# SUSE-SU-2025:01707-1: Security update for 3 packages SUSE-SU-2025:01707-1, released May 26, 2025, fixes 166 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/suse-su-2025-01707-1 - Platform: Linux - Released: May 26, 2025 - Priority: Urgent (Closes CVE-2025-22088, rated Critical) - CVEs: 166, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:01707-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.37.1 | | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.6 | 6.4.0-150600.8.37.1 | | [kernel-source-azure](https://patchblox.com/security/data/product/linux/kernel-source-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.37.1 | | [kernel-source-azure](https://patchblox.com/security/data/product/linux/kernel-source-azure.md) | sles 15.6 | 6.4.0-150600.8.37.1 | | [kernel-syms-azure](https://patchblox.com/security/data/product/linux/kernel-syms-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.37.1 | | [kernel-syms-azure](https://patchblox.com/security/data/product/linux/kernel-syms-azure.md) | sles 15.6 | 6.4.0-150600.8.37.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-22088](https://patchblox.com/security/data/cve/CVE-2025-22088.md) | Urgent | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0055 | | | [CVE-2024-50083](https://patchblox.com/security/data/cve/CVE-2024-50083.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.5 | 0.0087 | | | [CVE-2024-27018](https://patchblox.com/security/data/cve/CVE-2024-27018.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0064 | | | [CVE-2025-21927](https://patchblox.com/security/data/cve/CVE-2025-21927.md) | High | nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() | 8.0 | 0.0062 | | | [CVE-2024-46865](https://patchblox.com/security/data/cve/CVE-2024-46865.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0055 | | | [CVE-2025-37799](https://patchblox.com/security/data/cve/CVE-2025-37799.md) | High | kernel-64kb: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (bsc#1242283). | 9.4 | 0.0037 | | | [CVE-2025-22004](https://patchblox.com/security/data/cve/CVE-2025-22004.md) | High | kernel-64kb: net: atm: fix use after free in lec_send() (bsc#1240835). | 8.6 | 0.0036 | | | [CVE-2025-37785](https://patchblox.com/security/data/cve/CVE-2025-37785.md) | High | kernel-64kb: ext4: fix OOB read when checking dotdot dir (bsc#1241640). | 7.1 | 0.0031 | | | [CVE-2025-23133](https://patchblox.com/security/data/cve/CVE-2025-23133.md) | High | kernel-64kb: wifi: ath11k: update channel list in reg notifier instead reg worker (bsc#1241451). | 7.8 | 0.0031 | | | [CVE-2023-53034](https://patchblox.com/security/data/cve/CVE-2023-53034.md) | High | ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans | 7.5 | 0.0030 | | | [CVE-2025-21863](https://patchblox.com/security/data/cve/CVE-2025-21863.md) | High | kernel-64kb: io_uring: prevent opcode speculation (bsc#1239475). | 7.8 | 0.0027 | | | [CVE-2025-21696](https://patchblox.com/security/data/cve/CVE-2025-21696.md) | High | mm: clear uffd-wp PTE/PMD state on mremap() | 7.8 | 0.0026 | | | [CVE-2025-21969](https://patchblox.com/security/data/cve/CVE-2025-21969.md) | High | Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd | 7.8 | 0.0026 | | | [CVE-2025-22055](https://patchblox.com/security/data/cve/CVE-2025-22055.md) | High | kernel-64kb: net: fix geneve_opt length integer overflow (bsc#1241371). | 7.1 | 0.0026 | | | [CVE-2025-21914](https://patchblox.com/security/data/cve/CVE-2025-21914.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2025-21812](https://patchblox.com/security/data/cve/CVE-2025-21812.md) | High | kernel-64kb: ax25: rcu protect dev->ax25_ptr (bsc#1238471). | 7.8 | 0.0025 | | | [CVE-2025-21853](https://patchblox.com/security/data/cve/CVE-2025-21853.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2025-21934](https://patchblox.com/security/data/cve/CVE-2025-21934.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2025-21926](https://patchblox.com/security/data/cve/CVE-2025-21926.md) | High | kernel-64kb: net: gso: fix ownership in __udp_gso_segment (bsc#1240712). | 7.1 | 0.0024 | | | [CVE-2024-57998](https://patchblox.com/security/data/cve/CVE-2024-57998.md) | High | kernel-azure: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-21905](https://patchblox.com/security/data/cve/CVE-2025-21905.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0024 | | | [CVE-2024-58093](https://patchblox.com/security/data/cve/CVE-2024-58093.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-21729](https://patchblox.com/security/data/cve/CVE-2025-21729.md) | High | kernel-64kb: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874). | 7.8 | 0.0024 | | | [CVE-2025-21928](https://patchblox.com/security/data/cve/CVE-2025-21928.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-22058](https://patchblox.com/security/data/cve/CVE-2025-22058.md) | High | kernel-64kb: udp: Fix memory accounting leak (bsc#1241332). | 7.3 | 0.0024 | | | [CVE-2025-21999](https://patchblox.com/security/data/cve/CVE-2025-21999.md) | High | kernel-64kb: proc: fix UAF in proc_get_inode() (bsc#1240802). | 7.8 | 0.0023 | | | [CVE-2025-21950](https://patchblox.com/security/data/cve/CVE-2025-21950.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0023 | | | [CVE-2025-22104](https://patchblox.com/security/data/cve/CVE-2025-22104.md) | High | kernel-64kb: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550). | 7.1 | 0.0023 | | | [CVE-2025-21806](https://patchblox.com/security/data/cve/CVE-2025-21806.md) | High | kernel-64kb: net: let net.core.dev_weight always be non-zero (bsc#1238746). | 7.8 | 0.0023 | | | [CVE-2025-22097](https://patchblox.com/security/data/cve/CVE-2025-22097.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0023 | | | [CVE-2025-21991](https://patchblox.com/security/data/cve/CVE-2025-21991.md) | High | kernel-64kb: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795). | 7.8 | 0.0023 | | | [CVE-2025-21887](https://patchblox.com/security/data/cve/CVE-2025-21887.md) | High | kernel-64kb: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176). | 7.8 | 0.0022 | | | [CVE-2025-22107](https://patchblox.com/security/data/cve/CVE-2025-22107.md) | High | kernel-64kb: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (bsc#1241575). | 7.1 | 0.0022 | | | [CVE-2025-21993](https://patchblox.com/security/data/cve/CVE-2025-21993.md) | High | kernel-64kb: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797). | 7.1 | 0.0022 | | | [CVE-2025-22121](https://patchblox.com/security/data/cve/CVE-2025-22121.md) | High | ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() | 7.1 | 0.0022 | | | [CVE-2025-22020](https://patchblox.com/security/data/cve/CVE-2025-22020.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0022 | | | [CVE-2025-21979](https://patchblox.com/security/data/cve/CVE-2025-21979.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0022 | | | [CVE-2024-53139](https://patchblox.com/security/data/cve/CVE-2024-53139.md) | High | kernel-64kb: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157). | 7.8 | 0.0021 | | | [CVE-2025-21966](https://patchblox.com/security/data/cve/CVE-2025-21966.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 | | | [CVE-2025-21968](https://patchblox.com/security/data/cve/CVE-2025-21968.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 | | | [CVE-2025-21867](https://patchblox.com/security/data/cve/CVE-2025-21867.md) | High | kernel-64kb: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181). | 7.8 | 0.0021 | | | [CVE-2025-21923](https://patchblox.com/security/data/cve/CVE-2025-21923.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 | | | [CVE-2025-21915](https://patchblox.com/security/data/cve/CVE-2025-21915.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 | | | [CVE-2025-21962](https://patchblox.com/security/data/cve/CVE-2025-21962.md) | High | kernel-64kb: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655). | 7.8 | 0.0021 | | | [CVE-2025-21963](https://patchblox.com/security/data/cve/CVE-2025-21963.md) | High | kernel-64kb: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717). | 7.3 | 0.0021 | | | [CVE-2025-21964](https://patchblox.com/security/data/cve/CVE-2025-21964.md) | High | kernel-64kb: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740). | 7.0 | 0.0021 | | | [CVE-2025-22036](https://patchblox.com/security/data/cve/CVE-2025-22036.md) | High | kernel-64kb: exfat: fix random stack corruption after get_block (bsc#1241426). | 7.0 | 0.0020 | | | [CVE-2025-21985](https://patchblox.com/security/data/cve/CVE-2025-21985.md) | High | drm/amd/display: Fix out-of-bound accesses | 7.1 | 0.0020 | | | [CVE-2024-58068](https://patchblox.com/security/data/cve/CVE-2024-58068.md) | High | kernel-64kb: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961). | 7.8 | 0.0019 | | | [CVE-2024-58088](https://patchblox.com/security/data/cve/CVE-2024-58088.md) | High | kernel-64kb: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). | 7.8 | 0.0018 | | | [CVE-2025-21758](https://patchblox.com/security/data/cve/CVE-2025-21758.md) | Routine | kernel-64kb: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737). | 5.5 | 0.1693 | | | [CVE-2024-46763](https://patchblox.com/security/data/cve/CVE-2024-46763.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0071 | | | [CVE-2025-22025](https://patchblox.com/security/data/cve/CVE-2025-22025.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0059 | | | [CVE-2025-21961](https://patchblox.com/security/data/cve/CVE-2025-21961.md) | Routine | eth: bnxt: fix truesize for mb-xdp-pass case | 5.5 | 0.0059 | | | [CVE-2024-53124](https://patchblox.com/security/data/cve/CVE-2024-53124.md) | Routine | kernel-64kb: net: fix data-races around sk->sk_forward_alloc (bsc#1234074). | 4.7 | 0.0059 | | | [CVE-2025-23145](https://patchblox.com/security/data/cve/CVE-2025-23145.md) | Routine | mptcp: fix NULL pointer in can_accept_new_subflow | 5.5 | 0.0059 | | | [CVE-2025-21707](https://patchblox.com/security/data/cve/CVE-2025-21707.md) | Routine | kernel-64kb: mptcp: consolidate suboption status (bsc#1238862). | 5.5 | 0.0054 | | | [CVE-2025-21960](https://patchblox.com/security/data/cve/CVE-2025-21960.md) | Routine | kernel-64kb: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815). | 5.7 | 0.0053 | | | [CVE-2024-56641](https://patchblox.com/security/data/cve/CVE-2024-56641.md) | Routine | net/smc: initialize close_work early to avoid warning | 5.5 | 0.0053 | | | [CVE-2024-50162](https://patchblox.com/security/data/cve/CVE-2024-50162.md) | Routine | kernel-64kb: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075). | 5.5 | 0.0052 | | | [CVE-2025-22108](https://patchblox.com/security/data/cve/CVE-2025-22108.md) | Routine | bnxt_en: Mask the bd_cnt field in the TX BD properly | 5.5 | 0.0038 | | | [CVE-2024-58096](https://patchblox.com/security/data/cve/CVE-2024-58096.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0032 | | | [CVE-2025-21972](https://patchblox.com/security/data/cve/CVE-2025-21972.md) | Routine | kernel-64kb: net: mctp: unshare packets when reassembling (bsc#1240813). | 5.5 | 0.0032 | | | [CVE-2025-37860](https://patchblox.com/security/data/cve/CVE-2025-37860.md) | Routine | kernel-coco: CVE-2025-22105, Add missing bugzilla references (bsc#1241452 bsc#1241548). | 5.5 | 0.0032 | | | [CVE-2025-22062](https://patchblox.com/security/data/cve/CVE-2025-22062.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-22086](https://patchblox.com/security/data/cve/CVE-2025-22086.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-39728](https://patchblox.com/security/data/cve/CVE-2025-39728.md) | Routine | kernel-64kb: clk: samsung: Fix UBSAN panic in samsung_clk_init() (bsc#1241626). | 5.5 | 0.0028 | | | [CVE-2024-57924](https://patchblox.com/security/data/cve/CVE-2024-57924.md) | Routine | kernel-64kb: fs: relax assertions on failure to encode file handles (bsc#1236086). | 5.5 | 0.0028 | | | [CVE-2025-21917](https://patchblox.com/security/data/cve/CVE-2025-21917.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0027 | | | [CVE-2025-22064](https://patchblox.com/security/data/cve/CVE-2025-22064.md) | Routine | kernel-64kb: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413). | 5.5 | 0.0027 | | | [CVE-2025-22065](https://patchblox.com/security/data/cve/CVE-2025-22065.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0027 | | | [CVE-2025-22109](https://patchblox.com/security/data/cve/CVE-2025-22109.md) | Routine | ax25: Remove broken autobind | 5.5 | 0.0026 | | | [CVE-2025-21875](https://patchblox.com/security/data/cve/CVE-2025-21875.md) | Routine | kernel-64kb: mptcp: always handle address removal under msk socket lock (bsc#1240168). | 5.5 | 0.0026 | | | [CVE-2025-21768](https://patchblox.com/security/data/cve/CVE-2025-21768.md) | Routine | net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels | 5.5 | 0.0025 | | | [CVE-2025-21836](https://patchblox.com/security/data/cve/CVE-2025-21836.md) | Routine | kernel-64kb: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066). | 6.1 | 0.0025 | | | [CVE-2024-27415](https://patchblox.com/security/data/cve/CVE-2024-27415.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0025 | | | [CVE-2024-56702](https://patchblox.com/security/data/cve/CVE-2024-56702.md) | Routine | bpf: Mark raw_tp arguments with PTR_MAYBE_NULL | 5.5 | 0.0025 | | | [CVE-2025-22045](https://patchblox.com/security/data/cve/CVE-2025-22045.md) | Routine | kernel-64kb: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433). | 5.5 | 0.0024 | | | [CVE-2025-21924](https://patchblox.com/security/data/cve/CVE-2025-21924.md) | Routine | kernel-64kb: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720). | 5.5 | 0.0024 | | | [CVE-2025-21792](https://patchblox.com/security/data/cve/CVE-2025-21792.md) | Routine | ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt | 5.5 | 0.0024 | | | [CVE-2025-21925](https://patchblox.com/security/data/cve/CVE-2025-21925.md) | Routine | kernel-64kb: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713). | 5.5 | 0.0024 | | | [CVE-2025-21904](https://patchblox.com/security/data/cve/CVE-2025-21904.md) | Routine | kernel-64kb: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576). | 5.5 | 0.0023 | | | [CVE-2025-21910](https://patchblox.com/security/data/cve/CVE-2025-21910.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21916](https://patchblox.com/security/data/cve/CVE-2025-21916.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21918](https://patchblox.com/security/data/cve/CVE-2025-21918.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21922](https://patchblox.com/security/data/cve/CVE-2025-21922.md) | Routine | kernel-64kb: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639). | 5.5 | 0.0023 | | | [CVE-2025-21935](https://patchblox.com/security/data/cve/CVE-2025-21935.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21948](https://patchblox.com/security/data/cve/CVE-2025-21948.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21956](https://patchblox.com/security/data/cve/CVE-2025-21956.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21957](https://patchblox.com/security/data/cve/CVE-2025-21957.md) | Routine | kernel-64kb: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742). | 5.5 | 0.0023 | | | [CVE-2024-50038](https://patchblox.com/security/data/cve/CVE-2024-50038.md) | Routine | kernel-64kb: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910). | 5.5 | 0.0023 | | | [CVE-2024-58097](https://patchblox.com/security/data/cve/CVE-2024-58097.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21913](https://patchblox.com/security/data/cve/CVE-2025-21913.md) | Routine | kernel-64kb: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591). | 5.5 | 0.0023 | | | [CVE-2024-58001](https://patchblox.com/security/data/cve/CVE-2024-58001.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21936](https://patchblox.com/security/data/cve/CVE-2025-21936.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21937](https://patchblox.com/security/data/cve/CVE-2025-21937.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-22015](https://patchblox.com/security/data/cve/CVE-2025-22015.md) | Routine | kernel-64kb: mm/migrate: fix shmem xarray update during migration (bsc#1240944). | 5.5 | 0.0023 | | | [CVE-2025-22018](https://patchblox.com/security/data/cve/CVE-2025-22018.md) | Routine | kernel-64kb: atm: Fix NULL pointer dereference (bsc#1241266). | 5.5 | 0.0023 | | | [CVE-2025-21941](https://patchblox.com/security/data/cve/CVE-2025-21941.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21971](https://patchblox.com/security/data/cve/CVE-2025-21971.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-23136](https://patchblox.com/security/data/cve/CVE-2025-23136.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2024-58094](https://patchblox.com/security/data/cve/CVE-2024-58094.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21683](https://patchblox.com/security/data/cve/CVE-2025-21683.md) | Routine | kernel-64kb: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704). | 5.5 | 0.0023 | | | [CVE-2025-21906](https://patchblox.com/security/data/cve/CVE-2025-21906.md) | Routine | kernel-64kb: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587). | 5.5 | 0.0023 | | | [CVE-2025-22007](https://patchblox.com/security/data/cve/CVE-2025-22007.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22009](https://patchblox.com/security/data/cve/CVE-2025-22009.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22013](https://patchblox.com/security/data/cve/CVE-2025-22013.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-21881](https://patchblox.com/security/data/cve/CVE-2025-21881.md) | Routine | uprobes: Reject the shared zeropage in uprobe_write_opcode() | 5.5 | 0.0022 | | | [CVE-2025-22080](https://patchblox.com/security/data/cve/CVE-2025-22080.md) | Routine | kernel-64kb: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416). | 5.5 | 0.0022 | | | [CVE-2025-22044](https://patchblox.com/security/data/cve/CVE-2025-22044.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2024-35840](https://patchblox.com/security/data/cve/CVE-2024-35840.md) | Routine | kernel-64kb: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597). | 5.5 | 0.0022 | | | [CVE-2025-22075](https://patchblox.com/security/data/cve/CVE-2025-22075.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.1 | 0.0022 | | | [CVE-2025-21884](https://patchblox.com/security/data/cve/CVE-2025-21884.md) | Routine | kernel-64kb: net: better track kernel sockets lifetime (bsc#1240171). | 5.5 | 0.0022 | | | [CVE-2025-21970](https://patchblox.com/security/data/cve/CVE-2025-21970.md) | Routine | kernel-64kb: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819). | 5.5 | 0.0022 | | | [CVE-2025-21996](https://patchblox.com/security/data/cve/CVE-2025-21996.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22102](https://patchblox.com/security/data/cve/CVE-2025-22102.md) | Routine | kernel-64kb: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456). | 5.5 | 0.0022 | | | [CVE-2024-50163](https://patchblox.com/security/data/cve/CVE-2024-50163.md) | Routine | kernel-64kb: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098). | 5.5 | 0.0022 | | | [CVE-2025-21852](https://patchblox.com/security/data/cve/CVE-2025-21852.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-22008](https://patchblox.com/security/data/cve/CVE-2025-22008.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-21833](https://patchblox.com/security/data/cve/CVE-2025-21833.md) | Routine | iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE | 5.5 | 0.0022 | | | [CVE-2025-23138](https://patchblox.com/security/data/cve/CVE-2025-23138.md) | Routine | kernel-64kb: watch_queue: fix pipe accounting mismatch (bsc#1241648). | 5.5 | 0.0022 | | | [CVE-2025-21980](https://patchblox.com/security/data/cve/CVE-2025-21980.md) | Routine | kernel-64kb: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809). | 5.5 | 0.0021 | | | [CVE-2025-2312](https://patchblox.com/security/data/cve/CVE-2025-2312.md) | Routine | cifs-utils: Fixed cifs.upcall making an upcall to the wrong | 5.9 | 0.0021 | | | [CVE-2025-21894](https://patchblox.com/security/data/cve/CVE-2025-21894.md) | Routine | kernel-64kb: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581). | 5.5 | 0.0021 | | | [CVE-2025-21930](https://patchblox.com/security/data/cve/CVE-2025-21930.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-21975](https://patchblox.com/security/data/cve/CVE-2025-21975.md) | Routine | kernel-64kb: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812). | 5.5 | 0.0021 | | | [CVE-2025-21981](https://patchblox.com/security/data/cve/CVE-2025-21981.md) | Routine | kernel-64kb: ice: fix memory leak in aRFS after reset (bsc#1240612). | 5.5 | 0.0021 | | | [CVE-2025-22017](https://patchblox.com/security/data/cve/CVE-2025-22017.md) | Routine | kernel-64kb: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936). | 5.5 | 0.0021 | | | [CVE-2024-58095](https://patchblox.com/security/data/cve/CVE-2024-58095.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22033](https://patchblox.com/security/data/cve/CVE-2025-22033.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22093](https://patchblox.com/security/data/cve/CVE-2025-22093.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22105](https://patchblox.com/security/data/cve/CVE-2025-22105.md) | Routine | kernel-64kb: CVE-2025-37860: Add missing bugzilla references (bsc#1241452 bsc#1241548). | 5.5 | 0.0021 | | | [CVE-2025-21873](https://patchblox.com/security/data/cve/CVE-2025-21873.md) | Routine | kernel-64kb: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184). | 5.5 | 0.0021 | | | [CVE-2025-21992](https://patchblox.com/security/data/cve/CVE-2025-21992.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22106](https://patchblox.com/security/data/cve/CVE-2025-22106.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22116](https://patchblox.com/security/data/cve/CVE-2025-22116.md) | Routine | kernel-azure: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-21889](https://patchblox.com/security/data/cve/CVE-2025-21889.md) | Routine | kernel-64kb: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167). | 5.5 | 0.0021 | | | [CVE-2025-22016](https://patchblox.com/security/data/cve/CVE-2025-22016.md) | Routine | kernel-64kb: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934). | 5.5 | 0.0021 | | | [CVE-2025-21808](https://patchblox.com/security/data/cve/CVE-2025-21808.md) | Routine | kernel-64kb: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742). | 5.5 | 0.0020 | | | [CVE-2025-22050](https://patchblox.com/security/data/cve/CVE-2025-22050.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 | | | [CVE-2025-22001](https://patchblox.com/security/data/cve/CVE-2025-22001.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 | | | [CVE-2025-22003](https://patchblox.com/security/data/cve/CVE-2025-22003.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 | | | [CVE-2025-23131](https://patchblox.com/security/data/cve/CVE-2025-23131.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 | | | [CVE-2025-21978](https://patchblox.com/security/data/cve/CVE-2025-21978.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-21995](https://patchblox.com/security/data/cve/CVE-2025-21995.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.1 | 0.0019 | | | [CVE-2024-58018](https://patchblox.com/security/data/cve/CVE-2024-58018.md) | Routine | kernel-64kb: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990). | 5.5 | 0.0019 | | | [CVE-2025-23129](https://patchblox.com/security/data/cve/CVE-2025-23129.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-22128](https://patchblox.com/security/data/cve/CVE-2025-22128.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-22010](https://patchblox.com/security/data/cve/CVE-2025-22010.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-22014](https://patchblox.com/security/data/cve/CVE-2025-22014.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-22115](https://patchblox.com/security/data/cve/CVE-2025-22115.md) | Routine | btrfs: fix block group refcount race in btrfs_create_pending_block_groups() | 5.5 | 0.0018 | | | [CVE-2025-21912](https://patchblox.com/security/data/cve/CVE-2025-21912.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 | | | [CVE-2025-21909](https://patchblox.com/security/data/cve/CVE-2025-21909.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 | | | [CVE-2024-58071](https://patchblox.com/security/data/cve/CVE-2024-58071.md) | Routine | kernel-64kb: team: prevent adding a device which is already a team device lower (bsc#1238970). | 5.5 | 0.0018 | | | [CVE-2025-21953](https://patchblox.com/security/data/cve/CVE-2025-21953.md) | Routine | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0018 | | | [CVE-2025-21908](https://patchblox.com/security/data/cve/CVE-2025-21908.md) | Routine | kernel-64kb: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600). | 5.5 | 0.0017 | | | [CVE-2025-21943](https://patchblox.com/security/data/cve/CVE-2025-21943.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0017 | | | [CVE-2025-21951](https://patchblox.com/security/data/cve/CVE-2025-21951.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 | | | [CVE-2025-22027](https://patchblox.com/security/data/cve/CVE-2025-22027.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0017 | | | [CVE-2025-22060](https://patchblox.com/security/data/cve/CVE-2025-22060.md) | Routine | kernel-64kb: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526). | 5.5 | 0.0016 | | | [CVE-2025-21931](https://patchblox.com/security/data/cve/CVE-2025-21931.md) | Routine | kernel-64kb: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709). | 5.5 | 0.0016 | | | [CVE-2025-22053](https://patchblox.com/security/data/cve/CVE-2025-22053.md) | Routine | kernel-64kb: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373). | 5.5 | 0.0016 | | | [CVE-2024-58070](https://patchblox.com/security/data/cve/CVE-2024-58070.md) | Routine | kernel-64kb: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983). | 5.5 | 0.0015 | | | [CVE-2025-21895](https://patchblox.com/security/data/cve/CVE-2025-21895.md) | Routine | kernel-64kb: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585). | 4.7 | 0.0015 | | | [CVE-2025-21755](https://patchblox.com/security/data/cve/CVE-2025-21755.md) | Routine | linux: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | n/a | n/a | | | [CVE-2025-22029](https://patchblox.com/security/data/cve/CVE-2025-22029.md) | Routine | kernel-64kb: exec: fix the racy usage of fs_struct->in_exec (bsc#1241378). | n/a | n/a | | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.