suse/kernel-syms&distro=SUSE Linux Enterprise Server 12 SP5-LTSS

Vulnerabilities (1,878)

• CVE-2025-37927HigMay 20, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn

• CVE-2025-37923HigMay 20, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/tr

• CVE-2025-37920HigMay 20, 2025
  affected < 4.12.14-122.269.1fixed 4.12.14-122.269.1

  In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share single xsk_buff_pool. R

• CVE-2025-37913HigMay 20, 2025
  affected < 4.12.14-122.293.1fixed 4.12.14-122.293.1

  In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant

• CVE-2025-37911HigMay 20, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [

• CVE-2025-37892HigMay 20, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: mtd: inftlcore: Add error check for inftl_read_oob() In INFTL_findwriteunit(), the return value of inftl_read_oob() need to be checked. A proper implementation can be found in INFTL_deleteblock(). The status wi

• CVE-2024-28956MedMay 13, 2025
  affected < 4.12.14-122.272.1fixed 4.12.14-122.272.1

  Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2023-53145HigMay 10, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs wi

• CVE-2025-37885HigMay 9, 2025
  affected < 4.12.14-122.269.1fixed 4.12.14-122.269.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly to a vCPU, regardle

• CVE-2025-37879CriMay 9, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9_client_write() and p9_client_read_once(), if the server incorrectly replies with success but a negative write/read count then we would co

• CVE-2025-37871HigMay 9, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2

• CVE-2025-37862MedMay 9, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optio

• CVE-2025-37856HigMay 9, 2025
  affected < 4.12.14-122.269.1fixed 4.12.14-122.269.1

  In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as

• CVE-2025-37852MedMay 9, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error handling to propagate amdgpu_cgs_create_device() failures to the caller. When amdgpu_cgs_create_device() fails, release h

• CVE-2025-37844MedMay 9, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting

• CVE-2025-37836MedMay 9, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review.

• CVE-2025-37833MedMay 8, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads Fix niu_try_msix() to not cause a fatal trap on sparc systems. Set PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST on the struct pci_dev to work

• CVE-2025-37823HigMay 8, 2025
  affected < 4.12.14-122.261.1fixed 4.12.14-122.261.1

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

• CVE-2025-37810HigMay 8, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event bu

• CVE-2025-37800HigMay 8, 2025
  affected < 4.12.14-122.266.1fixed 4.12.14-122.266.1

  In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver fro