rpm package
suse/kernel-obs-build&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3
pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3
Vulnerabilities (1,468)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-22045 | Hig | 7.8 | < 5.3.18-150300.59.218.1 | 5.3.18-150300.59.218.1 | Apr 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE | |
| CVE-2025-22028 | Med | 5.5 | < 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 | Apr 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or stopped subdevs. | |
| CVE-2025-22020 | Hig | 7.8 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Apr 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rt | |
| CVE-2025-22004 | Hig | 8.6 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Apr 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free. | |
| CVE-2025-21999 | Hig | 7.8 | < 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 | Apr 3, 2025 | In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc | |
| CVE-2025-21971 | Hig | 7.8 | < 5.3.18-150300.59.218.1 | 5.3.18-150300.59.218.1 | Apr 1, 2025 | In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. Howe | |
| CVE-2025-21969 | Hig | 8.8 | < 5.3.18-150300.59.221.1 | 5.3.18-150300.59.221.1 | Apr 1, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper laye | |
| CVE-2023-53033 | Hig | 7.8 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the bounda | |
| CVE-2023-53026 | Hig | 7.8 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix ib block iterator counter overflow When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry to smaller, aligned to the | |
| CVE-2023-53024 | Hig | 7.1 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence ins | |
| CVE-2023-53015 | Med | 5.5 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertisi | |
| CVE-2023-53000 | Hig | 7.8 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) | |
| CVE-2023-52974 | Hig | 7.8 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we th | |
| CVE-2023-52973 | Hig | 7.8 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data p | |
| CVE-2023-52935 | Hig | 7.8 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock ( | |
| CVE-2022-49739 | Hig | 7.1 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Always check inode size of inline inodes Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk cor | |
| CVE-2022-49733 | Hig | 7.8 | < 5.3.18-150300.59.201.1 | 5.3.18-150300.59.201.1 | Mar 2, 2025 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, the | |
| CVE-2025-21812 | Hig | 7.8 | < 5.3.18-150300.59.207.1 | 5.3.18-150300.59.207.1 | Feb 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: ax25: rcu protect dev->ax25_ptr syzbot found a lockdep issue [1]. We should remove ax25 RTNL dependency in ax25_setsockopt() This should also fix a variety of possible UAF in ax25. [1] WARNING: possible cir | |
| CVE-2025-21791 | Hig | 7.8 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Feb 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_ou | |
| CVE-2025-21785 | Hig | 7.8 | < 5.3.18-150300.59.204.1 | 5.3.18-150300.59.204.1 | Feb 27, 2025 | In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate |
- affected < 5.3.18-150300.59.218.1fixed 5.3.18-150300.59.218.1
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE
- affected < 5.3.18-150300.59.207.1fixed 5.3.18-150300.59.207.1
In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or stopped subdevs.
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rt
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
- affected < 5.3.18-150300.59.207.1fixed 5.3.18-150300.59.207.1
In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc
- affected < 5.3.18-150300.59.218.1fixed 5.3.18-150300.59.218.1
In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. Howe
- affected < 5.3.18-150300.59.221.1fixed 5.3.18-150300.59.221.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper laye
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the bounda
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix ib block iterator counter overflow When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry to smaller, aligned to the
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence ins
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertisi
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype)
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we th
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data p
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: gfs2: Always check inode size of inline inodes Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk cor
- affected < 5.3.18-150300.59.201.1fixed 5.3.18-150300.59.201.1
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, the
- affected < 5.3.18-150300.59.207.1fixed 5.3.18-150300.59.207.1
In the Linux kernel, the following vulnerability has been resolved: ax25: rcu protect dev->ax25_ptr syzbot found a lockdep issue [1]. We should remove ax25 RTNL dependency in ax25_setsockopt() This should also fix a variety of possible UAF in ax25. [1] WARNING: possible cir
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_ou
- affected < 5.3.18-150300.59.204.1fixed 5.3.18-150300.59.204.1
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate
Page 16 of 74