# SUSE-SU-2025:03382-1: kernel-livepatch-SLE15-SP7-RT_Update_4 security update

SUSE-SU-2025:03382-1, released September 26, 2025, fixes 103 CVEs in kernel-livepatch-SLE15-SP7-RT_Update_4 (version 1-150700.1.3.2). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-03382-1
- Platform: Linux
- Released: Sep 26, 2025
- Priority: High (Closes CVE-2023-3867, high severity)
- CVEs: 103, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:03382-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-livepatch-SLE15-SP7-RT_Update_4](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-rt-update-4.md) | sles 15.7 | 1-150700.1.3.2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2023-3867](https://patchblox.com/security/data/cve/CVE-2023-3867.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 7.1 | 0.0627 |  |
| [CVE-2024-49996](https://patchblox.com/security/data/cve/CVE-2024-49996.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.8 | 0.0078 |  |
| [CVE-2025-38566](https://patchblox.com/security/data/cve/CVE-2025-38566.md) | High | sunrpc: fix handling of server side tls alerts | 8.1 | 0.0067 |  |
| [CVE-2025-38439](https://patchblox.com/security/data/cve/CVE-2025-38439.md) | High | bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT | 7.8 | 0.0058 |  |
| [CVE-2025-38146](https://patchblox.com/security/data/cve/CVE-2025-38146.md) | High | net: openvswitch: Fix the dead loop of MPLS parse | 7.8 | 0.0049 |  |
| [CVE-2025-38472](https://patchblox.com/security/data/cve/CVE-2025-38472.md) | High | netfilter: nf_conntrack: fix crash due to removal of uninitialised entry | 7.5 | 0.0046 |  |
| [CVE-2025-38075](https://patchblox.com/security/data/cve/CVE-2025-38075.md) | High | scsi: target: iscsi: Fix timeout on deleted connection | 7.0 | 0.0046 |  |
| [CVE-2025-38563](https://patchblox.com/security/data/cve/CVE-2025-38563.md) | High | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0044 |  |
| [CVE-2025-38608](https://patchblox.com/security/data/cve/CVE-2025-38608.md) | High | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0044 |  |
| [CVE-2025-38617](https://patchblox.com/security/data/cve/CVE-2025-38617.md) | High | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0043 |  |
| [CVE-2025-38571](https://patchblox.com/security/data/cve/CVE-2025-38571.md) | High | sunrpc: fix client side handling of tls alerts | 8.1 | 0.0037 |  |
| [CVE-2025-38490](https://patchblox.com/security/data/cve/CVE-2025-38490.md) | High | net: libwx: remove duplicate page_pool_put_full_page() | 9.8 | 0.0036 |  |
| [CVE-2025-37885](https://patchblox.com/security/data/cve/CVE-2025-37885.md) | High | KVM: x86: Reset IRTE to host control if *new* route isn't postable | 7.8 | 0.0032 |  |
| [CVE-2025-38601](https://patchblox.com/security/data/cve/CVE-2025-38601.md) | High | wifi: ath11k: clear initialized flag for deinit-ed srng lists | 7.0 | 0.0027 |  |
| [CVE-2025-38585](https://patchblox.com/security/data/cve/CVE-2025-38585.md) | High | staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() | 7.8 | 0.0025 |  |
| [CVE-2025-38512](https://patchblox.com/security/data/cve/CVE-2025-38512.md) | High | wifi: prevent A-MSDU attacks in mesh networks | 7.8 | 0.0025 |  |
| [CVE-2025-38491](https://patchblox.com/security/data/cve/CVE-2025-38491.md) | High | mptcp: make fallback action and fallback decision atomic | 7.0 | 0.0024 |  |
| [CVE-2025-38201](https://patchblox.com/security/data/cve/CVE-2025-38201.md) | High | netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX | 7.8 | 0.0024 |  |
| [CVE-2025-38103](https://patchblox.com/security/data/cve/CVE-2025-38103.md) | High | HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() | 7.1 | 0.0023 |  |
| [CVE-2025-38582](https://patchblox.com/security/data/cve/CVE-2025-38582.md) | High | RDMA/hns: Fix double destruction of rsv_qp | 7.8 | 0.0023 |  |
| [CVE-2025-38184](https://patchblox.com/security/data/cve/CVE-2025-38184.md) | High | tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer | 7.0 | 0.0022 |  |
| [CVE-2025-38464](https://patchblox.com/security/data/cve/CVE-2025-38464.md) | High | tipc: Fix use-after-free in tipc_conn_close(). | 7.8 | 0.0022 |  |
| [CVE-2025-38605](https://patchblox.com/security/data/cve/CVE-2025-38605.md) | High | wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() | 7.0 | 0.0021 |  |
| [CVE-2025-38656](https://patchblox.com/security/data/cve/CVE-2025-38656.md) | High | wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() | 7.8 | 0.0021 |  |
| [CVE-2025-38459](https://patchblox.com/security/data/cve/CVE-2025-38459.md) | High | atm: clip: Fix infinite recursive call of clip_push(). | 7.8 | 0.0021 |  |
| [CVE-2025-38565](https://patchblox.com/security/data/cve/CVE-2025-38565.md) | High | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0020 |  |
| [CVE-2025-38572](https://patchblox.com/security/data/cve/CVE-2025-38572.md) | High | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0020 |  |
| [CVE-2025-38445](https://patchblox.com/security/data/cve/CVE-2025-38445.md) | High | md/raid1: Fix stack memory use after return in raid1_reshape | 7.1 | 0.0020 |  |
| [CVE-2025-38125](https://patchblox.com/security/data/cve/CVE-2025-38125.md) | High | net: stmmac: make sure that ptp_rate is not 0 before configuring EST | 7.0 | 0.0020 |  |
| [CVE-2025-38555](https://patchblox.com/security/data/cve/CVE-2025-38555.md) | High | usb: gadget : fix use-after-free in composite_dev_cleanup() | 7.8 | 0.0020 |  |
| [CVE-2025-38529](https://patchblox.com/security/data/cve/CVE-2025-38529.md) | High | comedi: aio_iiro_16: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38530](https://patchblox.com/security/data/cve/CVE-2025-38530.md) | High | comedi: pcl812: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38458](https://patchblox.com/security/data/cve/CVE-2025-38458.md) | High | atm: clip: Fix NULL pointer dereference in vcc_sendmsg() | 7.0 | 0.0020 |  |
| [CVE-2025-38581](https://patchblox.com/security/data/cve/CVE-2025-38581.md) | High | crypto: ccp - Fix crash when rebind ccp device for ccp.ko | 7.0 | 0.0019 |  |
| [CVE-2025-38160](https://patchblox.com/security/data/cve/CVE-2025-38160.md) | High | clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() | 7.0 | 0.0019 |  |
| [CVE-2025-38245](https://patchblox.com/security/data/cve/CVE-2025-38245.md) | High | atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). | 7.8 | 0.0019 |  |
| [CVE-2025-38560](https://patchblox.com/security/data/cve/CVE-2025-38560.md) | High | x86/sev: Evict cache lines during SNP memory validation | 7.5 | 0.0019 |  |
| [CVE-2025-38538](https://patchblox.com/security/data/cve/CVE-2025-38538.md) | High | dmaengine: nbpfaxi: Fix memory corruption in probe() | 7.8 | 0.0019 |  |
| [CVE-2025-38568](https://patchblox.com/security/data/cve/CVE-2025-38568.md) | High | net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing | 7.8 | 0.0019 |  |
| [CVE-2025-38499](https://patchblox.com/security/data/cve/CVE-2025-38499.md) | High | clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns | 8.2 | 0.0019 |  |
| [CVE-2025-38535](https://patchblox.com/security/data/cve/CVE-2025-38535.md) | High | phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode | 7.8 | 0.0019 |  |
| [CVE-2025-38618](https://patchblox.com/security/data/cve/CVE-2025-38618.md) | High | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 |  |
| [CVE-2025-38548](https://patchblox.com/security/data/cve/CVE-2025-38548.md) | High | hwmon: (corsair-cpro) Validate the size of the received input buffer | 7.8 | 0.0018 |  |
| [CVE-2025-38208](https://patchblox.com/security/data/cve/CVE-2025-38208.md) | High | smb: client: add NULL check in automount_fullpath | 7.0 | 0.0018 |  |
| [CVE-2025-38500](https://patchblox.com/security/data/cve/CVE-2025-38500.md) | High | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0018 |  |
| [CVE-2025-38587](https://patchblox.com/security/data/cve/CVE-2025-38587.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.0 | 0.0018 |  |
| [CVE-2025-38609](https://patchblox.com/security/data/cve/CVE-2025-38609.md) | High | PM / devfreq: Check governor before using governor->name | 7.8 | 0.0018 |  |
| [CVE-2025-38550](https://patchblox.com/security/data/cve/CVE-2025-38550.md) | High | ipv6: mcast: Delay put pmc->idev in mld_del_delrec() | 7.8 | 0.0017 |  |
| [CVE-2025-38668](https://patchblox.com/security/data/cve/CVE-2025-38668.md) | High | regulator: core: fix NULL dereference on unbind due to stale coupling data | 7.0 | 0.0017 |  |
| [CVE-2025-38670](https://patchblox.com/security/data/cve/CVE-2025-38670.md) | High | arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() | 7.1 | 0.0017 |  |
| [CVE-2025-38521](https://patchblox.com/security/data/cve/CVE-2025-38521.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.1 | 0.0017 |  |
| [CVE-2025-38543](https://patchblox.com/security/data/cve/CVE-2025-38543.md) | High | drm/tegra: nvdec: Fix dma_alloc_coherent error check | 7.1 | 0.0017 |  |
| [CVE-2025-38665](https://patchblox.com/security/data/cve/CVE-2025-38665.md) | High | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 |  |
| [CVE-2025-38440](https://patchblox.com/security/data/cve/CVE-2025-38440.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.0 | 0.0014 |  |
| [CVE-2023-4130](https://patchblox.com/security/data/cve/CVE-2023-4130.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0051 |  |
| [CVE-2024-58239](https://patchblox.com/security/data/cve/CVE-2024-58239.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.9 | 0.0036 |  |
| [CVE-2023-4515](https://patchblox.com/security/data/cve/CVE-2023-4515.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0033 |  |
| [CVE-2025-38524](https://patchblox.com/security/data/cve/CVE-2025-38524.md) | Routine | rxrpc: Fix recv-recv race of completed call | 4.7 | 0.0032 |  |
| [CVE-2024-26661](https://patchblox.com/security/data/cve/CVE-2024-26661.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0023 |  |
| [CVE-2025-38591](https://patchblox.com/security/data/cve/CVE-2025-38591.md) | Routine | bpf: Reject narrower access to pointer ctx fields | 5.5 | 0.0022 |  |
| [CVE-2025-38190](https://patchblox.com/security/data/cve/CVE-2025-38190.md) | Routine | atm: Revert atm_account_tx() if copy_from_iter_full() fails. | 5.5 | 0.0021 |  |
| [CVE-2025-38185](https://patchblox.com/security/data/cve/CVE-2025-38185.md) | Routine | atm: atmtcp: Free invalid length skb in atmtcp_c_send(). | 5.5 | 0.0020 |  |
| [CVE-2025-38006](https://patchblox.com/security/data/cve/CVE-2025-38006.md) | Routine | net: mctp: Don't access ifa_index when missing | 5.5 | 0.0020 |  |
| [CVE-2025-38612](https://patchblox.com/security/data/cve/CVE-2025-38612.md) | Routine | staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() | 5.5 | 0.0019 |  |
| [CVE-2025-38441](https://patchblox.com/security/data/cve/CVE-2025-38441.md) | Routine | kernel-debug-modules: The kernel packages contain the Linux kernel, the core of any Linux operating system | 5.5 | 0.0019 |  |
| [CVE-2025-38604](https://patchblox.com/security/data/cve/CVE-2025-38604.md) | Routine | wifi: rtl818x: Kill URBs before clearing tx status queue | 5.5 | 0.0019 |  |
| [CVE-2025-38360](https://patchblox.com/security/data/cve/CVE-2025-38360.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0019 |  |
| [CVE-2024-58238](https://patchblox.com/security/data/cve/CVE-2024-58238.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0019 |  |
| [CVE-2025-38205](https://patchblox.com/security/data/cve/CVE-2025-38205.md) | Routine | drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 | 5.5 | 0.0018 |  |
| [CVE-2025-38576](https://patchblox.com/security/data/cve/CVE-2025-38576.md) | Routine | powerpc/eeh: Make EEH driver device hotplug safe | 5.5 | 0.0018 |  |
| [CVE-2025-38513](https://patchblox.com/security/data/cve/CVE-2025-38513.md) | Routine | wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() | 5.5 | 0.0018 |  |
| [CVE-2025-38516](https://patchblox.com/security/data/cve/CVE-2025-38516.md) | Routine | pinctrl: qcom: msm: mark certain pins as invalid for interrupts | 5.5 | 0.0018 |  |
| [CVE-2025-38528](https://patchblox.com/security/data/cve/CVE-2025-38528.md) | Routine | bpf: Reject %p% format string in bprintf-like helpers | 5.5 | 0.0018 |  |
| [CVE-2025-38540](https://patchblox.com/security/data/cve/CVE-2025-38540.md) | Routine | HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras | 5.5 | 0.0018 |  |
| [CVE-2025-38546](https://patchblox.com/security/data/cve/CVE-2025-38546.md) | Routine | atm: clip: Fix memory leak of struct clip_vcc. | 5.5 | 0.0018 |  |
| [CVE-2025-38635](https://patchblox.com/security/data/cve/CVE-2025-38635.md) | Routine | clk: davinci: Add NULL check in davinci_lpsc_clk_register() | 5.5 | 0.0018 |  |
| [CVE-2025-38663](https://patchblox.com/security/data/cve/CVE-2025-38663.md) | Routine | nilfs2: reject invalid file types when reading inodes | 5.5 | 0.0018 |  |
| [CVE-2025-38444](https://patchblox.com/security/data/cve/CVE-2025-38444.md) | Routine | raid10: cleanup memleak at raid10_make_request | 5.5 | 0.0018 |  |
| [CVE-2025-38602](https://patchblox.com/security/data/cve/CVE-2025-38602.md) | Routine | iwlwifi: Add missing check for alloc_ordered_workqueue | 5.5 | 0.0018 |  |
| [CVE-2025-38251](https://patchblox.com/security/data/cve/CVE-2025-38251.md) | Routine | atm: clip: prevent NULL deref in clip_push() | 5.5 | 0.0018 |  |
| [CVE-2025-38588](https://patchblox.com/security/data/cve/CVE-2025-38588.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0018 |  |
| [CVE-2025-38610](https://patchblox.com/security/data/cve/CVE-2025-38610.md) | Routine | powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() | 5.5 | 0.0018 |  |
| [CVE-2025-38531](https://patchblox.com/security/data/cve/CVE-2025-38531.md) | Routine | iio: common: st_sensors: Fix use of uninitialize device structs | 5.5 | 0.0018 |  |
| [CVE-2025-38583](https://patchblox.com/security/data/cve/CVE-2025-38583.md) | Routine | clk: xilinx: vcu: unregister pll_post only if registered correctly | 5.5 | 0.0018 |  |
| [CVE-2025-38630](https://patchblox.com/security/data/cve/CVE-2025-38630.md) | Routine | fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref | 5.5 | 0.0017 |  |
| [CVE-2024-46733](https://patchblox.com/security/data/cve/CVE-2024-46733.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38511](https://patchblox.com/security/data/cve/CVE-2025-38511.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38515](https://patchblox.com/security/data/cve/CVE-2025-38515.md) | Routine | drm/sched: Increment job count before swapping tail spsc queue | 5.5 | 0.0017 |  |
| [CVE-2025-38624](https://patchblox.com/security/data/cve/CVE-2025-38624.md) | Routine | PCI: pnv_php: Clean up allocated IRQs on unplug | 5.5 | 0.0017 |  |
| [CVE-2025-38671](https://patchblox.com/security/data/cve/CVE-2025-38671.md) | Routine | i2c: qup: jump out of the loop in case of timeout | 5.5 | 0.0017 |  |
| [CVE-2025-38644](https://patchblox.com/security/data/cve/CVE-2025-38644.md) | Routine | wifi: mac80211: reject TDLS operations when station is not associated | 5.5 | 0.0017 |  |
| [CVE-2025-38510](https://patchblox.com/security/data/cve/CVE-2025-38510.md) | Routine | kasan: remove kasan_find_vm_area() to prevent possible deadlock | 5.5 | 0.0017 |  |
| [CVE-2025-38634](https://patchblox.com/security/data/cve/CVE-2025-38634.md) | Routine | power: supply: cpcap-charger: Fix null check for power_supply_get_by_name | 5.5 | 0.0017 |  |
| [CVE-2025-38646](https://patchblox.com/security/data/cve/CVE-2025-38646.md) | Routine | wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band | 6.5 | 0.0017 |  |
| [CVE-2025-38621](https://patchblox.com/security/data/cve/CVE-2025-38621.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38503](https://patchblox.com/security/data/cve/CVE-2025-38503.md) | Routine | btrfs: fix assertion when building free space tree | 5.5 | 0.0016 |  |
| [CVE-2025-38537](https://patchblox.com/security/data/cve/CVE-2025-38537.md) | Routine | net: phy: Don't register LEDs for genphy | 5.5 | 0.0016 |  |
| [CVE-2025-38541](https://patchblox.com/security/data/cve/CVE-2025-38541.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0016 |  |
| [CVE-2025-38632](https://patchblox.com/security/data/cve/CVE-2025-38632.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 4.7 | 0.0014 |  |
| [CVE-2025-38650](https://patchblox.com/security/data/cve/CVE-2025-38650.md) | Routine | hfsplus: remove mutex_lock check in hfsplus_free_extents | 5.5 | 0.0014 |  |
| [CVE-2025-38520](https://patchblox.com/security/data/cve/CVE-2025-38520.md) | Routine | drm/amdkfd: Don't call mmput from MMU notifier callback | 5.5 | 0.0013 |  |
| [CVE-2025-38506](https://patchblox.com/security/data/cve/CVE-2025-38506.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0013 |  |
| [CVE-2025-38553](https://patchblox.com/security/data/cve/CVE-2025-38553.md) | Routine | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a |  |

---

Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.