suse/kernel-rt_debug&distro=SUSE Real Time Module 15 SP6

Vulnerabilities (3,740)

• CVE-2025-39678MedSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address is not allocated, accessing metrics_bin will result in a NULL pointer dereference, so add a check.

• CVE-2025-39677HigSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The p

• CVE-2025-39676MedSep 5, 2025
  affected < 6.4.0-150600.10.58.1fixed 6.4.0-150600.10.58.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error point

• CVE-2025-39675MedSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The re

• CVE-2025-39673CriSep 5, 2025
  affected < 6.4.0-150600.10.58.1fixed 6.4.0-150600.10.58.1

  In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held

• CVE-2025-38736HigSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this

• CVE-2025-38735HigSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing e

• CVE-2025-38734CriSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read acce

• CVE-2025-38732MedSep 5, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include

• CVE-2025-38730HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on r

• CVE-2025-38729HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.

• CVE-2025-38727MedSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the ju

• CVE-2025-38725MedSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-

• CVE-2025-38724CriSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM c

• CVE-2025-38722HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descripto

• CVE-2025-38721MedSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE c

• CVE-2025-38718HigSep 4, 2025
  affected < 6.4.0-150600.10.58.1fixed 6.4.0-150600.10.58.1

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uniniti

• CVE-2025-38715HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that

• CVE-2025-38714HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.8

• CVE-2025-38713HigSep 4, 2025
  affected < 6.4.0-150600.10.55.1fixed 6.4.0-150600.10.55.1

  In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] =================================================