suse/kernel-livepatch-SLE15-SP7_Update_1&distro=SUSE Linux Enterprise Live Patching 15 SP7

Vulnerabilities (371)

• CVE-2025-21883Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: ice: Fix deinitializing VF in error path If ice_ena_vfs() fails after calling ice_create_vf_entries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption. Repro

• CVE-2025-21882Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix vport QoS cleanup on error When enabling vport QoS fails, the scheduling node was never freed, causing a leak. Add the missing free and reset the vport scheduling node pointer to NULL.

• CVE-2025-21881Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000

• CVE-2025-21878Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: i2c: npcm: disable interrupt enable bit before devm_request_irq The customer reports that there is a soft lockup issue related to the i2c driver. After checking, the i2c module was doing a tx transfer and the b

• CVE-2025-21877Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix endpoint checking in genelink_bind() Syzbot reports [1] a warning in usb_submit_urb() triggered by inconsistencies between expected and actually present endpoints in gl620a driver. Since gen

• CVE-2025-21876Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix suspicious RCU usage Commit ("iommu/vt-d: Allocate DMAR fault interrupts locally") moved the call to enable_drhd_fault_handling() to a code path that does not hold any lock while

• CVE-2025-21875Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkaller reported a lockdep splat in the PM control path: WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sock_owned_by_me include/net/sock.

• CVE-2025-21873Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req()

• CVE-2024-58091Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed by struct page, so we cannot rely on it for deferred I/O. Allocate a shadow buffer for drivers that require deferred I/O

• CVE-2025-21871Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes more complicated wh

• CVE-2025-21870Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data

• CVE-2025-21869Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Disable KASAN report during patching via temporary mm Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.13: [ 12.028126] =======================================

• CVE-2025-21867Mar 27, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't c

• CVE-2025-2312MedMar 25, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credenti

• CVE-2023-52927HigMar 14, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the ex

• CVE-2025-21865MedMar 12, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported the list_del() corruption splat in gtp_net_exit_batch_rtnl(). [0] Commit eb28fd76c0a0 ("gtp: Destroy device along with u

• CVE-2025-21864MedMar 12, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a basic TCP test ove

• CVE-2025-21862MedMar 12, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU#1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner: /-1, .owne

• CVE-2025-21859MedMar 12, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it by using queue_wor

• CVE-2025-21858HigMar 12, 2025
  affected < 1-150700.15.3.1fixed 1-150700.15.3.1

  In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->