SUSE-SU-2025:01633-1: kernel-64kb&distro=SUSE Enterprise Storage 7.1 SUSE Linux Enterprise
Published
Published 21-05-2025Last modified 23-03-2026
Vulnerability summary
SUSE-SU-2025:01633-1 is a vulnerability in kernel-64kb&distro=SUSE Enterprise Storage 7.1 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 17 · Downstream 0 · Related 17Timeline
- 21-05-2025PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984). - CVE-2025-21726: padata: avoid UAF for reorder_work (bsc#1238865). - CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747). - CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512). - CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835). - CVE-2025-22020: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (bsc#1241280). - CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse39 products
- kernel-64kb&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-64kb&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-64kb&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-default-base&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default-base&distro=SUSE Linux Enterprise Micro 5.1< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default-base&distro=SUSE Linux Enterprise Micro 5.2< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default-base&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default-base&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1.150300.18.122.1
- kernel-default&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise High Availability Extension 15 SP3< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise Live Patching 15 SP3< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise Micro 5.1< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise Micro 5.2< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-default&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-docs&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-docs&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-docs&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-docs&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-livepatch-SLE15-SP3_Update_57&distro=SUSE Linux Enterprise Live Patching 15 SP3< 1-150300.7.3.1
- kernel-obs-build&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-obs-build&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-obs-build&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-obs-build&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-preempt&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-preempt&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-preempt&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-preempt&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-source&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-source&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-source&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-source&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-syms&distro=SUSE Enterprise Storage 7.1< 5.3.18-150300.59.204.1
- kernel-syms&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-syms&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
- kernel-syms&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 5.3.18-150300.59.204.1
- kernel-zfcpdump&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 5.3.18-150300.59.204.1
1 vendor · 39 products
References
36 linksShow all 36 references
Related vulnerabilities
Insufficient evidenceSUSE-SU-2025:4530-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +36 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
- CVE-2023-53659: iavf: Fix out-of-bounds when setting channels on remove (bsc#1251247).
- CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
- CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1252560).
- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
- CVE-2025-40121: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (bsc#1253367).
- CVE-2025-40154: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (bsc#1253431).
- CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
The following non-security bugs were fixed:
- cifs: Check the lease context if we actually got a lease (bsc#1228688).
- cifs: return a single-use cfid if we did not get a lease (bsc#1228688).
- smb3: fix Open files on server counter going negative (git-fixes).CVSSUnscoredInsufficient evidenceSUSE-SU-2025:4188-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +36 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues
The following security issues were fixed:
- CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
- CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
- CVE-2022-50388: nvme: fix multipath crash caused by flush request when blktrace is enabled (bsc#1250293).
- CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
- CVE-2022-50432: kernfs: fix use-after-free in __kernfs_remove (bsc#1250851).
- CVE-2022-50488: block, bfq: fix possible uaf for 'bfqq->bic' (bsc#1251201).
- CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
- CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
- CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
- CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
- CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
- CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
- CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
- CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
- CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
- CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
- CVE-2023-53722: md: raid1: fix potential OOB in raid1_remove_disk() (bsc#1252499).
- CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).CVSSUnscoredInsufficient evidenceSUSE-SU-2025:03626-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +38 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110).
- CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968).
- CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840).
- CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846).
- CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947).
- CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257).
- CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301).
- CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140).
- CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391).
- CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392).
- CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter (bsc#1250189).
- CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827).
- CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (bsc#1250337).
- CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313).
- CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180).
- CVE-2024-53093: nvme-multipath: defer partition scanning (bsc#1233640).
- CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
- CVE-2025-38011: drm/amdgpu: csa unmap use uninterruptible lock (bsc#1244729).
- CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
- CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
- CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239).
- CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255).
- CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399).
- CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628).
- CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220).
- CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200).
- CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538).
- CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002).
The following non-security bugs were fixed:
- Limit patch filenames to 100 characters (bsc#1249604).
- Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108).
- git_sort: Make tests independent of environment.
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).
- kernel-binary: Another installation ordering fix (bsc#1241353).
- kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522).
- kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346).
- kernel-syms.spec: Drop old rpm release number hack (bsc#1247172).
- rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879).
- rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337).
- rpm: Configure KABI checkingness macro (bsc#1249186).
- rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186).
- scripts/python/kss-dashboard: attempt getting smash data
- scripts/python/kss-dashboard: fetch into repos if stale
- scripts/python/kss-dashboard: implement CVSSv3.1 score consistency check
- scripts/python/kss-dashboard: prepare for the alternative CVE branch
- scripts/python/kss-dashboard: simplify control flow
- scripts/python/kss-dashboard: speed up patch checking a bit
- scripts/python/kss-dashboard: use decorator to handle exceptions
- scripts/tar-up: Remove mkspec only affter running it.
- scripts: Import arch-symbols script from packaging
- scripts: Import guards script from packaging
- scripts: test_linux_git.py: Do not complain about missing cwd
- sequence-patch: Use arch-symbols
- suse_git/header: Complain about patch filenames over 100 characters.
- tar-up: Also sort generated tar archives
- tar-up: Handle multiple levels of symlinks
- tar-up: Normalize file modes to ones supported by git
- tar-up: Remove mkspec and its inputs as from target directory (bsc#1250522).
- tar-up: Remove the $build_dir prefix when in $build_dir
- tar-up: Set owner of files in generated tar archives to root rather than nobody
- tar_up: Handle symlinks in rpm directory
- use uniform permission checks for all mount propagation changes (git-fixes).CVSSUnscoredInsufficient evidenceSUSE-SU-2025:03310-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +38 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2022-49492: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (bsc#1238954).
- CVE-2022-50116: tty: n_gsm: fix deadlock and link starvation in outgoing data path (bsc#1244824).
- CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
- CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
- CVE-2024-58239: tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1248614).
- CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
- CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
- CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
- CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
- CVE-2025-38323: net: atm: add lec_mutex (bsc#1246473).
- CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
- CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
- CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
- CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
- CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247314).
- CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
- CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (bsc#1247976).
- CVE-2025-38546: atm: clip: Fix memory leak of struct clip_vcc (bsc#1248223).
- CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings (bsc#1248306).
- CVE-2025-38608: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (bsc#1248338).
- CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1248621).
- CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1248511).
- CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248748).
The following non-security bugs were fixed:
- NFSv4.1: fix backchannel max_resp_sz verification check (bsc#1247518).
- scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1243278).
- scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() (git-fixes).
- Disable N_GSM (jsc#PED-8240).CVSSUnscoredInsufficient evidenceSUSE-SU-2025:02848-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +23 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2022-50211: md-raid10: fix KASAN warning (bsc#1245140).
- CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA (bsc#1210629).
- CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
- CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
- CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
- CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
- CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
- CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
- CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
- CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
- CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
- CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
- CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
- CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
- CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).CVSSUnscoredInsufficient evidenceSUSE-SU-2025:02308-1SUSE Linux Enterprisesuse · kernel-64kb&distro=SUSE Enterprise Storage 7.1 +30 moresuse kernel-64kb&distro=SUSE Enterprise Storage 7.1Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2022-50085: dm raid: fix address sanitizer warning in raid_resume (bsc#1245147).
- CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
- CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
- CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
- CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
- CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
- CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
- CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
- CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
- CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
- CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
- CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
- CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
- CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
- CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (bsc#1243330).
- CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
- CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
- CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
- CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).
The following non-security bugs were fixed:
- Fix conditional for selecting gcc-13 Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
- MyBS: Correctly generate build flags for non-multibuild package limit (bsc# 1244241) Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build')
- MyBS: Do not build kernel-obs-qa with limit_packages Fixes: 58e3f8c34b2b ('bs-upload-kernel: Pass limit_packages also on multibuild')
- MyBS: Simplify qa_expr generation Start with a 0 which makes the expression valid even if there are no QA repositories (currently does not happen). Then separator is always needed.
- Require zstd in kernel-default-devel when module compression is zstd To use ksym-provides tool modules need to be uncompressed. Without zstd at least kernel-default-base does not have provides. Link: https://github.com/openSUSE/rpm-config-SUSE/pull/82
- Test the correct macro to detect RT kernel build Fixes: 470cd1a41502 ('kernel-binary: Support livepatch_rt with merged RT branch')
- Use gcc-13 for build on SLE16 (jsc#PED-10028).
- add nf_tables for iptables non-legacy network handling This is needed for example by docker on the Alpine Linux distribution, but can also be used on openSUSE.
- bs-upload-kernel: Pass limit_packages also on multibuild Fixes: 0999112774fc ('MyBS: Use buildflags to set which package to build') Fixes: 747f601d4156 ('bs-upload-kernel, MyBS, Buildresults: Support multibuild (JSC-SLE#5501, boo#1211226, bsc#1218184)')
- check-for-config-changes: Fix flag name typo
- drop ax25 drivers (bsc#1238471).
- drop hamradio drivers (bsc#1238471).
- drop netrom drivers (bsc#1238471).
- drop rose drivers (bsc#1238471).
- kabi/severities: workaround kABI checker complains after AX25 and HAMRADIO removals KABI: symbol asc2ax(mod:net/ax25/ax25) lost KABI: symbol ax25_bcast(mod:net/ax25/ax25) lost KABI: symbol ax25_defaddr(mod:net/ax25/ax25) lost KABI: symbol ax25_display_timer(mod:net/ax25/ax25) lost KABI: symbol ax25_find_cb(mod:net/ax25/ax25) lost KABI: symbol ax25_findbyuid(mod:net/ax25/ax25) lost KABI: symbol ax25_header_ops(mod:net/ax25/ax25) lost KABI: symbol ax25_ip_xmit(mod:net/ax25/ax25) lost KABI: symbol ax25_linkfail_register(mod:net/ax25/ax25) lost KABI: symbol ax25_linkfail_release(mod:net/ax25/ax25) lost KABI: symbol ax25_listen_register(mod:net/ax25/ax25) lost KABI: symbol ax25_listen_release(mod:net/ax25/ax25) lost KABI: symbol ax25_protocol_release(mod:net/ax25/ax25) lost KABI: symbol ax25_register_pid(mod:net/ax25/ax25) lost KABI: symbol ax25_send_frame(mod:net/ax25/ax25) lost KABI: symbol ax25_uid_policy(mod:net/ax25/ax25) lost KABI: symbol ax25cmp(mod:net/ax25/ax25) lost KABI: symbol ax2asc(mod:net/ax25/ax25) lost KABI: symbol hdlcdrv_arbitrate(mod:drivers/net/hamradio/hdlcdrv) lost KABI: symbol hdlcdrv_receiver(mod:drivers/net/hamradio/hdlcdrv) lost KABI: symbol hdlcdrv_register(mod:drivers/net/hamradio/hdlcdrv) lost KABI: symbol hdlcdrv_transmitter(mod:drivers/net/hamradio/hdlcdrv) lost KABI: symbol hdlcdrv_unregister(mod:drivers/net/hamradio/hdlcdrv) lost KABI: symbol null_ax25_address(mod:net/ax25/ax25) lost
- kernel-binary: Support livepatch_rt with merged RT branch
- kernel-obs-qa: Use srchash for dependency as well
- kernel-source: Also replace bin/env
- kernel-source: Do not use multiple -r in sed parameters
- kernel-source: Remove log.sh from sources
- mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337).
- net_sched: sch_fifo: implement lockless __fifo_dump() (bsc#1237312)
- net_sched: sch_sfq: use a temporary work area for validating configuration (bsc#1232504)
- packaging: Patch Makefile to pre-select gcc version (jsc#PED-12251). When compiler different from the one which was used to configure the kernel is used to build modules a warning is issued and the build continues. This could be turned into an error but that would be too restrictive. The generated kernel-devel makefile could set the compiler but then the main Makefile as to be patched to assign CC with ?= This causes run_oldconfig failure on SUSE-2024 and kbuild config check failure on SUSE-2025. This cannot be hardcoded to one version in a regular patch because the value is expected to be configurable at mkspec time. Patch the Makefile after aplyin patches in rpm prep step instead. A check is added to verify that the sed command did indeed apply the change.
- packaging: Turn gcc version into config.sh variable Fixes: 51dacec21eb1 ('Use gcc-13 for build on SLE16 (jsc#PED-10028).')
- rpm/check-for-config-changes: Add GCC_ASM_FLAG_OUTPUT_BROKEN
- rpm/check-for-config-changes: Add GCC_ASM_FLAG_OUTPUT_BROKEN Both spellings are actually used
- rpm/check-for-config-changes: add LD_CAN_ to IGNORED_CONFIGS_RE
- rpm/check-for-config-changes: add more to IGNORED_CONFIGS_RE Useful when someone tries (needs) to build the kernel with clang.
- rpm/check-for-config-changes: ignore DRM_MSM_VALIDATE_XML This option is dynamically enabled to build-test different configurations. This makes run_oldconfig.sh complain sporadically for arm64.
- rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
- rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986) sle_version was obsoleted for SLE16. It has to be combined with suse_version check.
- rpm/kernel-binary.spec.in: Use OrderWithRequires (boo#1228659 boo#1241038). OrderWithRequires was introduced in rpm 4.9 (ie. SLE12+) to allow a package to inform the order of installation of other package without hard requiring that package. This means our kernel-binary packages no longer need to hard require perl-Bootloader or dracut, resolving the long-commented issue there. This is also needed for udev & systemd-boot to ensure those packages are installed before being called by dracut (boo#1228659)
- rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
- rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
- rpm/package-descriptions: Add rt and rt_debug descriptions
- rpm/release-projects: Update the ALP projects again (bsc#1231293).
- rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
- rpm: Stop using is_kotd_qa macro This macro is set by bs-upload-kernel, and a conditional in each spec file is used to determine when to build the spec file. This logic should not really be in the spec file. Previously this was done with package links and package meta for the individula links. However, the use of package links is rejected for packages in git based release projects (nothing to do with git actually, new policy). An alternative to package links is multibuild. However, for multibuild packages package meta cannot be used to set which spec file gets built. Use prjcon buildflags instead, and remove this conditional. Depends on bs-upload-kernel adding the build flag.
- scsi: storvsc: Do not report the host packet status as the hv status (git-fixes).
- scsi: storvsc: Increase the timeouts to storvsc_timeout (bsc#1245455).
- wifi: cfg80211: Add my certificate (bsc#1243001).
- wifi: cfg80211: fix certs build to not depend on file order (bsc#1243001).CVSSUnscored