SUSE update for the Linux Kernel



Risk High
Patch available YES
Number of vulnerabilities 116
CVE-ID CVE-2024-26924
CVE-2024-27397
CVE-2024-35839
CVE-2024-36908
CVE-2024-36915
CVE-2024-39480
CVE-2024-41042
CVE-2024-44934
CVE-2024-44996
CVE-2024-47678
CVE-2024-49854
CVE-2024-49884
CVE-2024-49915
CVE-2024-50016
CVE-2024-50018
CVE-2024-50039
CVE-2024-50047
CVE-2024-50143
CVE-2024-50154
CVE-2024-50202
CVE-2024-50203
CVE-2024-50211
CVE-2024-50228
CVE-2024-50256
CVE-2024-50262
CVE-2024-50272
CVE-2024-50278
CVE-2024-50279
CVE-2024-50280
CVE-2024-53050
CVE-2024-53064
CVE-2024-53090
CVE-2024-53099
CVE-2024-53103
CVE-2024-53105
CVE-2024-53111
CVE-2024-53113
CVE-2024-53117
CVE-2024-53118
CVE-2024-53119
CVE-2024-53120
CVE-2024-53122
CVE-2024-53125
CVE-2024-53126
CVE-2024-53127
CVE-2024-53129
CVE-2024-53130
CVE-2024-53131
CVE-2024-53133
CVE-2024-53134
CVE-2024-53136
CVE-2024-53141
CVE-2024-53142
CVE-2024-53144
CVE-2024-53146
CVE-2024-53148
CVE-2024-53150
CVE-2024-53151
CVE-2024-53154
CVE-2024-53155
CVE-2024-53156
CVE-2024-53157
CVE-2024-53158
CVE-2024-53159
CVE-2024-53160
CVE-2024-53161
CVE-2024-53162
CVE-2024-53166
CVE-2024-53169
CVE-2024-53171
CVE-2024-53173
CVE-2024-53174
CVE-2024-53179
CVE-2024-53180
CVE-2024-53188
CVE-2024-53190
CVE-2024-53191
CVE-2024-53200
CVE-2024-53201
CVE-2024-53202
CVE-2024-53206
CVE-2024-53207
CVE-2024-53208
CVE-2024-53209
CVE-2024-53210
CVE-2024-53213
CVE-2024-53214
CVE-2024-53215
CVE-2024-53216
CVE-2024-53217
CVE-2024-53222
CVE-2024-53224
CVE-2024-53229
CVE-2024-53234
CVE-2024-53237
CVE-2024-53240
CVE-2024-53241
CVE-2024-56536
CVE-2024-56539
CVE-2024-56549
CVE-2024-56551
CVE-2024-56562
CVE-2024-56566
CVE-2024-56567
CVE-2024-56576
CVE-2024-56582
CVE-2024-56599
CVE-2024-56604
CVE-2024-56605
CVE-2024-56645
CVE-2024-56667
CVE-2024-56752
CVE-2024-56754
CVE-2024-56755
CVE-2024-56756
CVE-2024-8805
CWE-ID CWE-399
CWE-667
CWE-125
CWE-119
CWE-20
CWE-416
CWE-476
CWE-190
CWE-908
CWE-388
CWE-835
CWE-415
CWE-401
CWE-369
CWE-191
CWE-366
CWE-362
CWE-665
CWE-1037
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Public Cloud Module
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15
Operating systems & Components / Operating system

kernel-devel-azure
Operating systems & Components / Operating system package or component

kernel-source-azure
Operating systems & Components / Operating system package or component

kernel-azure-vdso-debuginfo
Operating systems & Components / Operating system package or component

kernel-azure-vdso
Operating systems & Components / Operating system package or component

kernel-azure
Operating systems & Components / Operating system package or component

gfs2-kmp-azure
Operating systems & Components / Operating system package or component

kernel-azure-debuginfo
Operating systems & Components / Operating system package or component

ocfs2-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

kernel-syms-azure
Operating systems & Components / Operating system package or component

kernel-azure-extra
Operating systems & Components / Operating system package or component

dlm-kmp-azure
Operating systems & Components / Operating system package or component

kselftests-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

kernel-azure-devel
Operating systems & Components / Operating system package or component

kernel-azure-debugsource
Operating systems & Components / Operating system package or component

gfs2-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

kernel-azure-optional-debuginfo
Operating systems & Components / Operating system package or component

kernel-azure-devel-debuginfo
Operating systems & Components / Operating system package or component

reiserfs-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

cluster-md-kmp-azure
Operating systems & Components / Operating system package or component

reiserfs-kmp-azure
Operating systems & Components / Operating system package or component

kernel-azure-optional
Operating systems & Components / Operating system package or component

dlm-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

kselftests-kmp-azure
Operating systems & Components / Operating system package or component

ocfs2-kmp-azure
Operating systems & Components / Operating system package or component

cluster-md-kmp-azure-debuginfo
Operating systems & Components / Operating system package or component

kernel-azure-extra-debuginfo
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 116 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU89055

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26924

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nft_pipapo_remove() function in net/netfilter/nft_set_pipapo.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper locking

EUVDB-ID: #VU92027

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27397

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nft_rbtree_insert(), nft_rbtree_deactivate() and nft_rbtree_gc() functions in net/netfilter/nft_set_rbtree.c, within the pipapo_get(), nft_pipapo_get(), nft_pipapo_insert(), pipapo_gc() and pipapo_deactivate() functions in net/netfilter/nft_set_pipapo.c, within the nft_rhash_key(), nft_rhash_cmp(), nft_rhash_lookup(), nft_rhash_get(), nft_rhash_update(), nft_rhash_insert() and nft_rhash_deactivate() functions in net/netfilter/nft_set_hash.c, within the nft_trans_gc_catchall_sync() and nf_tables_valid_genid() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper locking

EUVDB-ID: #VU93386

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35839

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nf_reject6_fill_skb_dst() and nf_send_reset6() functions in net/ipv6/netfilter/nf_reject_ipv6.c, within the nf_reject_fill_skb_dst() and nf_send_reset() functions in net/ipv4/netfilter/nf_reject_ipv4.c, within the br_nf_pre_routing_finish_ipv6() function in net/bridge/br_netfilter_ipv6.c, within the br_nf_pre_routing_finish_bridge(), br_nf_ipv4_daddr_was_changed(), bridge_parent_rtable(), skb_dst_set_noref(), setup_pre_routing(), br_nf_forward_finish(), ip_sabotage_in() and br_nf_pre_routing_finish_bridge_slow() functions in net/bridge/br_netfilter_hooks.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

EUVDB-ID: #VU93278

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36908

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the iocg_pay_debt() function in block/blk-iocost.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU90268

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36915

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nfc_llcp_setsockopt() function in net/nfc/llcp_sock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU93827

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39480

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the kdb_printf() function in kernel/debug/kdb/kdb_io.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU95003

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41042

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nf_tables_rule_release(), nft_chain_validate(), nft_chain_validate_hooks() and nft_validate_register_store() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU96517

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44934

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the br_multicast_del_port() function in net/bridge/br_multicast.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU96879

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-44996

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __vsock_recvmsg() function in net/vmw_vsock/vsock_bpf.c, within the __vsock_dgram_recvmsg(), vsock_connectible_recvmsg() and release_sock() functions in net/vmw_vsock/af_vsock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper locking

EUVDB-ID: #VU99030

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47678

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the icmpv6_mask_allow(), icmpv6_global_allow(), icmpv6_xrlim_allow(), icmp6_send() and icmpv6_echo_reply() functions in net/ipv6/icmp.c, within the __SPIN_LOCK_UNLOCKED(), icmpv4_mask_allow(), icmpv4_global_allow(), icmpv4_xrlim_allow(), icmp_reply() and __icmp_send() functions in net/ipv4/icmp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU98892

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49854

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bfq_prepare_request() and bfq_init_rq() functions in block/bfq-iosched.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU98867

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49884

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ext4_split_extent_at() and ext4_ext_dirty() functions in fs/ext4/extents.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU98932

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49915

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dcn32_init_hw() function in drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Integer overflow

EUVDB-ID: #VU99090

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50016

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the dp_set_test_pattern() function in drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Integer overflow

EUVDB-ID: #VU99091

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50018

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the NETDEVICE_SHOW_RW() and napi_defer_hard_irqs_store() functions in net/core/net-sysfs.c, within the netif_elide_gro() function in Documentation/networking/net_cachelines/net_device.rst. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Resource management error

EUVDB-ID: #VU99133

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50039

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qdisc_skb_cb() function in net/sched/sch_api.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper locking

EUVDB-ID: #VU98995

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50047

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the SMB2_negotiate() function in fs/smb/client/smb2pdu.c, within the smb2_get_enc_key(), crypt_message(), smb3_init_transform_rq() and decrypt_raw_data() functions in fs/smb/client/smb2ops.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use of uninitialized resource

EUVDB-ID: #VU100084

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50143

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the udf_current_aext() function in fs/udf/inode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU100062

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50154

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the reqsk_queue_unlink() and reqsk_timer_handler() functions in net/ipv4/inet_connection_sock.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Input validation error

EUVDB-ID: #VU100130

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50202

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nilfs_lookup(), nilfs_do_unlink(), nilfs_rename() and nilfs_get_parent() functions in fs/nilfs2/namei.c, within the nilfs_readdir(), nilfs_find_entry() and nilfs_inode_by_name() functions in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU100139

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50203

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the prepare_trampoline() function in arch/arm64/net/bpf_jit_comp.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Improper error handling

EUVDB-ID: #VU100134

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50211

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the udf_truncate_extents() function in fs/udf/truncate.c, within the udf_try_read_meta() function in fs/udf/partition.c, within the udf_map_block(), udf_extend_file(), udf_delete_aext() and inode_bmap() functions in fs/udf/inode.c, within the udf_fiiter_init() and udf_fiiter_append_blk() functions in fs/udf/directory.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Improper locking

EUVDB-ID: #VU100182

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50228

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the shmem_getattr() function in mm/shmem.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper error handling

EUVDB-ID: #VU100192

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50256

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nf_reject6_fill_skb_dst() and nf_send_reset6() functions in net/ipv6/netfilter/nf_reject_ipv6.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Out-of-bounds read

EUVDB-ID: #VU100173

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50262

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the trie_get_next_key() function in kernel/bpf/lpm_trie.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Infinite loop

EUVDB-ID: #VU100640

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50272

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the filemap_read() function in mm/filemap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Out-of-bounds read

EUVDB-ID: #VU100619

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50278

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the get_cache_dev_size() and cache_preresume() functions in drivers/md/dm-cache-target.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds read

EUVDB-ID: #VU100620

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50279

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the can_resize() function in drivers/md/dm-cache-target.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU100614

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the check_migrations(), destroy(), cache_create() and cache_ctr() functions in drivers/md/dm-cache-target.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) NULL pointer dereference

EUVDB-ID: #VU100709

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53050

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the intel_dp_hdcp2_get_capability() function in drivers/gpu/drm/i915/display/intel_dp_hdcp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) NULL pointer dereference

EUVDB-ID: #VU100714

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53064

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the idpf_init_hard_reset() function in drivers/net/ethernet/intel/idpf/idpf_lib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper locking

EUVDB-ID: #VU100833

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53090

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the afs_deferred_free_worker(), afs_alloc_call(), afs_put_call(), afs_wake_up_call_waiter() and afs_wake_up_async_call() functions in fs/afs/rxrpc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Out-of-bounds read

EUVDB-ID: #VU100938

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53099

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bpf_link_show_fdinfo() function in kernel/bpf/syscall.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) NULL pointer dereference

EUVDB-ID: #VU101106

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53103

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hvs_destruct() function in net/vmw_vsock/hyperv_transport.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Double free

EUVDB-ID: #VU101108

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53105

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the __page_cache_release() function in mm/swap.c, within the free_pages_prepare() function in mm/page_alloc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Integer overflow

EUVDB-ID: #VU101110

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53111

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the mm/mremap.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) NULL pointer dereference

EUVDB-ID: #VU101103

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53113

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the alloc_pages_bulk_noprof() function in mm/page_alloc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Memory leak

EUVDB-ID: #VU101096

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53117

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the virtio_transport_send_pkt_info() function in net/vmw_vsock/virtio_transport_common.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Memory leak

EUVDB-ID: #VU101097

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53118

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vsock_sk_destruct() function in net/vmw_vsock/af_vsock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Memory leak

EUVDB-ID: #VU101098

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53119

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the virtio_transport_recv_listen() function in net/vmw_vsock/virtio_transport_common.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) NULL pointer dereference

EUVDB-ID: #VU101105

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53120

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5_tc_ct_entry_add_rule() function in drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Division by zero

EUVDB-ID: #VU101111

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53122

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the mptcp_rcv_space_adjust() function in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Resource management error

EUVDB-ID: #VU101233

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53125

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the find_equal_scalars() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Buffer overflow

EUVDB-ID: #VU101235

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53126

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the psnet_open_pf_bar() function in drivers/vdpa/solidrun/snet_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Buffer overflow

EUVDB-ID: #VU101231

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53127

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dw_mci_init_slot() function in drivers/mmc/host/dw_mmc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) NULL pointer dereference

EUVDB-ID: #VU101224

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53129

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vop_plane_atomic_async_check() function in drivers/gpu/drm/rockchip/rockchip_drm_vop.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) NULL pointer dereference

EUVDB-ID: #VU101225

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53130

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nilfs_grab_buffer() function in fs/nilfs2/page.c, within the nilfs_mdt_create_block() function in fs/nilfs2/mdt.c, within the nilfs_gccache_submit_read_data() function in fs/nilfs2/gcinode.c, within the nilfs_btnode_create_block() and nilfs_btnode_submit_block() functions in fs/nilfs2/btnode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) NULL pointer dereference

EUVDB-ID: #VU101226

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53131

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __nilfs_get_page_block() function in fs/nilfs2/page.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Use-after-free

EUVDB-ID: #VU101222

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53133

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dc_state_create_copy() function in drivers/gpu/drm/amd/display/dc/core/dc_state.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Input validation error

EUVDB-ID: #VU101236

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53134

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the imx93_blk_ctrl_remove() function in drivers/pmdomain/imx/imx93-blk-ctrl.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper locking

EUVDB-ID: #VU101229

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53136

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the shmem_getattr() function in mm/shmem.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Input validation error

EUVDB-ID: #VU101348

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53141

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bitmap_ip_uadt() function in net/netfilter/ipset/ip_set_bitmap_ip.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use of uninitialized resource

EUVDB-ID: #VU101347

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53142

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the do_name() and do_copy() functions in init/initramfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU101815

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53144

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hci_user_confirm_request_evt() function in net/bluetooth/hci_event.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Integer overflow

EUVDB-ID: #VU101921

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53146

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the decode_cb_compound4res() function in fs/nfsd/nfs4callback.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Buffer overflow

EUVDB-ID: #VU101927

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53148

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the comedi_mmap() function in drivers/comedi/comedi_fops.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Out-of-bounds read

EUVDB-ID: #VU101910

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53150

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the DESC_LENGTH_CHECK(), validate_clock_source() and validate_clock_selector() functions in sound/usb/clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Integer overflow

EUVDB-ID: #VU101922

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53151

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the xdr_check_write_chunk() function in net/sunrpc/xprtrdma/svc_rdma_recvfrom.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) NULL pointer dereference

EUVDB-ID: #VU101913

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53154

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the applnco_probe() function in drivers/clk/clk-apple-nco.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Use of uninitialized resource

EUVDB-ID: #VU101917

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53155

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ocfs2_file_write_iter() and ocfs2_file_read_iter() functions in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Out-of-bounds read

EUVDB-ID: #VU101911

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53156

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the htc_connect_service() function in drivers/net/wireless/ath/ath9k/htc_hst.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) NULL pointer dereference

EUVDB-ID: #VU101914

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53157

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the scpi_dvfs_get_info() function in drivers/firmware/arm_scpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Integer underflow

EUVDB-ID: #VU101924

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53158

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the geni_se_clk_tbl_get() function in drivers/soc/qcom/qcom-geni-se.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Buffer overflow

EUVDB-ID: #VU101925

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53159

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the store_target_temp(), store_temp_tolerance() and store_weight_temp() functions in drivers/hwmon/nct6775-core.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Race condition within a thread

EUVDB-ID: #VU101926

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53160

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

Description

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the krc_count(), schedule_delayed_monitor_work() and kvfree_call_rcu() functions in kernel/rcu/tree.c. A local user can corrupt data.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Integer overflow

EUVDB-ID: #VU101923

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53161

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the bluefield_edac_check() function in drivers/edac/bluefield_edac.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Out-of-bounds read

EUVDB-ID: #VU101912

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53162

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the uof_get_name() function in drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Use-after-free

EUVDB-ID: #VU102048

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53166

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bfq_choose_req(), bfqq_request_over_limit() and bfq_limit_depth() functions in block/bfq-iosched.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Race condition

EUVDB-ID: #VU102220

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53169

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the EXPORT_SYMBOL_GPL() function in drivers/nvme/host/core.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Use-after-free

EUVDB-ID: #VU102059

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53171

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the get_znodes_to_commit() function in fs/ubifs/tnc_commit.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Use-after-free

EUVDB-ID: #VU102058

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53173

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfs4_open_release() function in fs/nfs/nfs4proc.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Use-after-free

EUVDB-ID: #VU102057

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53174

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the c_show() function in net/sunrpc/cache.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Use-after-free

EUVDB-ID: #VU102054

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53179

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smb2_get_sign_key(), smb2_find_smb_ses_unlocked(), smb2_calc_signature() and smb3_calc_signature() functions in fs/smb/client/smb2transport.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Improper Initialization

EUVDB-ID: #VU102222

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53180

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the snd_pcm_mmap_data_fault() function in sound/core/pcm_native.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) NULL pointer dereference

EUVDB-ID: #VU102130

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53188

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ath12k_dp_cc_cleanup() function in drivers/net/wireless/ath/ath12k/dp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Improper locking

EUVDB-ID: #VU102173

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53190

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the efuse_write_1byte() and read_efuse_byte() functions in drivers/net/wireless/realtek/rtlwifi/efuse.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Double free

EUVDB-ID: #VU102194

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53191

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ath12k_dp_free() function in drivers/net/wireless/ath/ath12k/dp.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU102138

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53200

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hwss_setup_dpp() function in drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) NULL pointer dereference

EUVDB-ID: #VU102137

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53201

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dcn20_program_pipe() function in drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Memory leak

EUVDB-ID: #VU102005

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53202

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fw_log_firmware_info() function in drivers/base/firmware_loader/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Use-after-free

EUVDB-ID: #VU102046

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53206

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __inet_csk_reqsk_queue_drop() function in net/ipv4/inet_connection_sock.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Improper locking

EUVDB-ID: #VU102176

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53207

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mgmt_set_discoverable_complete(), mgmt_set_connectable_complete(), set_ssp_complete(), set_name_complete(), set_default_phy_complete(), start_discovery_complete(), stop_discovery_complete() and read_local_oob_ext_data_complete() functions in net/bluetooth/mgmt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Use-after-free

EUVDB-ID: #VU102063

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53208

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mgmt_set_powered_complete() function in net/bluetooth/mgmt.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) NULL pointer dereference

EUVDB-ID: #VU102134

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53209

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the bnxt_set_rx_skb_mode() and bnxt_change_mtu() functions in drivers/net/ethernet/broadcom/bnxt/bnxt.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Memory leak

EUVDB-ID: #VU102004

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53210

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the iucv_sock_recvmsg() function in net/iucv/af_iucv.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Double free

EUVDB-ID: #VU102195

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53213

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the lan78xx_probe() function in drivers/net/usb/lan78xx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Out-of-bounds read

EUVDB-ID: #VU102092

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53214

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vfio_virt_config_read() and vfio_config_do_rw() functions in drivers/vfio/pci/vfio_pci_config.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Improper error handling

EUVDB-ID: #VU102208

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53215

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the svc_rdma_proc_init() function in net/sunrpc/xprtrdma/svc_rdma.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Use-after-free

EUVDB-ID: #VU102356

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53216

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in fs/nfsd/export.c. A local user can execute arbitrary code with elevated privileges.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) NULL pointer dereference

EUVDB-ID: #VU102133

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53217

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfsd4_process_cb_update() function in fs/nfsd/nfs4callback.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) NULL pointer dereference

EUVDB-ID: #VU102129

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53222

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the zram_add() function in drivers/block/zram/zram_drv.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) NULL pointer dereference

EUVDB-ID: #VU102141

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53224

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5_ib_dev_res_init(), mlx5_ib_stage_delay_drop_cleanup(), mlx5_ib_stage_dev_notifier_init() and STAGE_CREATE() functions in drivers/infiniband/hw/mlx5/main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Infinite loop

EUVDB-ID: #VU102217

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53229

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the rxe_requester() function in drivers/infiniband/sw/rxe/rxe_req.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Resource management error

EUVDB-ID: #VU102251

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53234

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the z_erofs_load_compact_lcluster() and z_erofs_get_extent_decompressedlen() functions in fs/erofs/zmap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Use-after-free

EUVDB-ID: #VU102069

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53237

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __match_tty() and hci_conn_del_sysfs() functions in net/bluetooth/hci_sysfs.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) NULL pointer dereference

EUVDB-ID: #VU101818

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-53240

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote backend to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the guest xen-netfront driver. A a malicious network backend can crash the guest OS.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Processor optimization removal or modification of security-critical code

EUVDB-ID: #VU101817

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53241

CWE-ID: CWE-1037 - Processor optimization removal or modification of security-critical code

Exploit availability: No

Description

The vulnerability allows a malicious guest to gain access to sensitive information.

The vulnerability exists due to implemented mitigations for hardware vulnerabilities related to Xen hypercall page implementation the guest OS is relying on to work might not be fully functional, resulting in e.g. guest user processes being able to read data they ought not have access to.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) NULL pointer dereference

EUVDB-ID: #VU102148

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56536

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cw1200_spi_suspend() function in drivers/net/wireless/st/cw1200/cw1200_spi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Buffer overflow

EUVDB-ID: #VU102236

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56539

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drivers/net/wireless/marvell/mwifiex/fw.h. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) NULL pointer dereference

EUVDB-ID: #VU102151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56549

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cachefiles_ondemand_fd_write_iter() and cachefiles_ondemand_fd_llseek() functions in fs/cachefiles/ondemand.c, within the cachefiles_commit_object() and cachefiles_clean_up_object() functions in fs/cachefiles/interface.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Use-after-free

EUVDB-ID: #VU102039

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56551

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the amdgpu_vce_sw_fini() function in drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c, within the amdgpu_device_fini_sw() function in drivers/gpu/drm/amd/amdgpu/amdgpu_device.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Input validation error

EUVDB-ID: #VU102279

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56562

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the i3c_master_put_i3c_addrs() function in drivers/i3c/master.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Improper locking

EUVDB-ID: #VU102170

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56566

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the check_slab(), slab_fix() and alloc_single_from_partial() functions in mm/slub.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Division by zero

EUVDB-ID: #VU102216

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56567

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the ad7780_write_raw() function in drivers/iio/adc/ad7780.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Resource management error

EUVDB-ID: #VU102229

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56576

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tc358743_probe() function in drivers/media/i2c/tc358743.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Use-after-free

EUVDB-ID: #VU102045

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56582

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btrfs_encoded_read_endio() function in fs/btrfs/inode.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) NULL pointer dereference

EUVDB-ID: #VU102108

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56599

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ath10k_sdio_remove() function in drivers/net/wireless/ath/ath10k/sdio.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use-after-free

EUVDB-ID: #VU102019

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56604

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rfcomm_sock_alloc() function in net/bluetooth/rfcomm/sock.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Use-after-free

EUVDB-ID: #VU102020

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56605

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_sock_alloc() function in net/bluetooth/l2cap_sock.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Integer underflow

EUVDB-ID: #VU102210

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56645

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the j1939_session_new() function in net/can/j1939/transport.c. A local user can execute arbitrary code.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) NULL pointer dereference

EUVDB-ID: #VU102121

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56667

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the capture_engine() function in drivers/gpu/drm/i915/i915_gpu_error.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Resource management error

EUVDB-ID: #VU102241

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56752

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the gf100_gr_chan_new() function in drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Input validation error

EUVDB-ID: #VU102273

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the caam_qi_init() function in drivers/crypto/caam/qi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Input validation error

EUVDB-ID: #VU102265

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fs/netfs/fscache_volume.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Use-after-free

EUVDB-ID: #VU102008

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56756

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nvme_free_host_mem(), __nvme_alloc_host_mem() and kfree() functions in drivers/nvme/host/pci.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Improper access control

EUVDB-ID: #VU97651

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-8805

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the implementation of the HID over GATT Profile. A remote attacker on the local network can bypass implemented security restrictions and execute arbitrary code on the target system.

Mitigation

Update the affected package the Linux Kernel to the latest version.

Vulnerable software versions

Public Cloud Module: 15-SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-devel-azure: before 6.4.0-150600.8.23.1

kernel-source-azure: before 6.4.0-150600.8.23.1

kernel-azure-vdso-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-vdso: before 6.4.0-150600.8.23.1

kernel-azure: before 6.4.0-150600.8.23.1

gfs2-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-debuginfo: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-syms-azure: before 6.4.0-150600.8.23.1

kernel-azure-extra: before 6.4.0-150600.8.23.1

dlm-kmp-azure: before 6.4.0-150600.8.23.1

kselftests-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel: before 6.4.0-150600.8.23.1

kernel-azure-debugsource: before 6.4.0-150600.8.23.1

gfs2-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-optional-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-devel-debuginfo: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure: before 6.4.0-150600.8.23.1

reiserfs-kmp-azure: before 6.4.0-150600.8.23.1

kernel-azure-optional: before 6.4.0-150600.8.23.1

dlm-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kselftests-kmp-azure: before 6.4.0-150600.8.23.1

ocfs2-kmp-azure: before 6.4.0-150600.8.23.1

cluster-md-kmp-azure-debuginfo: before 6.4.0-150600.8.23.1

kernel-azure-extra-debuginfo: before 6.4.0-150600.8.23.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2025/suse-su-20250117-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###