rpm package
suse/kernel-source&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7
pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7
Vulnerabilities (2,365)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-38614 | Hig | 7.8 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some re | |
| CVE-2025-38612 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is n | |
| CVE-2025-38610 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impo | |
| CVE-2025-38609 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But | |
| CVE-2025-38608 | Hig | 8.6 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data len | |
| CVE-2025-38605 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could | |
| CVE-2025-38604 | Hig | 7.8 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed sk | |
| CVE-2025-38602 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. | |
| CVE-2025-38601 | Hig | 8.8 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath1 | |
| CVE-2025-38597 | Med | 5.5 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available wi | |
| CVE-2025-38595 | Hig | 7.8 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread | |
| CVE-2025-38593 | Hig | 7.8 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_c | |
| CVE-2025-38591 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at of | |
| CVE-2025-38590 | Hig | 7.5 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed | |
| CVE-2025-38588 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_sibling | |
| CVE-2025-38587 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() | |
| CVE-2025-38585 | Hig | 7.8 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine t | |
| CVE-2025-38584 | Hig | 7.0 | < 6.4.0-150700.53.19.1 | 6.4.0-150700.53.19.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and relea | |
| CVE-2025-38583 | Med | 5.5 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace: Unable to handle | |
| CVE-2025-38582 | Hig | 7.8 | < 6.4.0-150700.53.16.1 | 6.4.0-150700.53.16.1 | Aug 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init(). |
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some re
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is n
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impo
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data len
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed sk
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath1
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available wi
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_c
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at of
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_sibling
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route()
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine t
- affected < 6.4.0-150700.53.19.1fixed 6.4.0-150700.53.19.1
In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and relea
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace: Unable to handle
- affected < 6.4.0-150700.53.16.1fixed 6.4.0-150700.53.16.1
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init().
Page 71 of 119