Описание
Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP5)
This update for the SUSE Linux Enterprise kernel 5.14.21-150500.55.83 fixes various security issues
The following security issues were fixed:
- CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
- CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1246019).
- CVE-2025-38617: net/packet: fix a race in packet_set_ring() and packet_notifier() (bsc#1249208).
- CVE-2025-38618: vsock: Do not allow binding to VMADDR_PORT_ANY (bsc#1249207).
- CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248631).
The following non security issue was fixed:
- bsc#1249208: fix livepatching target module name (bsc#1252946)
Список пакетов
SUSE Linux Enterprise Live Patching 15 SP4
SUSE Linux Enterprise Live Patching 15 SP5
Ссылки
- Link for SUSE-SU-2025:4043-1
- E-Mail link for SUSE-SU-2025:4043-1
- SUSE Security Ratings
- SUSE Bug 1246019
- SUSE Bug 1248631
- SUSE Bug 1249207
- SUSE Bug 1249208
- SUSE Bug 1249847
- SUSE Bug 1252946
- SUSE CVE CVE-2022-50252 page
- SUSE CVE CVE-2024-53164 page
- SUSE CVE CVE-2025-38617 page
- SUSE CVE CVE-2025-38618 page
- SUSE CVE CVE-2025-38664 page
Описание
In the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed but left in the original adapter->q_vector[v_idx] array position.
Затронутые продукты
Ссылки
- CVE-2022-50252
- SUSE Bug 1247374
- SUSE Bug 1249846
Описание
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become empty.
Затронутые продукты
Ссылки
- CVE-2024-53164
- SUSE Bug 1234863
- SUSE Bug 1246019
Описание
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.
Затронутые продукты
Ссылки
- CVE-2025-38617
- SUSE Bug 1247374
- SUSE Bug 1248621
- SUSE Bug 1249208
Описание
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY.
Затронутые продукты
Ссылки
- CVE-2025-38618
- SUSE Bug 1248511
- SUSE Bug 1249207
Описание
In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference.
Затронутые продукты
Ссылки
- CVE-2025-38664
- SUSE Bug 1248628
- SUSE Bug 1248631