
6.4.0-15061.12.coco15sp6.1
kernel-syms-coco
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6
From an advisory covering 343 CVEs
 before 6.4.0-15061.12.coco15sp6.1
6.4.0-15061.12.coco15sp6.1
kernel-livepatch-SLE15-SP6-RT_Update_8
SUSE:Linux Enterprise Live Patching 15 SP6
From an advisory covering 256 CVEs
 before 1-150600.1.3.1
1-150600.1.3.1
kernel-rt
SUSE:Real Time Module 15 SP6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-rt_debug
SUSE:Real Time Module 15 SP6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-source-rt
SUSE:Real Time Module 15 SP6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-syms-rt
SUSE:Real Time Module 15 SP6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-rt
openSUSE:Leap 15.6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-rt_debug
openSUSE:Leap 15.6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-source-rt
openSUSE:Leap 15.6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-syms-rt
openSUSE:Leap 15.6
From an advisory covering 256 CVEs
 before 6.4.0-150600.10.26.1
6.4.0-150600.10.26.1
kernel-livepatch-MICRO-6-0-RT_Update_5
SUSE:Linux Micro 6.0
From an advisory covering 610 CVEs
 before 1-1.1
1-1.1
kernel-rt
SUSE:Linux Micro 6.0
From an advisory covering 610 CVEs
 before 6.4.0-25.1
6.4.0-25.1
kernel-source-rt
SUSE:Linux Micro 6.0
From an advisory covering 610 CVEs
 before 6.4.0-25.1
6.4.0-25.1
kernel-livepatch-MICRO-6-0-RT_Update_5
SUSE:Linux Micro 6.1
From an advisory covering 610 CVEs
 before 1-1.1
1-1.1
kernel-rt
SUSE:Linux Micro 6.1
From an advisory covering 610 CVEs
 before 6.4.0-25.1
6.4.0-25.1
kernel-source-rt
SUSE:Linux Micro 6.1
From an advisory covering 610 CVEs
 before 6.4.0-25.1
6.4.0-25.1
arm-trusted-firmware
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1-32.2-2
 None known
arm-trusted-firmware
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.5+dfsg-12.6+dfsg-1
 None known
arm-trusted-firmware
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.9.0+dfsg-32.10.0+dfsg-12.10.0+dfsg-1build12.10.0+dfsg-1build2
 None known
arm-trusted-firmware
Ubuntu:25.10
 All versions, plus listed versions
2.10.0+dfsg-1build2
 None known
arm-trusted-firmware
Ubuntu:26.10
 All versions, plus listed versions
2.12.1+dfsg-12.12.1+dfsg-1ubuntu1
 None known
arm-trusted-firmware
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.10.0+dfsg-1build22.12.1+dfsg-1
 None known

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-5660 is a critical vulnerability (CVSS 9.8) in Arm Cortex-a710, published December 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in arm-trusted-firmware 2.8.32-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,274 references and the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open