rpm package
suse/kernel-default&distro=SUSE Linux Enterprise Module for Legacy 15 SP6
pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP6
Vulnerabilities (3,752)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-40207 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. I | ||
| CVE-2025-40206 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit | ||
| CVE-2025-40205 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only retu | ||
| CVE-2025-40204 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. | ||
| CVE-2025-40200 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system retur | ||
| CVE-2025-40198 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount | ||
| CVE-2025-40194 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() | ||
| CVE-2025-40188 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kern | ||
| CVE-2025-40186 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), | ||
| CVE-2025-40183 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in orde | ||
| CVE-2025-40180 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed a | ||
| CVE-2025-40176 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate th | ||
| CVE-2025-40173 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: i | ||
| CVE-2025-40172 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host re | ||
| CVE-2025-40171 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code | ||
| CVE-2025-40169 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. | ||
| CVE-2025-40168 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk | ||
| CVE-2025-40159 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frame | ||
| CVE-2025-40157 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in dr | ||
| CVE-2025-40156 | — | < 6.4.0-150600.23.81.3 | 6.4.0-150600.23.81.3 | Nov 12, 2025 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL() |
- CVE-2025-40207Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. I
- CVE-2025-40206Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit
- CVE-2025-40205Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only retu
- CVE-2025-40204Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
- CVE-2025-40200Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system retur
- CVE-2025-40198Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount
- CVE-2025-40194Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request()
- CVE-2025-40188Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu exception then kern
- CVE-2025-40186Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(),
- CVE-2025-40183Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in orde
- CVE-2025-40180Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed a
- CVE-2025-40176Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate th
- CVE-2025-40173Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: i
- CVE-2025-40172Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host re
- CVE-2025-40171Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code
- CVE-2025-40169Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer.
- CVE-2025-40168Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk
- CVE-2025-40159Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frame
- CVE-2025-40157Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in dr
- CVE-2025-40156Nov 12, 2025affected < 6.4.0-150600.23.81.3fixed 6.4.0-150600.23.81.3
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL()
Page 1 of 188