suse/kernel-source-azure&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP7

Vulnerabilities (2,117)

• CVE-2025-21853Mar 12, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we naively do this mea

• CVE-2025-21852Mar 12, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL. Commit c53795d48ee8 ("net: ad

• CVE-2025-21850Mar 12, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when

• CVE-2025-21849Mar 12, 2025
  affected < 6.4.0-150700.20.6.1fixed 6.4.0-150700.20.6.1

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Use spin_lock_irqsave() in interruptible context spin_lock/unlock() functions used in interrupt contexts could result in a deadlock, as seen in GitLab issue #13399, which occurs when interrupt come

• CVE-2025-21847Mar 12, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NUL

• CVE-2024-58088Mar 12, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for fentry/fexit progr

• CVE-2025-21842Mar 7, 2025
  affected < 6.4.0-150700.20.6.1fixed 6.4.0-150700.20.6.1

  In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt bo is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which takes void** as the

• CVE-2025-21839Mar 7, 2025
  affected < 6.4.0-150700.20.11.1fixed 6.4.0-150700.20.11.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load

• CVE-2025-21836Mar 7, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement tha

• CVE-2025-21833Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unlikely situation when domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless happens we must avoid using a

• CVE-2025-21832Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than m

• CVE-2024-58071MedMar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lower of vlan1. This

• CVE-2024-58083Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will

• CVE-2024-58077Mar 6, 2025
  affected < 6.4.0-150700.20.6.1fixed 6.4.0-150700.20.6.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is u

• CVE-2024-58074Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Grab intel_display from the encoder to avoid potential oopsies Grab the intel_display from 'encoder' rather than 'state' in the encoder hooks to avoid the massive footgun that is intel_sanitize_encode

• CVE-2024-58070Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is to enforce

• CVE-2024-58068Mar 6, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was not created because t

• CVE-2024-58062Mar 6, 2025
  affected < 6.4.0-150700.20.6.1fixed 6.4.0-150700.20.6.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference When iterating over the links of a vif, we need to make sure that the pointer is valid (in other words - that the link exists) before dereferncing it. Use for_

• CVE-2024-58053Mar 6, 2025
  affected < 6.4.0-150700.20.6.1fixed 6.4.0-150700.20.6.1

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connection abort that we've received. Though the abort is at the connection level, it needs propagating to the calls on that connection.

• CVE-2025-21814MedFeb 27, 2025
  affected < 6.4.0-150700.20.3.1fixed 6.4.0-150700.20.3.1

  In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affecte