CVE-2025-21684

gpio: xilinx: Convert gpio_lock to raw spinlock

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

[ 5.349336] ============================= [ 5.353349] [ BUG: Invalid wait context ] [ 5.357361] 6.13.0-rc5+ #69 Tainted: G W [ 5.363031] ----------------------------- [ 5.367045] kworker/u17:1/44 is trying to lock: [ 5.371587] ffffff88018b02c0 (&chip->gpio_lock){....}-{3:3}, at: xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) [ 5.380079] other info that might help us debug this: [ 5.385138] context-{5:5} [ 5.387762] 5 locks held by kworker/u17:1/44: [ 5.392123] #0: ffffff8800014958 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3204) [ 5.402260] #1: ffffffc082fcbdd8 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3205) [ 5.411528] #2: ffffff880172c900 (&dev->mutex){....}-{4:4}, at: __device_attach (drivers/base/dd.c:1006) [ 5.419929] #3: ffffff88039c8268 (request_class#2){+.+.}-{4:4}, at: __setup_irq (kernel/irq/internals.h:156 kernel/irq/manage.c:1596) [ 5.428331] #4: ffffff88039c80c8 (lock_class#2){....}-{2:2}, at: __setup_irq (kernel/irq/manage.c:1614) [ 5.436472] stack backtrace: [ 5.439359] CPU: 2 UID: 0 PID: 44 Comm: kworker/u17:1 Tainted: G W 6.13.0-rc5+ #69 [ 5.448690] Tainted: [W]=WARN [ 5.451656] Hardware name: xlnx,zynqmp (DT) [ 5.455845] Workqueue: events_unbound deferred_probe_work_func [ 5.461699] Call trace: [ 5.464147] show_stack+0x18/0x24 C [ 5.467821] dump_stack_lvl (lib/dump_stack.c:123) [ 5.471501] dump_stack (lib/dump_stack.c:130) [ 5.474824] __lock_acquire (kernel/locking/lockdep.c:4828 kernel/locking/lockdep.c:4898 kernel/locking/lockdep.c:5176) [ 5.478758] lock_acquire (arch/arm64/include/asm/percpu.h:40 kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851 kernel/locking/lockdep.c:5814) [ 5.482429] _raw_spin_lock_irqsave (include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 5.486797] xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) [ 5.490737] irq_enable (kernel/irq/internals.h:236 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) [ 5.494060] __irq_startup (kernel/irq/internals.h:241 kernel/irq/chip.c:180 kernel/irq/chip.c:250) [ 5.497645] irq_startup (kernel/irq/chip.c:270) [ 5.501143] __setup_irq (kernel/irq/manage.c:1807) [ 5.504728] request_threaded_irq (kernel/irq/manage.c:2208)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Feb 10, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: CVE-2025-21684
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-667
Updated: 2026-11-02

CVE List No score

gpio: xilinx: Convert gpio_lock to raw spinlock

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: CVE-2025-21684
Updated: 2026-11-02

EUVDEUVD-2025-2633 No score

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: EUVD-2025-2633
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m4w5-f9xf-8fgr 5.5

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert...

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: GHSA-m4w5-f9xf-8fgr
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-667
Updated: 2026-11-02

OSVAZL-56546 5.5

CVE-2025-21684 affecting package kernel for versions less than 5.15.179.1-1

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: AZL-56546
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-56550 5.5

CVE-2025-21684 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: AZL-56550
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 38 moreShow less

OSVBELL-CVE-2025-21684 5.5

Record: BELL-CVE-2025-21684
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-21684 5.5

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert gpio_lock to raw spinlock irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking. This fixes the following lockdep splat: [ 5.349336] ============================= [ 5.353349] [ BUG: Invalid wait context ] [ 5.357361] 6.13.0-rc5+ #69 Tainted: G W [ 5.363031] ----------------------------- [ 5.367045] kworker/u17:1/44 is trying to lock: [ 5.371587] ffffff88018b02c0 (&chip->gpio_lock){....}-{3:3}, at: xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) [ 5.380079] other info that might help us debug this: [ 5.385138] context-{5:5} [ 5.387762] 5 locks held by kworker/u17:1/44: [ 5.392123] #0: ffffff8800014958 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3204) [ 5.402260] #1: ffffffc082fcbdd8 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3205) [ 5.411528] #2: ffffff880172c900 (&dev->mutex){....}-{4:4}, at: __device_attach (drivers/base/dd.c:1006) [ 5.419929] #3: ffffff88039c8268 (request_class#2){+.+.}-{4:4}, at: __setup_irq (kernel/irq/internals.h:156 kernel/irq/manage.c:1596) [ 5.428331] #4: ffffff88039c80c8 (lock_class#2){....}-{2:2}, at: __setup_irq (kernel/irq/manage.c:1614) [ 5.436472] stack backtrace: [ 5.439359] CPU: 2 UID: 0 PID: 44 Comm: kworker/u17:1 Tainted: G W 6.13.0-rc5+ #69 [ 5.448690] Tainted: [W]=WARN [ 5.451656] Hardware name: xlnx,zynqmp (DT) [ 5.455845] Workqueue: events_unbound deferred_probe_work_func [ 5.461699] Call trace: [ 5.464147] show_stack+0x18/0x24 C [ 5.467821] dump_stack_lvl (lib/dump_stack.c:123) [ 5.471501] dump_stack (lib/dump_stack.c:130) [ 5.474824] __lock_acquire (kernel/locking/lockdep.c:4828 kernel/locking/lockdep.c:4898 kernel/locking/lockdep.c:5176) [ 5.478758] lock_acquire (arch/arm64/include/asm/percpu.h:40 kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851 kernel/locking/lockdep.c:5814) [ 5.482429] _raw_spin_lock_irqsave (include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 5.486797] xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8)) [ 5.490737] irq_enable (kernel/irq/internals.h:236 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) [ 5.494060] __irq_startup (kernel/irq/internals.h:241 kernel/irq/chip.c:180 kernel/irq/chip.c:250) [ 5.497645] irq_startup (kernel/irq/chip.c:270) [ 5.501143] __setup_irq (kernel/irq/manage.c:1807) [ 5.504728] request_threaded_irq (kernel/irq/manage.c:2208)

Record: DEBIAN-CVE-2025-21684
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-1110 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock

A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3c_device_info() to avoid acquiring the lock twice.

v2:

Modified the title and commit message

============================================ WARNING: possible recursive locking detected 6.11.0-mainline

init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock

but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register

other info that might help us debug this: Possible unsafe locking scenario:

   CPU0
   ----

lock(&i3cbus->lock); lock(&i3cbus->lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register

stack backtrace: CPU: 6 UID: 0 PID: 1 Comm: init Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc0 dump_stack+0x18/0x24 print_deadlock_bug+0x388/0x390 __lock_acquire+0x18bc/0x32ec lock_acquire+0x134/0x2b0 down_read+0x50/0x19c i3c_bus_normaluse_lock+0x14/0x24 i3c_device_get_info+0x24/0x58 i3c_device_uevent+0x34/0xa4 dev_uevent+0x310/0x384 kobject_uevent_env+0x244/0x414 kobject_uevent+0x14/0x20 device_add+0x278/0x460 device_register+0x20/0x34 i3c_master_register_new_i3c_devs+0x78/0x154 i3c_master_register+0x6a0/0x6d4 mtk_i3c_master_probe+0x3b8/0x4d8 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa0/0x15c driver_probe_device+0x3c/0x1ac __driver_attach+0xc4/0x1f0 bus_for_each_dev+0x104/0x160 driver_attach+0x24/0x34 bus_add_driver+0x14c/0x294 driver_register+0x68/0x104 __platform_driver_register+0x20/0x30 init_module+0x20/0xfe4 do_one_initcall+0x184/0x464 do_init_module+0x58/0x1ec load_module+0xefc/0x10c8 __arm64_sys_finit_module+0x238/0x33c invoke_syscall+0x58/0x10c el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x50/0xac el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac(CVE-2024-43098)

In the Linux kernel, the following vulnerability has been resolved:

MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed

This avoids warning:

[ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283

Caused by get_c0_compare_int on secondary CPU.

We also skipped saving IRQ number to struct clock_event_device *cd as it's never used by clockevent core, as per comments it's only meant for "non CPU local devices".(CVE-2024-46832)

In the Linux kernel, the following vulnerability has been resolved:

pinmux: Use sequential access to access desc->pinmux data

When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner.

Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer.

Serialize the access to mux related setting with a mutex lock.

cpu0 (process A)			cpu1(process B)

pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) {

     if…

Record: OESA-2025-1110
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1111 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock

A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3c_device_info() to avoid acquiring the lock twice.

v2:

Modified the title and commit message

============================================ WARNING: possible recursive locking detected 6.11.0-mainline

init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock

but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register

other info that might help us debug this: Possible unsafe locking scenario:

   CPU0
   ----

lock(&i3cbus->lock); lock(&i3cbus->lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register

In the Linux kernel, the following vulnerability has been resolved:

pinmux: Use sequential access to access desc->pinmux data

When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner.

Serialize the access to mux related setting with a mutex lock.

cpu0 (process A)			cpu1(process B)

pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) {

     if (desc-&gt;mux_usecount &gt; 1)
           return 0;
     desc-&gt;mux_owner = owner;

} }(CVE-2024-47141)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: check smcd_v2_ext_offset when receiving proposal msg

When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may…

Record: OESA-2025-1111
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-21684 5.5

Record: UBUNTU-CVE-2025-21684
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

gpio: xilinx: Convert gpio_lock to raw spinlock

In the Linux kernel, the following vulnerability has been resolved:

gpio: xilinx: Convert gpio_lock to raw spinlock

irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking.

This fixes the following lockdep splat:

Record: CVE-2025-21684
Updated: 2026-11-02

OSVSUSE-SU-2025:0784-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26708: mptcp: fastopen and PM-trigger subflow shutdown can race (bsc#1222672).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50185: mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).

The following non-security bugs were fixed:

ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V (stable-fixes).
ALSA: hda/cirrus: Correct the full scale volume set logic (git-fixes).
ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED (stable-fixes).
ALSA: hda/realtek: Fixup ALC225 depop procedure (git-fixes).
ALSA: hda: Add error check for snd_ctl_rename_id() in snd_hda_create_dig_out_ctls() (git-fixes).
ALSA: seq: Drop UMP events when no UMP-conversion is set (git-fixes).
APEI: GHES: Have GHES honor the panic= setting (stable-fixes).
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V (stable-fixes).
ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close (git-fixes).
ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (git-fixes).
ASoC: amd: Add ACPI dependency to fix build error (stable-fixes).
ASoC: fsl_micfil: Enable default case in micfil_set_quality() (git-fixes).
ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB] (git-fixes).
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (stable-fixes).
HID: Wacom: Add PCI Wacom device support (stable-fixes).
HID: hid-steam: Add Deck IMU support (stable-fixes).
HID: hid-steam: Add gamepad-only mode switched to by holding options (stable-fixes).
HID: hid-steam: Avoid overwriting smoothing parameter (stable-fixes).
HID: hid-steam: Clean up locking (stable-fixes).
HID: hid-steam: Disable watchdog instead of using a heartbeat (stable-fixes).
HID: hid-steam: Do not use cancel_delayed_work_sync in IRQ context (git-fixes).
HID: hid-steam: Fix cleanup in probe() (git-fixes).
HID: hid-steam: Make sure rumble work is canceled on removal (stable-fixes).
HID: hid-steam: Move hidraw input (un)registering to work (git-fixes).
HID: hid-steam: Update list of identifiers from SDL (stable-fixes).
HID: hid-steam: remove pointless error message (stable-fixes).
HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()…

Record: SUSE-SU-2025:0784-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0847-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
CVE-2024-57882: mptcp: fix TCP options overflow. (bsc#1235914).
CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
CVE-2025-21666: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] (bsc#1236680).
CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
CVE-2025-21669: vsock/virtio: discard packets if the transport changes (bsc#1236683).
CVE-2025-21670: vsock/bpf: return early if transport is not assigned (bsc#1236685).
CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
CVE-2025-21675: net/mlx5: Clear port select structure when fail to create (bsc#1236694).
CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
CVE-2025-21700: net: sched:…

Record: SUSE-SU-2025:0847-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0856-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-56568: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877). -…

Record: SUSE-SU-2025:0856-1
Updated: 2026-11-02

OSVSUSE-SU-2025:0955-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56720: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592).
CVE-2024-57994: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901).
CVE-2025-21636: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113).
CVE-2025-21637: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114).
CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115).
CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122).
CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123).
CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133).
CVE-2025-21665: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684).
CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits (bsc#1236681).
CVE-2025-21668: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682).
CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689).
CVE-2025-21680: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700).
CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702).
CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls (bsc#1237045).
CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing (bsc#1237028).
CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
CVE-2025-21705: mptcp: handle fastopen disconnect correctly (bsc#1238525).
CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889).
CVE-2025-21716: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891).
CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860).
CVE-2025-21724: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863).
CVE-2025-21725: smb: client: fix oops due to unset link speed (bsc#1238877).
CVE-2025-21728: bpf: Send signals asynchronously if !preemptible (bsc#1237879).
CVE-2025-21767: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic…

Record: SUSE-SU-2025:0955-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20190-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20190-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20192-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20192-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20260-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20260-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20270-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20270-1
Updated: 2026-11-02

OSVUSN-7445-1 No score

linux, linux-aws, linux-gcp, linux-hwe-6.11, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oem-6.11, linux-oracle, linux-raspi, linux-realtime vulnerabilities