CVE-2025-21825

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

During the update procedure, when overwrite element in a pre-allocated htab, the freeing of old_element is protected by the bucket lock. The reason why the bucket lock is necessary is that the old_element has already been stashed in htab->extra_elems after alloc_htab_elem() returns. If freeing the old_element after the bucket lock is unlocked, the stashed element may be reused by concurrent update procedure and the freeing of old_element will run concurrently with the reuse of the old_element. However, the invocation of check_and_free_fields() may acquire a spin-lock which violates the lockdep rule because its caller has already held a raw-spin-lock (bucket lock). The following warning will be reported when such race happens:

BUG: scheduling while atomic: test_progs/676/0x00000003 3 locks held by test_progs/676: #0: ffffffff864b0240 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x2c0/0x830 #1: ffff88810e961188 (&htab->lockdep_key){....}-{2:2}, at: htab_map_update_elem+0x306/0x1500 #2: ffff8881f4eac1b8 (&base->softirq_expiry_lock){....}-{2:2}, at: hrtimer_cancel_wait_running+0xe9/0x1b0 Modules linked in: bpf_testmod(O) Preemption disabled at: [<ffffffff817837a3>] htab_map_update_elem+0x293/0x1500 CPU: 0 UID: 0 PID: 676 Comm: test_progs Tainted: G ... 6.12.0+ #11 Tainted: [W]=WARN, [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)... Call Trace: <TASK> dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 __schedule_bug+0x120/0x170 __schedule+0x300c/0x4800 schedule_rtlock+0x37/0x60 rtlock_slowlock_locked+0x6d9/0x54c0 rt_spin_lock+0x168/0x230 hrtimer_cancel_wait_running+0xe9/0x1b0 hrtimer_cancel+0x24/0x30 bpf_timer_delete_work+0x1d/0x40 bpf_timer_cancel_and_free+0x5e/0x80 bpf_obj_free_fields+0x262/0x4a0 check_and_free_fields+0x1d0/0x280 htab_map_update_elem+0x7fc/0x1500 bpf_prog_9f90bc20768e0cb9_overwrite_cb+0x3f/0x43 bpf_prog_ea601c4649694dbd_overwrite_timer+0x5d/0x7e bpf_prog_test_run_syscall+0x322/0x830 __sys_bpf+0x135d/0x3ca0 __x64_sys_bpf+0x75/0xb0 x64_sys_call+0x1b5/0xa10 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... </TASK>

It seems feasible to break the reuse and refill of per-cpu extra_elems into two independent parts: reuse the per-cpu extra_elems with bucket lock being held and refill the old_element as per-cpu extra_elems after the bucket lock is unlocked. However, it will make the concurrent overwrite procedures on the same CPU return unexpected -E2BIG error when the map is full.

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

It is a bit hard to decide the right fix tag. One reason is that the problem depends on PREEMPT_RT which is enabled in v6.12. Considering the softirq_expiry_lock lock exists since v5.4 and bpf_timer is introduced in v5.15, the bpf_timer commit is used in the fixes tag and an extra depends-on tag is added to state the dependency on PREEMPT_RT.

Depends-on: v6.12+ with PREEMPT_RT enabled

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Mar 7, 2025

What each source reports

CVE List Score used 7.8

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: CVE-2025-21825
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-6220 7.8

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: EUVD-2025-6220
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v333-5589-2mh9 4.7

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running...

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: GHSA-v333-5589-2mh9
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: CVE-2025-21825
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSVBELL-CVE-2025-21825 4.7

Record: BELL-CVE-2025-21825
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.8

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: CVE-2025-21825
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 26 moreShow less

OSVDEBIAN-CVE-2025-21825 4.7

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the update procedure, when overwrite element in a pre-allocated htab, the freeing of old_element is protected by the bucket lock. The reason why the bucket lock is necessary is that the old_element has already been stashed in htab->extra_elems after alloc_htab_elem() returns. If freeing the old_element after the bucket lock is unlocked, the stashed element may be reused by concurrent update procedure and the freeing of old_element will run concurrently with the reuse of the old_element. However, the invocation of check_and_free_fields() may acquire a spin-lock which violates the lockdep rule because its caller has already held a raw-spin-lock (bucket lock). The following warning will be reported when such race happens: BUG: scheduling while atomic: test_progs/676/0x00000003 3 locks held by test_progs/676: #0: ffffffff864b0240 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x2c0/0x830 #1: ffff88810e961188 (&htab->lockdep_key){....}-{2:2}, at: htab_map_update_elem+0x306/0x1500 #2: ffff8881f4eac1b8 (&base->softirq_expiry_lock){....}-{2:2}, at: hrtimer_cancel_wait_running+0xe9/0x1b0 Modules linked in: bpf_testmod(O) Preemption disabled at: [<ffffffff817837a3>] htab_map_update_elem+0x293/0x1500 CPU: 0 UID: 0 PID: 676 Comm: test_progs Tainted: G ... 6.12.0+ #11 Tainted: [W]=WARN, [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)... Call Trace: <TASK> dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 __schedule_bug+0x120/0x170 __schedule+0x300c/0x4800 schedule_rtlock+0x37/0x60 rtlock_slowlock_locked+0x6d9/0x54c0 rt_spin_lock+0x168/0x230 hrtimer_cancel_wait_running+0xe9/0x1b0 hrtimer_cancel+0x24/0x30 bpf_timer_delete_work+0x1d/0x40 bpf_timer_cancel_and_free+0x5e/0x80 bpf_obj_free_fields+0x262/0x4a0 check_and_free_fields+0x1d0/0x280 htab_map_update_elem+0x7fc/0x1500 bpf_prog_9f90bc20768e0cb9_overwrite_cb+0x3f/0x43 bpf_prog_ea601c4649694dbd_overwrite_timer+0x5d/0x7e bpf_prog_test_run_syscall+0x322/0x830 __sys_bpf+0x135d/0x3ca0 __x64_sys_bpf+0x75/0xb0 x64_sys_call+0x1b5/0xa10 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... </TASK> It seems feasible to break the reuse and refill of per-cpu extra_elems into two independent parts: reuse the per-cpu extra_elems with bucket lock being held and refill the old_element as per-cpu extra_elems after the bucket lock is unlocked. However, it will make the concurrent overwrite procedures on the same CPU return unexpected -E2BIG error when the map is full. Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT: 1) use hrtimer_try_to_cancel() and check its return value 2) if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary. It is a bit hard to decide the right fix tag. One reason is that the problem depends on PREEMPT_RT which is enabled in v6.12. Considering the softirq_expiry_lock lock exists since v5.4 and bpf_timer is introduced in v5.15, the bpf_timer commit is used in the fixes tag and an extra depends-on tag is added to state the dependency on PREEMPT_RT. Depends-on: v6.12+ with PREEMPT_RT enabled

Record: DEBIAN-CVE-2025-21825
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-21825 4.7

CVE-2025-21825 in linux - Patched by Root

Root has patched CVE-2025-21825 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-21825
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-21825 4.7

CVE-2025-21825 in linux - Patched by Root

Root has patched CVE-2025-21825 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-21825
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2025-21825 4.7

CVE-2025-21825 in linux - Patched by Root

Root has patched CVE-2025-21825 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-21825
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-21825 5.6

Record: UBUNTU-CVE-2025-21825
CVSS 4.0: 5.6 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVAZL-62534 No score

CVE-2025-21825 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: AZL-62534
Updated: 2026-11-05

OSVAZL-69488 No score

CVE-2025-21825 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT:

use hrtimer_try_to_cancel() and check its return value
if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary.

Depends-on: v6.12+ with PREEMPT_RT enabled

Record: AZL-69488
Updated: 2026-11-02

OSVSUSE-SU-2025:01919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

Record: SUSE-SU-2025:01919-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1177-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775).
CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
CVE-2025-21763:…

Record: SUSE-SU-2025:1177-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1178-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

Record: SUSE-SU-2025:1178-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1180-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
CVE-2024-58012: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (bsc#1239104).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
CVE-2025-21733: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494).
CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
CVE-2025-21754: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496).
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738). -…

Record: SUSE-SU-2025:1180-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20190-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20190-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20192-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20192-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20260-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: kABI fix for l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435).
CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441).
CVE-2024-56702: bpf: Add tracepoints with null-able arguments (bsc#1235501).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…

Record: SUSE-SU-2025:20260-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20270-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free…

Record: SUSE-SU-2025:20270-1
Updated: 2026-11-02

OSVUSN-7521-1 No score

linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities