Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:3880-1

Опубликовано: 31 окт. 2025
Источник: suse-cvrf

Описание

Security update for the Linux Kernel RT (Live Patch 7 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600_10_23 fixes several issues.

The following security issues were fixed:

  • CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248631).
  • CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1249208).
  • CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1249207).
  • CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1246019).

Список пакетов

SUSE Linux Enterprise Live Patching 15 SP6
kernel-livepatch-6_4_0-150600_10_23-rt-15-150600.4.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become empty.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_10_23-rt-15-150600.4.1
Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_10_23-rt-15-150600.4.1
Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_10_23-rt-15-150600.4.1
Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_10_23-rt-15-150600.4.1
Ссылки