# SUSE-SU-2025:02000-1: Security update for 13 packages SUSE-SU-2025:02000-1, released June 18, 2025, fixes 171 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2025-02000-1 - Platform: Linux - Released: Jun 18, 2025 - Priority: High (Closes CVE-2025-37928, high severity) - CVEs: 171, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:02000-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [dtb-aarch64](https://patchblox.com/security/data/product/linux/dtb-aarch64.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-debug](https://patchblox.com/security/data/product/linux/kernel-debug.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1.150600.12.24.1 | | [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.6 | 6.4.0-150600.23.53.1.150600.12.24.1 | | [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-kvmsmall](https://patchblox.com/security/data/product/linux/kernel-kvmsmall.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-livepatch-SLE15-SP6_Update_12](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-update-12.md) | sles 15.6 | 1-150600.13.3.1 | | [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-obs-qa](https://patchblox.com/security/data/product/linux/kernel-obs-qa.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.6 | 6.4.0-150600.23.53.1 | | [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | opensuse-leap 15.6 | 6.4.0-150600.23.53.1 | | [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | sles 15.6 | 6.4.0-150600.23.53.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-37928](https://patchblox.com/security/data/cve/CVE-2025-37928.md) | High | dm-bufio: don't schedule in atomic context | 7.8 | 0.0074 | | | [CVE-2025-37879](https://patchblox.com/security/data/cve/CVE-2025-37879.md) | High | 9p/net: fix improper handling of bogus negative read/write replies | 7.1 | 0.0073 | | | [CVE-2025-37750](https://patchblox.com/security/data/cve/CVE-2025-37750.md) | High | smb: client: fix UAF in decryption with multichannel | 7.8 | 0.0050 | | | [CVE-2024-50106](https://patchblox.com/security/data/cve/CVE-2024-50106.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0050 | | | [CVE-2024-28956](https://patchblox.com/security/data/cve/CVE-2024-28956.md) | High | kernel-64kb: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006). | 7.8 | 0.0043 | | | [CVE-2025-37749](https://patchblox.com/security/data/cve/CVE-2025-37749.md) | High | net: ppp: Add bound checking for skb data on ppp_sync_txmung | 7.8 | 0.0041 | | | [CVE-2025-37954](https://patchblox.com/security/data/cve/CVE-2025-37954.md) | High | smb: client: Avoid race in open_cached_dir with lease breaks | 7.0 | 0.0037 | | | [CVE-2025-37839](https://patchblox.com/security/data/cve/CVE-2025-37839.md) | High | jbd2: remove wrong sb->s_sequence check | 7.8 | 0.0033 | | | [CVE-2024-58099](https://patchblox.com/security/data/cve/CVE-2024-58099.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0033 | | | [CVE-2025-37840](https://patchblox.com/security/data/cve/CVE-2025-37840.md) | High | mtd: rawnand: brcmnand: fix PM resume warning | 7.8 | 0.0033 | | | [CVE-2025-22056](https://patchblox.com/security/data/cve/CVE-2025-22056.md) | High | kernel-64kb: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525). | 7.8 | 0.0033 | | | [CVE-2025-37858](https://patchblox.com/security/data/cve/CVE-2025-37858.md) | High | fs/jfs: Prevent integer overflow in AG size calculation | 7.8 | 0.0031 | | | [CVE-2025-22063](https://patchblox.com/security/data/cve/CVE-2025-22063.md) | High | kernel-64kb: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351). | 7.8 | 0.0030 | | | [CVE-2024-46713](https://patchblox.com/security/data/cve/CVE-2024-46713.md) | High | kernel-64kb: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581). | 7.8 | 0.0030 | | | [CVE-2025-39735](https://patchblox.com/security/data/cve/CVE-2025-39735.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0030 | | | [CVE-2025-21702](https://patchblox.com/security/data/cve/CVE-2025-21702.md) | High | kernel-64kb: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312). | 7.8 | 0.0028 | | | [CVE-2025-37849](https://patchblox.com/security/data/cve/CVE-2025-37849.md) | High | KVM: arm64: Tear down vGIC on failed vCPU creation | 7.8 | 0.0027 | | | [CVE-2025-21787](https://patchblox.com/security/data/cve/CVE-2025-21787.md) | High | kernel-64kb: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774). | 7.8 | 0.0027 | | | [CVE-2025-37854](https://patchblox.com/security/data/cve/CVE-2025-37854.md) | High | drm/amdkfd: Fix mode1 reset crash issue | 7.8 | 0.0027 | | | [CVE-2025-37943](https://patchblox.com/security/data/cve/CVE-2025-37943.md) | High | wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi | 8.0 | 0.0026 | | | [CVE-2025-37944](https://patchblox.com/security/data/cve/CVE-2025-37944.md) | High | wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process | 7.8 | 0.0026 | | | [CVE-2024-54458](https://patchblox.com/security/data/cve/CVE-2024-54458.md) | High | kernel-64kb: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992). | 7.8 | 0.0026 | | | [CVE-2025-37803](https://patchblox.com/security/data/cve/CVE-2025-37803.md) | High | udmabuf: fix a buf size overflow issue during udmabuf creation | 7.8 | 0.0025 | | | [CVE-2025-37810](https://patchblox.com/security/data/cve/CVE-2025-37810.md) | High | usb: dwc3: gadget: check that event count does not exceed event buffer length | 7.8 | 0.0025 | | | [CVE-2025-37891](https://patchblox.com/security/data/cve/CVE-2025-37891.md) | High | ALSA: ump: Fix buffer overflow at UMP SysEx message conversion | 7.8 | 0.0025 | | | [CVE-2025-40014](https://patchblox.com/security/data/cve/CVE-2025-40014.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2024-53135](https://patchblox.com/security/data/cve/CVE-2024-53135.md) | High | kernel-64kb: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154). | 7.8 | 0.0024 | | | [CVE-2025-37911](https://patchblox.com/security/data/cve/CVE-2025-37911.md) | High | bnxt_en: Fix out-of-bound memcpy() during ethtool -w | 7.0 | 0.0024 | | | [CVE-2025-21919](https://patchblox.com/security/data/cve/CVE-2025-21919.md) | High | kernel-64kb: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593). | 7.8 | 0.0024 | | | [CVE-2025-37913](https://patchblox.com/security/data/cve/CVE-2025-37913.md) | High | net_sched: qfq: Fix double list add in class with netem as child qdisc | 7.8 | 0.0024 | | | [CVE-2025-23150](https://patchblox.com/security/data/cve/CVE-2025-23150.md) | High | ext4: fix off-by-one error in do_split | 8.4 | 0.0023 | | | [CVE-2025-37914](https://patchblox.com/security/data/cve/CVE-2025-37914.md) | High | net_sched: ets: Fix double list add in class with netem as child qdisc | 7.8 | 0.0023 | | | [CVE-2025-37823](https://patchblox.com/security/data/cve/CVE-2025-37823.md) | High | net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too | 7.8 | 0.0023 | | | [CVE-2025-37930](https://patchblox.com/security/data/cve/CVE-2025-37930.md) | High | drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() | 7.0 | 0.0023 | | | [CVE-2025-37798](https://patchblox.com/security/data/cve/CVE-2025-37798.md) | High | codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() | 7.8 | 0.0023 | | | [CVE-2025-37958](https://patchblox.com/security/data/cve/CVE-2025-37958.md) | High | mm/huge_memory: fix dereferencing invalid pmd migration entry | 7.1 | 0.0023 | | | [CVE-2025-23142](https://patchblox.com/security/data/cve/CVE-2025-23142.md) | High | sctp: detect and prevent references to a freed transport in sendmsg | 7.8 | 0.0023 | | | [CVE-2025-37797](https://patchblox.com/security/data/cve/CVE-2025-37797.md) | High | net_sched: hfsc: Fix a UAF vulnerability in class handling | 7.8 | 0.0023 | | | [CVE-2025-37819](https://patchblox.com/security/data/cve/CVE-2025-37819.md) | High | irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() | 7.8 | 0.0023 | | | [CVE-2025-37915](https://patchblox.com/security/data/cve/CVE-2025-37915.md) | High | net_sched: drr: Fix double list add in class with netem as child qdisc | 7.0 | 0.0023 | | | [CVE-2025-23158](https://patchblox.com/security/data/cve/CVE-2025-23158.md) | High | media: venus: hfi: add check to handle incorrect queue size | 7.8 | 0.0022 | | | [CVE-2025-23156](https://patchblox.com/security/data/cve/CVE-2025-23156.md) | High | media: venus: hfi_parser: refactor hfi packet parsing logic | 7.1 | 0.0022 | | | [CVE-2025-23157](https://patchblox.com/security/data/cve/CVE-2025-23157.md) | High | media: venus: hfi_parser: add check to avoid out of bound access | 7.1 | 0.0022 | | | [CVE-2025-37963](https://patchblox.com/security/data/cve/CVE-2025-37963.md) | High | arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users | 7.0 | 0.0022 | | | [CVE-2025-37789](https://patchblox.com/security/data/cve/CVE-2025-37789.md) | High | net: openvswitch: fix nested key length validation in the set() action | 7.8 | 0.0022 | | | [CVE-2025-37890](https://patchblox.com/security/data/cve/CVE-2025-37890.md) | High | net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc | 7.8 | 0.0022 | | | [CVE-2025-37979](https://patchblox.com/security/data/cve/CVE-2025-37979.md) | High | ASoC: qcom: Fix sc7280 lpass potential buffer overflow | 7.8 | 0.0022 | | | [CVE-2025-21648](https://patchblox.com/security/data/cve/CVE-2025-21648.md) | High | kernel-64kb: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142). | 7.8 | 0.0022 | | | [CVE-2025-37780](https://patchblox.com/security/data/cve/CVE-2025-37780.md) | High | isofs: Prevent the use of too small fid | 7.1 | 0.0022 | | | [CVE-2025-37901](https://patchblox.com/security/data/cve/CVE-2025-37901.md) | High | irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs | 7.0 | 0.0021 | | | [CVE-2025-37948](https://patchblox.com/security/data/cve/CVE-2025-37948.md) | High | arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs | 7.0 | 0.0021 | | | [CVE-2025-37905](https://patchblox.com/security/data/cve/CVE-2025-37905.md) | High | firmware: arm_scmi: Balance device refcount when destroying devices | 7.0 | 0.0021 | | | [CVE-2025-37892](https://patchblox.com/security/data/cve/CVE-2025-37892.md) | High | mtd: inftlcore: Add error check for inftl_read_oob() | 7.8 | 0.0021 | | | [CVE-2025-37903](https://patchblox.com/security/data/cve/CVE-2025-37903.md) | High | drm/amd/display: Fix slab-use-after-free in hdcp | 7.8 | 0.0021 | | | [CVE-2025-37897](https://patchblox.com/security/data/cve/CVE-2025-37897.md) | High | wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release | 7.0 | 0.0020 | | | [CVE-2025-37929](https://patchblox.com/security/data/cve/CVE-2025-37929.md) | High | kernel-zfcpdump: Security update for the Linux Kernel | 7.0 | 0.0020 | | | [CVE-2025-22126](https://patchblox.com/security/data/cve/CVE-2025-22126.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0020 | | | [CVE-2025-37796](https://patchblox.com/security/data/cve/CVE-2025-37796.md) | High | wifi: at76c50x: fix use after free access in at76_disconnect | 7.8 | 0.0020 | | | [CVE-2025-37900](https://patchblox.com/security/data/cve/CVE-2025-37900.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0020 | | | [CVE-2025-37989](https://patchblox.com/security/data/cve/CVE-2025-37989.md) | High | net: phy: leds: fix memory leak | 7.0 | 0.0020 | | | [CVE-2025-37953](https://patchblox.com/security/data/cve/CVE-2025-37953.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0019 | | | [CVE-2025-37982](https://patchblox.com/security/data/cve/CVE-2025-37982.md) | High | wifi: wl1251: fix memory leak in wl1251_tx_work | 7.0 | 0.0019 | | | [CVE-2025-37957](https://patchblox.com/security/data/cve/CVE-2025-37957.md) | High | KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception | 7.8 | 0.0019 | | | [CVE-2025-37972](https://patchblox.com/security/data/cve/CVE-2025-37972.md) | High | Input: mtk-pmic-keys - fix possible null pointer dereference | 7.0 | 0.0019 | | | [CVE-2025-37951](https://patchblox.com/security/data/cve/CVE-2025-37951.md) | High | drm/v3d: Add job to pending list if the reset was skipped | 7.0 | 0.0019 | | | [CVE-2025-37831](https://patchblox.com/security/data/cve/CVE-2025-37831.md) | High | cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() | 7.0 | 0.0019 | | | [CVE-2025-37833](https://patchblox.com/security/data/cve/CVE-2025-37833.md) | High | net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads | 7.0 | 0.0019 | | | [CVE-2025-37960](https://patchblox.com/security/data/cve/CVE-2025-37960.md) | High | memblock: Accept allocated memory before use in memblock_double_array() | 7.0 | 0.0019 | | | [CVE-2025-37969](https://patchblox.com/security/data/cve/CVE-2025-37969.md) | High | iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo | 7.0 | 0.0018 | | | [CVE-2025-37970](https://patchblox.com/security/data/cve/CVE-2025-37970.md) | High | iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo | 7.0 | 0.0018 | | | [CVE-2025-37871](https://patchblox.com/security/data/cve/CVE-2025-37871.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0079 | | | [CVE-2025-22021](https://patchblox.com/security/data/cve/CVE-2025-22021.md) | Routine | kernel-64kb: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282). | 5.5 | 0.0048 | | | [CVE-2025-21629](https://patchblox.com/security/data/cve/CVE-2025-21629.md) | Routine | net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets | 5.5 | 0.0043 | | | [CVE-2025-37820](https://patchblox.com/security/data/cve/CVE-2025-37820.md) | Routine | xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() | 5.5 | 0.0040 | | | [CVE-2025-37959](https://patchblox.com/security/data/cve/CVE-2025-37959.md) | Routine | bpf: Scrub packet on bpf_redirect_peer | 5.5 | 0.0038 | | | [CVE-2025-37755](https://patchblox.com/security/data/cve/CVE-2025-37755.md) | Routine | net: libwx: handle page_pool_dev_alloc_pages error | 5.5 | 0.0038 | | | [CVE-2025-38637](https://patchblox.com/security/data/cve/CVE-2025-38637.md) | Routine | kernel-64kb: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657). | 5.5 | 0.0033 | | | [CVE-2025-37836](https://patchblox.com/security/data/cve/CVE-2025-37836.md) | Routine | PCI: Fix reference leak in pci_register_host_bridge() | 5.5 | 0.0031 | | | [CVE-2025-37881](https://patchblox.com/security/data/cve/CVE-2025-37881.md) | Routine | usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() | 5.5 | 0.0031 | | | [CVE-2025-37870](https://patchblox.com/security/data/cve/CVE-2025-37870.md) | Routine | drm/amd/display: prevent hang on link training fail | 5.5 | 0.0031 | | | [CVE-2025-37867](https://patchblox.com/security/data/cve/CVE-2025-37867.md) | Routine | RDMA/core: Silence oversized kvmalloc() warning | 5.5 | 0.0031 | | | [CVE-2025-37886](https://patchblox.com/security/data/cve/CVE-2025-37886.md) | Routine | pds_core: make wait_context part of q_info | 5.5 | 0.0030 | | | [CVE-2025-37841](https://patchblox.com/security/data/cve/CVE-2025-37841.md) | Routine | pm: cpupower: bench: Prevent NULL dereference on malloc failure | 5.5 | 0.0030 | | | [CVE-2025-37850](https://patchblox.com/security/data/cve/CVE-2025-37850.md) | Routine | kernel-livepatch-SLE15-SP7_Update_2: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-37851](https://patchblox.com/security/data/cve/CVE-2025-37851.md) | Routine | fbdev: omapfb: Add 'plane' value check | 5.5 | 0.0030 | | | [CVE-2025-37925](https://patchblox.com/security/data/cve/CVE-2025-37925.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-37889](https://patchblox.com/security/data/cve/CVE-2025-37889.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0029 | | | [CVE-2025-37887](https://patchblox.com/security/data/cve/CVE-2025-37887.md) | Routine | pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result | 5.5 | 0.0029 | | | [CVE-2025-37875](https://patchblox.com/security/data/cve/CVE-2025-37875.md) | Routine | igc: fix PTM cycle trigger logic | 5.5 | 0.0029 | | | [CVE-2025-40325](https://patchblox.com/security/data/cve/CVE-2025-40325.md) | Routine | md/raid10: wait barrier before returning discard request with REQ_NOWAIT | 5.5 | 0.0028 | | | [CVE-2025-37842](https://patchblox.com/security/data/cve/CVE-2025-37842.md) | Routine | spi: fsl-qspi: use devm function instead of driver remove | 5.5 | 0.0028 | | | [CVE-2025-37852](https://patchblox.com/security/data/cve/CVE-2025-37852.md) | Routine | drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() | 5.5 | 0.0028 | | | [CVE-2025-37853](https://patchblox.com/security/data/cve/CVE-2025-37853.md) | Routine | drm/amdkfd: debugfs hang_hws skip GPU with MES | 5.5 | 0.0028 | | | [CVE-2025-37873](https://patchblox.com/security/data/cve/CVE-2025-37873.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0028 | | | [CVE-2025-38152](https://patchblox.com/security/data/cve/CVE-2025-38152.md) | Routine | kernel-64kb: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627). | 5.5 | 0.0027 | | | [CVE-2025-21814](https://patchblox.com/security/data/cve/CVE-2025-21814.md) | Routine | kernel-64kb: ptp: Ensure info->enable callback is always set (bsc#1238473). | 5.5 | 0.0026 | | | [CVE-2025-38240](https://patchblox.com/security/data/cve/CVE-2025-38240.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0026 | | | [CVE-2025-37747](https://patchblox.com/security/data/cve/CVE-2025-37747.md) | Routine | perf: Fix hang while freeing sigtrap event | 5.5 | 0.0025 | | | [CVE-2025-37918](https://patchblox.com/security/data/cve/CVE-2025-37918.md) | Routine | Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() | 5.5 | 0.0025 | | | [CVE-2025-22070](https://patchblox.com/security/data/cve/CVE-2025-22070.md) | Routine | kernel-64kb: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305). | 5.5 | 0.0025 | | | [CVE-2025-37790](https://patchblox.com/security/data/cve/CVE-2025-37790.md) | Routine | net: mctp: Set SOCK_RCU_FREE | 5.5 | 0.0024 | | | [CVE-2025-37937](https://patchblox.com/security/data/cve/CVE-2025-37937.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2025-37949](https://patchblox.com/security/data/cve/CVE-2025-37949.md) | Routine | kernel-64kb: xenbus: Use kref to track req lifetime (bsc#1243541). | 5.5 | 0.0024 | | | [CVE-2025-37932](https://patchblox.com/security/data/cve/CVE-2025-37932.md) | Routine | sch_htb: make htb_qlen_notify() idempotent | 5.5 | 0.0024 | | | [CVE-2024-50223](https://patchblox.com/security/data/cve/CVE-2024-50223.md) | Routine | kernel-64kb: sched/numa: Fix the potential null pointer dereference in (bsc#1233192). | 5.5 | 0.0024 | | | [CVE-2025-37990](https://patchblox.com/security/data/cve/CVE-2025-37990.md) | Routine | wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() | 5.5 | 0.0024 | | | [CVE-2025-23159](https://patchblox.com/security/data/cve/CVE-2025-23159.md) | Routine | media: venus: hfi: add a check to handle OOB in sfr region | 5.5 | 0.0023 | | | [CVE-2025-37912](https://patchblox.com/security/data/cve/CVE-2025-37912.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-37765](https://patchblox.com/security/data/cve/CVE-2025-37765.md) | Routine | drm/nouveau: prime: fix ttm_bo_delayed_delete oops | 5.5 | 0.0022 | | | [CVE-2025-23140](https://patchblox.com/security/data/cve/CVE-2025-23140.md) | Routine | misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error | 5.5 | 0.0022 | | | [CVE-2025-23144](https://patchblox.com/security/data/cve/CVE-2025-23144.md) | Routine | backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() | 5.5 | 0.0022 | | | [CVE-2025-22057](https://patchblox.com/security/data/cve/CVE-2025-22057.md) | Routine | net: decrease cached dst counters in dst_release | 6.6 | 0.0022 | | | [CVE-2025-22005](https://patchblox.com/security/data/cve/CVE-2025-22005.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.1 | 0.0022 | | | [CVE-2025-22089](https://patchblox.com/security/data/cve/CVE-2025-22089.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-37931](https://patchblox.com/security/data/cve/CVE-2025-37931.md) | Routine | btrfs: adjust subpage bit start based on sectorsize | 5.5 | 0.0022 | | | [CVE-2025-23146](https://patchblox.com/security/data/cve/CVE-2025-23146.md) | Routine | mfd: ene-kb3930: Fix a potential NULL pointer dereference | 5.5 | 0.0022 | | | [CVE-2025-23160](https://patchblox.com/security/data/cve/CVE-2025-23160.md) | Routine | kernel-64kb: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507). | 5.5 | 0.0022 | | | [CVE-2025-23141](https://patchblox.com/security/data/cve/CVE-2025-23141.md) | Routine | KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses | 6.1 | 0.0021 | | | [CVE-2025-22066](https://patchblox.com/security/data/cve/CVE-2025-22066.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-22095](https://patchblox.com/security/data/cve/CVE-2025-22095.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-23147](https://patchblox.com/security/data/cve/CVE-2025-23147.md) | Routine | i3c: Add NULL pointer check in i3c_master_queue_ibi() | 5.5 | 0.0021 | | | [CVE-2025-23148](https://patchblox.com/security/data/cve/CVE-2025-23148.md) | Routine | soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() | 5.5 | 0.0021 | | | [CVE-2025-37766](https://patchblox.com/security/data/cve/CVE-2025-37766.md) | Routine | drm/amd/pm: Prevent division by zero | 5.5 | 0.0021 | | | [CVE-2024-43869](https://patchblox.com/security/data/cve/CVE-2024-43869.md) | Routine | kernel-64k: kernel: perf: Fix event leak upon exec and file release | 6.1 | 0.0021 | | | [CVE-2025-37754](https://patchblox.com/security/data/cve/CVE-2025-37754.md) | Routine | drm/i915/huc: Fix fence not released on early probe errors | 5.5 | 0.0021 | | | [CVE-2025-37824](https://patchblox.com/security/data/cve/CVE-2025-37824.md) | Routine | tipc: fix NULL pointer dereference in tipc_mon_reinit_self() | 5.5 | 0.0021 | | | [CVE-2025-37829](https://patchblox.com/security/data/cve/CVE-2025-37829.md) | Routine | cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() | 5.5 | 0.0021 | | | [CVE-2025-22103](https://patchblox.com/security/data/cve/CVE-2025-22103.md) | Routine | kernel-64kb: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448). | 5.5 | 0.0021 | | | [CVE-2025-37768](https://patchblox.com/security/data/cve/CVE-2025-37768.md) | Routine | drm/amd/pm: Prevent division by zero | 5.5 | 0.0021 | | | [CVE-2025-37770](https://patchblox.com/security/data/cve/CVE-2025-37770.md) | Routine | drm/amd/pm: Prevent division by zero | 5.5 | 0.0021 | | | [CVE-2025-37781](https://patchblox.com/security/data/cve/CVE-2025-37781.md) | Routine | i2c: cros-ec-tunnel: defer probe if parent EC is not present | 5.5 | 0.0021 | | | [CVE-2025-37767](https://patchblox.com/security/data/cve/CVE-2025-37767.md) | Routine | drm/amd/pm: Prevent division by zero | 5.5 | 0.0020 | | | [CVE-2025-37771](https://patchblox.com/security/data/cve/CVE-2025-37771.md) | Routine | drm/amd/pm: Prevent division by zero | 5.5 | 0.0020 | | | [CVE-2025-37805](https://patchblox.com/security/data/cve/CVE-2025-37805.md) | Routine | sound/virtio: Fix cancel_sync warnings on uninitialized work_structs | 5.5 | 0.0020 | | | [CVE-2025-37809](https://patchblox.com/security/data/cve/CVE-2025-37809.md) | Routine | kernel-64kb: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856). | 5.5 | 0.0020 | | | [CVE-2025-23149](https://patchblox.com/security/data/cve/CVE-2025-23149.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 6.0 | 0.0020 | | | [CVE-2025-22030](https://patchblox.com/security/data/cve/CVE-2025-22030.md) | Routine | kernel-64kb: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376). | 5.5 | 0.0020 | | | [CVE-2025-22124](https://patchblox.com/security/data/cve/CVE-2025-22124.md) | Routine | md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb | 6.0 | 0.0020 | | | [CVE-2025-37769](https://patchblox.com/security/data/cve/CVE-2025-37769.md) | Routine | drm/amd/pm/smu11: Prevent division by zero | 5.5 | 0.0020 | | | [CVE-2025-37772](https://patchblox.com/security/data/cve/CVE-2025-37772.md) | Routine | RDMA/cma: Fix workqueue crash in cma_netevent_work_handler | 5.5 | 0.0020 | | | [CVE-2025-37788](https://patchblox.com/security/data/cve/CVE-2025-37788.md) | Routine | cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path | 5.5 | 0.0020 | | | [CVE-2025-37740](https://patchblox.com/security/data/cve/CVE-2025-37740.md) | Routine | jfs: add sanity check for agwidth in dbMount | 5.5 | 0.0020 | | | [CVE-2025-37758](https://patchblox.com/security/data/cve/CVE-2025-37758.md) | Routine | ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() | 5.5 | 0.0020 | | | [CVE-2025-37773](https://patchblox.com/security/data/cve/CVE-2025-37773.md) | Routine | virtiofs: add filesystem context source name check | 5.5 | 0.0020 | | | [CVE-2025-37792](https://patchblox.com/security/data/cve/CVE-2025-37792.md) | Routine | Bluetooth: btrtl: Prevent potential NULL dereference | 5.5 | 0.0020 | | | [CVE-2025-37794](https://patchblox.com/security/data/cve/CVE-2025-37794.md) | Routine | wifi: mac80211: Purge vif txq in ieee80211_do_stop() | 5.5 | 0.0020 | | | [CVE-2024-58100](https://patchblox.com/security/data/cve/CVE-2024-58100.md) | Routine | bpf: check changes_pkt_data property for extension programs | 6.0 | 0.0020 | | | [CVE-2024-58098](https://patchblox.com/security/data/cve/CVE-2024-58098.md) | Routine | bpf: track changes_pkt_data property for global functions | 6.0 | 0.0020 | | | [CVE-2024-58237](https://patchblox.com/security/data/cve/CVE-2024-58237.md) | Routine | bpf: consider that tail calls invalidate packet pointers | 6.0 | 0.0020 | | | [CVE-2025-22119](https://patchblox.com/security/data/cve/CVE-2025-22119.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37980](https://patchblox.com/security/data/cve/CVE-2025-37980.md) | Routine | block: fix resource leak in blk_register_queue() error path | 5.5 | 0.0019 | | | [CVE-2025-37983](https://patchblox.com/security/data/cve/CVE-2025-37983.md) | Routine | qibfs: fix _another_ leak | 5.5 | 0.0019 | | | [CVE-2025-22125](https://patchblox.com/security/data/cve/CVE-2025-22125.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37830](https://patchblox.com/security/data/cve/CVE-2025-37830.md) | Routine | cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() | 5.5 | 0.0019 | | | [CVE-2023-53146](https://patchblox.com/security/data/cve/CVE-2023-53146.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37742](https://patchblox.com/security/data/cve/CVE-2025-37742.md) | Routine | jfs: Fix uninit-value access of imap allocated in the diMount() function | 5.5 | 0.0019 | | | [CVE-2025-37787](https://patchblox.com/security/data/cve/CVE-2025-37787.md) | Routine | net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered | 5.5 | 0.0019 | | | [CVE-2025-37748](https://patchblox.com/security/data/cve/CVE-2025-37748.md) | Routine | kernel-64kb: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523). | 5.5 | 0.0019 | | | [CVE-2025-37815](https://patchblox.com/security/data/cve/CVE-2025-37815.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37978](https://patchblox.com/security/data/cve/CVE-2025-37978.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37793](https://patchblox.com/security/data/cve/CVE-2025-37793.md) | Routine | ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() | 5.5 | 0.0019 | | | [CVE-2025-37974](https://patchblox.com/security/data/cve/CVE-2025-37974.md) | Routine | kernel-64kb: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547). | 6.4 | 0.0019 | | | [CVE-2025-37986](https://patchblox.com/security/data/cve/CVE-2025-37986.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-38104](https://patchblox.com/security/data/cve/CVE-2025-38104.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 | | | [CVE-2025-37741](https://patchblox.com/security/data/cve/CVE-2025-37741.md) | Routine | jfs: Prevent copying of nlink with value 0 from disk inode | 5.5 | 0.0016 | | | [CVE-2025-37812](https://patchblox.com/security/data/cve/CVE-2025-37812.md) | Routine | usb: cdns3: Fix deadlock when using NCM gadget | 5.5 | 0.0016 | | | [CVE-2025-23151](https://patchblox.com/security/data/cve/CVE-2025-23151.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0016 | | | [CVE-2025-23161](https://patchblox.com/security/data/cve/CVE-2025-23161.md) | Routine | PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type | 5.5 | 0.0015 | | | [CVE-2025-37985](https://patchblox.com/security/data/cve/CVE-2025-37985.md) | Routine | USB: wdm: close race between wdm_open and wdm_wwan_port_stop | 4.7 | 0.0014 | | | [CVE-2025-37782](https://patchblox.com/security/data/cve/CVE-2025-37782.md) | Routine | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | n/a | n/a | | | [CVE-2025-37804](https://patchblox.com/security/data/cve/CVE-2025-37804.md) | Routine | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | n/a | n/a | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.