CVE-2025-22016

dpll: fix xa_alloc_cyclic() error handling

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Apr 8, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: CVE-2025-22016
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

CVE List No score

dpll: fix xa_alloc_cyclic() error handling

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: CVE-2025-22016
Updated: 2026-11-05

EUVDEUVD-2025-10341 No score

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: EUVD-2025-10341
Updated: 2026-11-05

GitHub AdvisoriesGHSA-89vx-7m9v-cf88 5.5

In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic()...

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: GHSA-89vx-7m9v-cf88
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2025-22016 5.5

Record: BELL-CVE-2025-22016
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-22016 5.5

In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin). Fix it by checking if err is lower than zero. This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: DEBIAN-CVE-2025-22016
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 32 moreShow less

OSVROOT-OS-UBUNTU-2404-CVE-2025-22016 5.5

CVE-2025-22016 in linux - Patched by Root

Root has patched CVE-2025-22016 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-22016
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-22016 5.5

Record: UBUNTU-CVE-2025-22016
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1786352940 No score

kernel: Fix of 148 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
ubi: Fix use-after-free when volume resizing failed {CVE-2023-53271}
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() {CVE-2025-37912}
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() {CVE-2026-53318}
dpll: Prevent duplicate registrations {CVE-2026-23129}
pinmux: fix race causing mux_owner NULL with active mux_usecount {CVE-2025-38632}
HID: apple: validate feature-report field count to prevent NULL pointer dereference {CVE-2025-38557}
thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782}
ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
drm/xe/reg_sr: Fix leak on xa_store failure {CVE-2026-23418}
ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
md/raid10: wait barrier before returning discard request with REQ_NOWAIT {CVE-2025-40325}
nbd: defer config put in recv_work {CVE-2025-68372}
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference {CVE-2026-23148}
net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
net/mlx5e: Disable MACsec offload for uplink representor profile {CVE-2025-38020}
serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
dm-thin: fix metadata refcount underflow {CVE-2026-46107}
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
usbnet:fix NPE during rx_complete {CVE-2025-22050}
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it {CVE-2025-21645}
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() {CVE-2025-21810}
usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
ALSA: seq: dummy: fix UMP event stack overread {CVE-2026-53241}
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled {CVE-2026-31655}
net/mlx5: Bridge, fix the crash caused by LAG state check {CVE-2025-21970}
ALSA: timer: Don't take register_mutex with copy_from/to_user() {CVE-2025-23134}
md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op {CVE-2025-40171}
iommu: Fix potential memory leak in iopf_queue_remove_device() {CVE-2025-21770}
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
nvme-tcp: fix the memleak while create new ctrl failed {CVE-2024-56632}
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146}
pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains {CVE-2026-23187}
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path {CVE-2025-22128}
octeon_ep: Fix memory leak in octep_device_setup() {CVE-2026-23160}
pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
net: tun: fix tun_napi_alloc_frags() {CVE-2024-56372}
wifi: iwlwifi: mvm: clean up ROC on failure {CVE-2025-21906}
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
dpll: fix xa_alloc_cyclic() error handling {CVE-2025-22016}
usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
RDMA/siw: Fix potential NULL pointer dereference in header processing…

Record: CLSA-2026-1786352940
Updated: 2026-11-02

OSV No score

dpll: fix xa_alloc_cyclic() error handling

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.

Record: CVE-2025-22016
Updated: 2026-11-07

OSVSUSE-SU-2025:01614-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720). -…

Record: SUSE-SU-2025:01614-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01707-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-27415: netfilter: bridge: confirm multicast packets before passing them up the stack (bsc#1224757).
CVE-2024-28956: Intel CPU: Indirect Target Selection (ITS) (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-46763: fou: Fix null-ptr-deref in GRO (bsc#1230764).
CVE-2024-50038: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (bsc#1231910).
CVE-2024-50162: bpf: devmap: provide rxq after redirect (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: sockmap, vsock: For connectible sockets allow only connected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).…

Record: SUSE-SU-2025:01707-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

Record: SUSE-SU-2025:01919-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01951-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

Record: SUSE-SU-2025:01951-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01964-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
CVE-2025-21894: net: enetc: VFs do not…

Record: SUSE-SU-2025:01964-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01967-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

Record: SUSE-SU-2025:01967-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20343-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW…

Record: SUSE-SU-2025:20343-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20344-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during…

Record: SUSE-SU-2025:20344-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20354-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW…

Record: SUSE-SU-2025:20354-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20355-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
CVE-2025-22029: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378).
CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during…

Record: SUSE-SU-2025:20355-1
Updated: 2026-11-02

OSVUSN-7605-1 No score

linux, linux-aws, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oracle, linux-raspi, linux-realtime vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)