🛡️ SUSE-SU-2025:01964-1 — kernel-livepatch-sle15-sp6-rt-update-11 (CVE-2024-28956 +338 more)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
  • CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
  • CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
  • CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
  • CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
  • CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
  • CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
  • CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
  • CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
  • CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
  • CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
  • CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
  • CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
  • CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
  • CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
  • CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
  • CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
  • CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
  • CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
  • CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
  • CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
  • CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
  • CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
  • CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
  • CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
  • CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
  • CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
  • CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
  • CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
  • CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
  • CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
  • CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
  • CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
  • CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
  • CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
  • CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
  • CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
  • CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
  • CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
  • CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
  • CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
  • CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
  • CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
  • CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
  • CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
  • CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
  • CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
  • CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
  • CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
  • CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
  • CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
  • CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
  • CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
  • CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1

Affected software

SUSE-SU-2025:01964-1 is recorded against 5 packages.

  • kernel-livepatch-sle15-sp6-rt-update-11 (fixed in 1-150600.1.3.2)
  • kernel-rt (fixed in 6.4.0-150600.10.39.1)
  • kernel-rt-debug (fixed in 6.4.0-150600.10.39.1)
  • kernel-source-rt (fixed in 6.4.0-150600.10.39.1)
  • kernel-syms-rt (fixed in 6.4.0-150600.10.39.1)

Timeline and source

Published on 16 June 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.suse.com (Advisory)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2025-06-16
Updated 2026-08-20
Modified 2026-02-04
Fix URL N/A

Affected Packages

Software From version Fixed in
kernel-livepatch-sle15-sp6-rt-update-11 — 1-150600.1.3.2
kernel-rt — 6.4.0-150600.10.39.1
kernel-rt-debug — 6.4.0-150600.10.39.1
kernel-source-rt — 6.4.0-150600.10.39.1
kernel-syms-rt — 6.4.0-150600.10.39.1

References

Free Vulnerability Check

Is your site affected by SUSE-SU-2025:01964-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against SUSE-SU-2025:01964-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesSUSESUSE 2025