suse/kernel-livepatch-SLE15-SP6_Update_18&distro=SUSE Linux Enterprise Live Patching 15 SP6

Vulnerabilities (77)

• CVE-2025-40186Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(),

• CVE-2025-40183Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in orde

• CVE-2025-40180Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed a

• CVE-2025-40176Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate th

• CVE-2025-40173Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: i

• CVE-2025-40172Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host re

• CVE-2025-40171Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code

• CVE-2025-40169Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer.

• CVE-2025-40168Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk

• CVE-2025-40159Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frame

• CVE-2025-40157Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in dr

• CVE-2025-40156Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL()

• CVE-2025-40154Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxect

• CVE-2025-40141Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

• CVE-2025-40140Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit(

• CVE-2025-40139Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_ge

• CVE-2025-40129Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data

• CVE-2025-40127Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer,

• CVE-2025-40121Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results lik

• CVE-2025-40120Nov 12, 2025
  affected < 1-150600.13.3.3fixed 1-150600.13.3.3

  In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_dri