Security update for the Linux Kernel

Announcement ID: SUSE-SU-2025:02852-1
Release Date: 2025-08-18T15:58:14Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2022-49138 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
  • CVE-2022-49138 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • CVE-2022-49770 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-52923 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2023-52923 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-52927 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2023-52927 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2023-52927 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26643 ( SUSE ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-26643 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-53057 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-53057 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-53057 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-53164 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2024-53164 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-57947 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2024-57947 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-21701 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-21971 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-21971 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-37797 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-37798 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38079 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38079 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38088 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38088 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38120 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • CVE-2025-38120 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-38177 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38177 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38181 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38181 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2025-38200 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38200 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
  • CVE-2025-38206 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38206 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38212 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38212 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38213 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38213 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38257 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38257 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38289 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38289 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38350 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38350 ( SUSE ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
  • CVE-2025-38468 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38468 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2025-38477 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38477 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38494 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38494 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38495 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38495 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2025-38497 ( SUSE ): 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-38497 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Affected Products:
  • openSUSE Leap 15.5
  • SUSE Linux Enterprise Micro 5.5

An update that solves 29 vulnerabilities and has five security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
  • CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
  • CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
  • CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
  • CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
  • CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
  • CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
  • CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
  • CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
  • CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
  • CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
  • CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
  • CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
  • CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
  • CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
  • CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
  • CVE-2025-38289: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (bsc#1246287).
  • CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
  • CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
  • CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
  • CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
  • CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
  • CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

  • Revert "hugetlb: unshare some PMDs when splitting VMAs" (bsc#1245431).
  • Revert "mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race"
  • Revert "mm/hugetlb: unshare page tables during VMA split, not before"
  • bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (bsc#1244523).
  • net: usb: usbnet: restore usb%d name exception for local mac addresses (bsc#1234480 bsc#1246555).

Special Instructions and Notes:

  • Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.5
    zypper in -t patch SUSE-2025-2852=1
  • SUSE Linux Enterprise Micro 5.5
    zypper in -t patch SUSE-SLE-Micro-5.5-2025-2852=1

Package List:

  • openSUSE Leap 15.5 (noarch)
    • kernel-source-rt-5.14.21-150500.13.103.2
    • kernel-devel-rt-5.14.21-150500.13.103.2
  • openSUSE Leap 15.5 (x86_64)
    • kernel-rt-livepatch-5.14.21-150500.13.103.2
    • kselftests-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • reiserfs-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt_debug-vdso-debuginfo-5.14.21-150500.13.103.2
    • ocfs2-kmp-rt-5.14.21-150500.13.103.2
    • reiserfs-kmp-rt-5.14.21-150500.13.103.2
    • kselftests-kmp-rt-5.14.21-150500.13.103.2
    • kernel-rt-devel-5.14.21-150500.13.103.2
    • kernel-rt-vdso-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-optional-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt_debug-debugsource-5.14.21-150500.13.103.2
    • gfs2-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-optional-5.14.21-150500.13.103.2
    • ocfs2-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-devel-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-extra-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-vdso-5.14.21-150500.13.103.2
    • cluster-md-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • cluster-md-kmp-rt-5.14.21-150500.13.103.2
    • kernel-rt_debug-vdso-5.14.21-150500.13.103.2
    • kernel-rt_debug-devel-debuginfo-5.14.21-150500.13.103.2
    • dlm-kmp-rt-5.14.21-150500.13.103.2
    • kernel-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-extra-5.14.21-150500.13.103.2
    • gfs2-kmp-rt-5.14.21-150500.13.103.2
    • kernel-rt-livepatch-devel-5.14.21-150500.13.103.2
    • kernel-rt_debug-debuginfo-5.14.21-150500.13.103.2
    • dlm-kmp-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt_debug-devel-5.14.21-150500.13.103.2
    • kernel-rt-debugsource-5.14.21-150500.13.103.2
  • openSUSE Leap 15.5 (nosrc x86_64)
    • kernel-rt-5.14.21-150500.13.103.2
    • kernel-rt_debug-5.14.21-150500.13.103.2
  • SUSE Linux Enterprise Micro 5.5 (noarch)
    • kernel-source-rt-5.14.21-150500.13.103.2
    • kernel-devel-rt-5.14.21-150500.13.103.2
  • SUSE Linux Enterprise Micro 5.5 (nosrc x86_64)
    • kernel-rt-5.14.21-150500.13.103.2
  • SUSE Linux Enterprise Micro 5.5 (x86_64)
    • kernel-rt-debuginfo-5.14.21-150500.13.103.2
    • kernel-rt-debugsource-5.14.21-150500.13.103.2

References: