# SUSE-SU-2025:02335-1: Security update for 5 packages

SUSE-SU-2025:02335-1, released July 16, 2025, fixes 94 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-02335-1
- Platform: Linux
- Released: Jul 16, 2025
- Priority: High (Closes CVE-2025-37917, high severity)
- CVEs: 94, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:02335-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-livepatch-SLE15-SP6-RT_Update_13](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-rt-update-13.md) | sles 15.6 | 1-150600.1.5.1 |
| [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.44.1 |
| [kernel-rt_debug](https://patchblox.com/security/data/product/linux/kernel-rt-debug-kernel-rt-debug.md) | opensuse-leap 15.6 | 6.4.0-150600.10.44.1 |
| [kernel-source-rt](https://patchblox.com/security/data/product/linux/kernel-source-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.44.1 |
| [kernel-syms-rt](https://patchblox.com/security/data/product/linux/kernel-syms-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.44.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-37917](https://patchblox.com/security/data/cve/CVE-2025-37917.md) | High | kernel-64kb: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll (bsc#1243475). | 7.0 | 0.0056 |  |
| [CVE-2025-38001](https://patchblox.com/security/data/cve/CVE-2025-38001.md) | High | net_sched: hfsc: Address reentrant enqueue adding class to eltree twice | 7.8 | 0.0056 |  |
| [CVE-2024-50106](https://patchblox.com/security/data/cve/CVE-2024-50106.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0050 |  |
| [CVE-2025-38018](https://patchblox.com/security/data/cve/CVE-2025-38018.md) | High | kernel-64kb: net/tls: fix kernel panic when alloc_page failed (bsc#1244999). | 7.0 | 0.0048 |  |
| [CVE-2025-22035](https://patchblox.com/security/data/cve/CVE-2025-22035.md) | High | kernel-64kb: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544). | 7.8 | 0.0031 |  |
| [CVE-2025-37752](https://patchblox.com/security/data/cve/CVE-2025-37752.md) | High | kernel-64kb: net_sched: sch_sfq: move the limit validation (bsc#1242504). | 7.8 | 0.0030 |  |
| [CVE-2025-38003](https://patchblox.com/security/data/cve/CVE-2025-38003.md) | High | can: bcm: add missing rcu read protection for procfs content | 7.0 | 0.0030 |  |
| [CVE-2025-37927](https://patchblox.com/security/data/cve/CVE-2025-37927.md) | High | iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid | 7.8 | 0.0030 |  |
| [CVE-2025-38004](https://patchblox.com/security/data/cve/CVE-2025-38004.md) | High | can: bcm: add locking for bcm_op runtime updates | 7.8 | 0.0028 |  |
| [CVE-2025-22113](https://patchblox.com/security/data/cve/CVE-2025-22113.md) | High | ext4: avoid journaling sb update on error if journal is destroying | 7.8 | 0.0026 |  |
| [CVE-2024-57982](https://patchblox.com/security/data/cve/CVE-2024-57982.md) | High | xfrm: state: fix out-of-bounds read during lookup | 7.1 | 0.0025 |  |
| [CVE-2025-37923](https://patchblox.com/security/data/cve/CVE-2025-37923.md) | High | tracing: Fix oob write in trace_seq_to_buffer() | 7.8 | 0.0025 |  |
| [CVE-2025-38060](https://patchblox.com/security/data/cve/CVE-2025-38060.md) | High | bpf: copy_verifier_state() should copy 'loop_entry' field | 7.8 | 0.0024 |  |
| [CVE-2025-38000](https://patchblox.com/security/data/cve/CVE-2025-38000.md) | High | sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() | 7.8 | 0.0024 |  |
| [CVE-2025-37921](https://patchblox.com/security/data/cve/CVE-2025-37921.md) | High | vxlan: vnifilter: Fix unlocked deletion of default FDB entry | 7.8 | 0.0024 |  |
| [CVE-2025-37973](https://patchblox.com/security/data/cve/CVE-2025-37973.md) | High | wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation | 7.1 | 0.0024 |  |
| [CVE-2025-21920](https://patchblox.com/security/data/cve/CVE-2025-21920.md) | High | kernel-64kb: vlan: enforce underlying device type (bsc#1240686). | 7.1 | 0.0024 |  |
| [CVE-2025-38065](https://patchblox.com/security/data/cve/CVE-2025-38065.md) | High | orangefs: Do not truncate file size | 7.0 | 0.0023 |  |
| [CVE-2025-38024](https://patchblox.com/security/data/cve/CVE-2025-38024.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0023 |  |
| [CVE-2025-38023](https://patchblox.com/security/data/cve/CVE-2025-38023.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0023 |  |
| [CVE-2025-38077](https://patchblox.com/security/data/cve/CVE-2025-38077.md) | High | platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() | 7.8 | 0.0023 |  |
| [CVE-2025-37994](https://patchblox.com/security/data/cve/CVE-2025-37994.md) | High | usb: typec: ucsi: displayport: Fix NULL pointer access | 7.8 | 0.0022 |  |
| [CVE-2025-37995](https://patchblox.com/security/data/cve/CVE-2025-37995.md) | High | module: ensure that kobject_put() is safe for module type kobjects | 7.0 | 0.0022 |  |
| [CVE-2025-37936](https://patchblox.com/security/data/cve/CVE-2025-37936.md) | High | perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. | 7.0 | 0.0022 |  |
| [CVE-2025-38005](https://patchblox.com/security/data/cve/CVE-2025-38005.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0022 |  |
| [CVE-2025-37738](https://patchblox.com/security/data/cve/CVE-2025-37738.md) | High | ext4: ignore xattrs past end | 7.8 | 0.0022 |  |
| [CVE-2025-38079](https://patchblox.com/security/data/cve/CVE-2025-38079.md) | High | crypto: algif_hash - fix double free in hash_accept | 7.8 | 0.0022 |  |
| [CVE-2025-22083](https://patchblox.com/security/data/cve/CVE-2025-22083.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 |  |
| [CVE-2024-56699](https://patchblox.com/security/data/cve/CVE-2024-56699.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0021 |  |
| [CVE-2025-21997](https://patchblox.com/security/data/cve/CVE-2025-21997.md) | High | kernel-64kb: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823). | 7.1 | 0.0021 |  |
| [CVE-2025-37938](https://patchblox.com/security/data/cve/CVE-2025-37938.md) | High | tracing: Verify event formats that have "%*p.." | 7.8 | 0.0021 |  |
| [CVE-2025-38013](https://patchblox.com/security/data/cve/CVE-2025-38013.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0020 |  |
| [CVE-2025-38068](https://patchblox.com/security/data/cve/CVE-2025-38068.md) | High | crypto: lzo - Fix compression buffer overrun | 7.8 | 0.0020 |  |
| [CVE-2025-38027](https://patchblox.com/security/data/cve/CVE-2025-38027.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0020 |  |
| [CVE-2025-38022](https://patchblox.com/security/data/cve/CVE-2025-38022.md) | High | RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem | 7.8 | 0.0020 |  |
| [CVE-2025-38015](https://patchblox.com/security/data/cve/CVE-2025-38015.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0020 |  |
| [CVE-2025-38020](https://patchblox.com/security/data/cve/CVE-2025-38020.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0020 |  |
| [CVE-2025-38043](https://patchblox.com/security/data/cve/CVE-2025-38043.md) | High | firmware: arm_ffa: Set dma_mask for ffa devices | 7.0 | 0.0020 |  |
| [CVE-2025-37946](https://patchblox.com/security/data/cve/CVE-2025-37946.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0020 |  |
| [CVE-2025-38040](https://patchblox.com/security/data/cve/CVE-2025-38040.md) | High | serial: mctrl_gpio: split disable_ms into sync and no_sync APIs | 7.0 | 0.0020 |  |
| [CVE-2025-37786](https://patchblox.com/security/data/cve/CVE-2025-37786.md) | High | net: dsa: free routing table on probe failure | 7.8 | 0.0019 |  |
| [CVE-2025-38014](https://patchblox.com/security/data/cve/CVE-2025-38014.md) | High | dmaengine: idxd: Refactor remove call with idxd_cleanup() helper | 7.0 | 0.0019 |  |
| [CVE-2025-38045](https://patchblox.com/security/data/cve/CVE-2025-38045.md) | High | wifi: iwlwifi: fix debug actions order | 7.0 | 0.0019 |  |
| [CVE-2025-37987](https://patchblox.com/security/data/cve/CVE-2025-37987.md) | High | pds_core: Prevent possible adminq overflow/stuck condition | 7.0 | 0.0019 |  |
| [CVE-2025-38053](https://patchblox.com/security/data/cve/CVE-2025-38053.md) | High | kernel-64kb: idpf: fix null-ptr-deref in idpf_features_check (bsc#1244746). | 7.1 | 0.0019 |  |
| [CVE-2025-38081](https://patchblox.com/security/data/cve/CVE-2025-38081.md) | High | spi-rockchip: Fix register out of bounds access | 7.1 | 0.0018 |  |
| [CVE-2025-37997](https://patchblox.com/security/data/cve/CVE-2025-37997.md) | High | netfilter: ipset: fix region locking in hash types | 7.0 | 0.0018 |  |
| [CVE-2025-38080](https://patchblox.com/security/data/cve/CVE-2025-38080.md) | High | drm/amd/display: Increase block_sequence array size | 7.0 | 0.0018 |  |
| [CVE-2025-38078](https://patchblox.com/security/data/cve/CVE-2025-38078.md) | High | ALSA: pcm: Fix race of buffer access at PCM OSS layer | 7.0 | 0.0017 |  |
| [CVE-2025-37968](https://patchblox.com/security/data/cve/CVE-2025-37968.md) | High | iio: light: opt3001: fix deadlock due to concurrent flag access | 7.0 | 0.0016 |  |
| [CVE-2025-38083](https://patchblox.com/security/data/cve/CVE-2025-38083.md) | High | net_sched: prio: fix a race in prio_tune() | 7.0 | 0.0016 |  |
| [CVE-2024-49568](https://patchblox.com/security/data/cve/CVE-2024-49568.md) | Routine | net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg | 5.5 | 0.0058 |  |
| [CVE-2025-38057](https://patchblox.com/security/data/cve/CVE-2025-38057.md) | Routine | espintcp: fix skb leaks | 5.5 | 0.0048 |  |
| [CVE-2024-58053](https://patchblox.com/security/data/cve/CVE-2024-58053.md) | Routine | rxrpc: Fix handling of received connection abort | 5.5 | 0.0046 |  |
| [CVE-2025-37757](https://patchblox.com/security/data/cve/CVE-2025-37757.md) | Routine | tipc: fix memory leak in tipc_link_xmit | 6.1 | 0.0045 |  |
| [CVE-2025-21959](https://patchblox.com/security/data/cve/CVE-2025-21959.md) | Routine | kernel-64kb: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (bsc#1240814). | 5.5 | 0.0045 |  |
| [CVE-2025-21938](https://patchblox.com/security/data/cve/CVE-2025-21938.md) | Routine | kernel-64kb: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723). | 5.9 | 0.0039 |  |
| [CVE-2025-21868](https://patchblox.com/security/data/cve/CVE-2025-21868.md) | Routine | kernel-64kb: kABI workaround for adding an header (bsc#1240180). | 5.5 | 0.0039 |  |
| [CVE-2025-21720](https://patchblox.com/security/data/cve/CVE-2025-21720.md) | Routine | kernel-64kb: xfrm: delete intermediate secpath entry in packet offload mode (bsc#1238859). | 5.5 | 0.0036 |  |
| [CVE-2025-37874](https://patchblox.com/security/data/cve/CVE-2025-37874.md) | Routine | net: ngbe: fix memory leak in ngbe_probe() error path | 5.5 | 0.0032 |  |
| [CVE-2025-37859](https://patchblox.com/security/data/cve/CVE-2025-37859.md) | Routine | page_pool: avoid infinite loop to schedule delayed worker | 5.5 | 0.0031 |  |
| [CVE-2025-37862](https://patchblox.com/security/data/cve/CVE-2025-37862.md) | Routine | HID: pidff: Fix null pointer dereference in pidff_find_fields | 5.5 | 0.0031 |  |
| [CVE-2025-37756](https://patchblox.com/security/data/cve/CVE-2025-37756.md) | Routine | net: tls: explicitly disallow disconnect | 5.5 | 0.0030 |  |
| [CVE-2025-37844](https://patchblox.com/security/data/cve/CVE-2025-37844.md) | Routine | cifs: avoid NULL pointer dereference in dbg call | 5.5 | 0.0030 |  |
| [CVE-2025-37865](https://patchblox.com/security/data/cve/CVE-2025-37865.md) | Routine | net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported | 5.5 | 0.0029 |  |
| [CVE-2025-37998](https://patchblox.com/security/data/cve/CVE-2025-37998.md) | Routine | openvswitch: Fix unsafe attribute parsing in output_userspace() | 5.5 | 0.0027 |  |
| [CVE-2025-37743](https://patchblox.com/security/data/cve/CVE-2025-37743.md) | Routine | wifi: ath12k: Avoid memory leak while enabling statistics | 5.5 | 0.0024 |  |
| [CVE-2023-52888](https://patchblox.com/security/data/cve/CVE-2023-52888.md) | Routine | media: mediatek: vcodec: Only free buffer VA that is not NULL | 5.5 | 0.0024 |  |
| [CVE-2025-38044](https://patchblox.com/security/data/cve/CVE-2025-38044.md) | Routine | media: cx231xx: set device_caps for 417 | 5.5 | 0.0024 |  |
| [CVE-2025-21899](https://patchblox.com/security/data/cve/CVE-2025-21899.md) | Routine | tracing: Fix bad hist from corrupting named_triggers list | 6.0 | 0.0023 |  |
| [CVE-2025-21898](https://patchblox.com/security/data/cve/CVE-2025-21898.md) | Routine | kernel-64kb: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610). | 5.5 | 0.0023 |  |
| [CVE-2025-37909](https://patchblox.com/security/data/cve/CVE-2025-37909.md) | Routine | net: lan743x: Fix memleak issue when GSO enabled | 5.5 | 0.0023 |  |
| [CVE-2024-26831](https://patchblox.com/security/data/cve/CVE-2024-26831.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 |  |
| [CVE-2025-38072](https://patchblox.com/security/data/cve/CVE-2025-38072.md) | Routine | libnvdimm/labels: Fix divide error in nd_label_data_init() | 5.5 | 0.0022 |  |
| [CVE-2025-37992](https://patchblox.com/security/data/cve/CVE-2025-37992.md) | Routine | net_sched: Flush gso_skb list too during ->change() | 5.5 | 0.0022 |  |
| [CVE-2025-37801](https://patchblox.com/security/data/cve/CVE-2025-37801.md) | Routine | spi: spi-imx: Add check for spi_imx_setupxfer() | 5.5 | 0.0021 |  |
| [CVE-2025-38009](https://patchblox.com/security/data/cve/CVE-2025-38009.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-38031](https://patchblox.com/security/data/cve/CVE-2025-38031.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-37884](https://patchblox.com/security/data/cve/CVE-2025-37884.md) | Routine | bpf: Fix deadlock between rcu_tasks_trace and event_mutex. | 5.5 | 0.0021 |  |
| [CVE-2025-37945](https://patchblox.com/security/data/cve/CVE-2025-37945.md) | Routine | net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY | 5.5 | 0.0021 |  |
| [CVE-2025-22111](https://patchblox.com/security/data/cve/CVE-2025-22111.md) | Routine | kernel-64kb: kABI fix for net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF (bsc#1241572). | 5.5 | 0.0021 |  |
| [CVE-2025-23155](https://patchblox.com/security/data/cve/CVE-2025-23155.md) | Routine | net: stmmac: Fix accessing freed irq affinity_hint | 5.5 | 0.0021 |  |
| [CVE-2025-37933](https://patchblox.com/security/data/cve/CVE-2025-37933.md) | Routine | octeon_ep: Fix host hang issue during device reboot | 5.6 | 0.0021 |  |
| [CVE-2025-37800](https://patchblox.com/security/data/cve/CVE-2025-37800.md) | Routine | driver core: fix potential NULL pointer dereference in dev_uevent() | 5.5 | 0.0021 |  |
| [CVE-2024-56613](https://patchblox.com/security/data/cve/CVE-2024-56613.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 |  |
| [CVE-2025-21658](https://patchblox.com/security/data/cve/CVE-2025-21658.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 |  |
| [CVE-2025-38011](https://patchblox.com/security/data/cve/CVE-2025-38011.md) | Routine | drm/amdgpu: csa unmap use uninterruptible lock | 5.5 | 0.0020 |  |
| [CVE-2025-38007](https://patchblox.com/security/data/cve/CVE-2025-38007.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0020 |  |
| [CVE-2025-38010](https://patchblox.com/security/data/cve/CVE-2025-38010.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-38059](https://patchblox.com/security/data/cve/CVE-2025-38059.md) | Routine | btrfs: avoid NULL pointer dereference if no valid csum tree | 5.5 | 0.0019 |  |
| [CVE-2025-22120](https://patchblox.com/security/data/cve/CVE-2025-22120.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-37961](https://patchblox.com/security/data/cve/CVE-2025-37961.md) | Routine | ipvs: fix uninit-value for saddr in do_output_route4 | 6.5 | 0.0019 |  |
| [CVE-2025-37811](https://patchblox.com/security/data/cve/CVE-2025-37811.md) | Routine | kernel-64kb: usb: chipidea: ci_hdrc_imx: fix usbmisc handling (bsc#1242907). | 5.5 | 0.0019 |  |
| [CVE-2025-37967](https://patchblox.com/security/data/cve/CVE-2025-37967.md) | Routine | usb: typec: ucsi: displayport: Fix deadlock | 5.5 | 0.0016 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.