# SUSE-SU-2025:03601-1: Security update for 9 packages

SUSE-SU-2025:03601-1, released October 15, 2025, fixes 96 CVEs across 9 products. One of them is being exploited (CVE-2025-39682); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-03601-1
- Platform: Linux
- Released: Oct 15, 2025
- Priority: Patch now (Closes CVE-2025-39682, exploited (CISA KEV))
- CVEs: 96, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:03601-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.7 | 6.4.0-150700.53.19.1.150700.17.13.1 |
| [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-livepatch-SLE15-SP7_Update_5](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-update-5.md) | sles 15.7 | 1-150700.15.3.1 |
| [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.7 | 6.4.0-150700.53.19.1 |
| [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | sles 15.7 | 6.4.0-150700.53.19.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-39682](https://patchblox.com/security/data/cve/CVE-2025-39682.md) | Patch now | tls: fix handling of zero-length records on the rx_list | 9.8 | 0.0331 | CISA KEV |
| [CVE-2025-38488](https://patchblox.com/security/data/cve/CVE-2025-38488.md) | High | kernel-64kb: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239). | 7.8 | 0.0077 |  |
| [CVE-2025-38527](https://patchblox.com/security/data/cve/CVE-2025-38527.md) | High | smb: client: fix use-after-free in cifs_oplock_break | 7.8 | 0.0046 |  |
| [CVE-2025-38590](https://patchblox.com/security/data/cve/CVE-2025-38590.md) | High | net/mlx5e: Remove skb secpath if xfrm state is not found | 7.5 | 0.0044 |  |
| [CVE-2025-38676](https://patchblox.com/security/data/cve/CVE-2025-38676.md) | High | iommu/amd: Avoid stack buffer overflow from kernel cmdline | 7.8 | 0.0042 |  |
| [CVE-2025-38574](https://patchblox.com/security/data/cve/CVE-2025-38574.md) | High | pptp: ensure minimal skb length in pptp_xmit() | 7.8 | 0.0041 |  |
| [CVE-2025-38660](https://patchblox.com/security/data/cve/CVE-2025-38660.md) | High | [ceph] parse_longname(): strrchr() expects NUL-terminated string | 7.1 | 0.0041 |  |
| [CVE-2025-39703](https://patchblox.com/security/data/cve/CVE-2025-39703.md) | High | net, hsr: reject HSR frame if skb can't hold tag | 7.0 | 0.0039 |  |
| [CVE-2025-40300](https://patchblox.com/security/data/cve/CVE-2025-40300.md) | High | x86/vmscape: Add conditional IBPB mitigation | 7.3 | 0.0038 |  |
| [CVE-2025-38533](https://patchblox.com/security/data/cve/CVE-2025-38533.md) | High | net: libwx: fix the using of Rx buffer DMA | 7.8 | 0.0033 |  |
| [CVE-2025-38678](https://patchblox.com/security/data/cve/CVE-2025-38678.md) | High | netfilter: nf_tables: reject duplicate device on updates | 7.1 | 0.0029 |  |
| [CVE-2023-5633](https://patchblox.com/security/data/cve/CVE-2023-5633.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0028 |  |
| [CVE-2025-38466](https://patchblox.com/security/data/cve/CVE-2025-38466.md) | High | perf: Revert to requiring CAP_SYS_ADMIN for uprobes | 7.8 | 0.0023 |  |
| [CVE-2025-38595](https://patchblox.com/security/data/cve/CVE-2025-38595.md) | High | xen: fix UAF in dmabuf_exp_from_pages() | 7.8 | 0.0023 |  |
| [CVE-2025-39677](https://patchblox.com/security/data/cve/CVE-2025-39677.md) | High | net/sched: Fix backlog accounting in qdisc_dequeue_internal | 7.0 | 0.0021 |  |
| [CVE-2025-38616](https://patchblox.com/security/data/cve/CVE-2025-38616.md) | High | tls: handle data disappearing from under the TLS ULP | 7.1 | 0.0021 |  |
| [CVE-2025-38605](https://patchblox.com/security/data/cve/CVE-2025-38605.md) | High | wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() | 7.0 | 0.0021 |  |
| [CVE-2025-38722](https://patchblox.com/security/data/cve/CVE-2025-38722.md) | High | habanalabs: fix UAF in export_dmabuf() | 7.8 | 0.0021 |  |
| [CVE-2025-22022](https://patchblox.com/security/data/cve/CVE-2025-22022.md) | High | kernel-64kb: usb: xhci: Apply the link chain quirk on NEC isoc endpoints (bsc#1241292). | 7.8 | 0.0020 |  |
| [CVE-2025-38614](https://patchblox.com/security/data/cve/CVE-2025-38614.md) | High | eventpoll: Fix semi-unbounded recursion | 7.5 | 0.0020 |  |
| [CVE-2025-38119](https://patchblox.com/security/data/cve/CVE-2025-38119.md) | High | scsi: core: ufs: Fix a hang in the error handler | 7.0 | 0.0020 |  |
| [CVE-2025-38584](https://patchblox.com/security/data/cve/CVE-2025-38584.md) | High | padata: Fix pd UAF once and for all | 7.8 | 0.0019 |  |
| [CVE-2025-39691](https://patchblox.com/security/data/cve/CVE-2025-39691.md) | High | fs/buffer: fix use-after-free when call bh_read() helper | 7.8 | 0.0019 |  |
| [CVE-2025-38351](https://patchblox.com/security/data/cve/CVE-2025-38351.md) | High | KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush | 7.5 | 0.0019 |  |
| [CVE-2025-38456](https://patchblox.com/security/data/cve/CVE-2025-38456.md) | High | ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() | 7.8 | 0.0019 |  |
| [CVE-2025-38701](https://patchblox.com/security/data/cve/CVE-2025-38701.md) | High | ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | 7.0 | 0.0019 |  |
| [CVE-2025-38593](https://patchblox.com/security/data/cve/CVE-2025-38593.md) | High | Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' | 7.8 | 0.0019 |  |
| [CVE-2025-39766](https://patchblox.com/security/data/cve/CVE-2025-39766.md) | High | net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit | 8.1 | 0.0018 |  |
| [CVE-2025-38684](https://patchblox.com/security/data/cve/CVE-2025-38684.md) | High | net/sched: ets: use old 'nbands' while purging unused classes | 7.0 | 0.0018 |  |
| [CVE-2025-38732](https://patchblox.com/security/data/cve/CVE-2025-38732.md) | High | netfilter: nf_reject: don't leak dst refcount for loopback packets | 7.0 | 0.0018 |  |
| [CVE-2025-38556](https://patchblox.com/security/data/cve/CVE-2025-38556.md) | High | HID: core: Harden s32ton() against conversion to 0 bits | 8.0 | 0.0018 |  |
| [CVE-2025-39823](https://patchblox.com/security/data/cve/CVE-2025-39823.md) | High | KVM: x86: use array_index_nospec with indices that come from guest | 7.8 | 0.0018 |  |
| [CVE-2025-38216](https://patchblox.com/security/data/cve/CVE-2025-38216.md) | High | kernel-64kb: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963). | 7.8 | 0.0018 |  |
| [CVE-2025-38703](https://patchblox.com/security/data/cve/CVE-2025-38703.md) | High | drm/xe: Make dma-fences compliant with the safe access rules | 7.8 | 0.0018 |  |
| [CVE-2025-39738](https://patchblox.com/security/data/cve/CVE-2025-39738.md) | High | btrfs: do not allow relocation of partially dropped subvolumes | 7.8 | 0.0018 |  |
| [CVE-2025-39749](https://patchblox.com/security/data/cve/CVE-2025-39749.md) | High | rcu: Protect ->defer_qs_iw_pending from data race | 7.0 | 0.0017 |  |
| [CVE-2025-38730](https://patchblox.com/security/data/cve/CVE-2025-38730.md) | High | io_uring/net: commit partial buffers on retry | 7.8 | 0.0017 |  |
| [CVE-2025-39835](https://patchblox.com/security/data/cve/CVE-2025-39835.md) | High | xfs: do not propagate ENODATA disk errors into xattr code | 7.8 | 0.0017 |  |
| [CVE-2025-38679](https://patchblox.com/security/data/cve/CVE-2025-38679.md) | High | media: venus: Fix OOB read due to missing payload bound check | 7.1 | 0.0017 |  |
| [CVE-2025-38668](https://patchblox.com/security/data/cve/CVE-2025-38668.md) | High | regulator: core: fix NULL dereference on unbind due to stale coupling data | 7.0 | 0.0017 |  |
| [CVE-2025-39718](https://patchblox.com/security/data/cve/CVE-2025-39718.md) | High | vsock/virtio: Validate length in packet header before skb_put() | 7.8 | 0.0017 |  |
| [CVE-2025-39744](https://patchblox.com/security/data/cve/CVE-2025-39744.md) | High | rcu: Fix rcu_read_unlock() deadloop due to IRQ work | 7.1 | 0.0016 |  |
| [CVE-2025-38710](https://patchblox.com/security/data/cve/CVE-2025-38710.md) | High | gfs2: Validate i_depth for exhash directories | 7.0 | 0.0016 |  |
| [CVE-2025-39865](https://patchblox.com/security/data/cve/CVE-2025-39865.md) | High | tee: fix NULL pointer dereference in tee_shm_put | 7.0 | 0.0016 |  |
| [CVE-2025-39797](https://patchblox.com/security/data/cve/CVE-2025-39797.md) | High | xfrm: Duplicate SPI Handling | 7.8 | 0.0016 |  |
| [CVE-2025-39838](https://patchblox.com/security/data/cve/CVE-2025-39838.md) | High | cifs: prevent NULL pointer dereference in UTF16 conversion | 7.0 | 0.0016 |  |
| [CVE-2025-39746](https://patchblox.com/security/data/cve/CVE-2025-39746.md) | High | wifi: ath10k: shutdown driver when hardware is unreliable | 7.0 | 0.0016 |  |
| [CVE-2025-39711](https://patchblox.com/security/data/cve/CVE-2025-39711.md) | High | media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls | 7.8 | 0.0016 |  |
| [CVE-2025-38709](https://patchblox.com/security/data/cve/CVE-2025-38709.md) | High | loop: Avoid updating block size under exclusive owner | 7.0 | 0.0016 |  |
| [CVE-2025-39922](https://patchblox.com/security/data/cve/CVE-2025-39922.md) | High | kernel-64kb: ixgbe: fix incorrect map used in eee linkmode (bsc#1250722). | 7.1 | 0.0015 |  |
| [CVE-2025-39825](https://patchblox.com/security/data/cve/CVE-2025-39825.md) | High | smb: client: fix race with concurrent opens in rename(2) | 7.6 | 0.0012 |  |
| [CVE-2025-38526](https://patchblox.com/security/data/cve/CVE-2025-38526.md) | Routine | ice: add NULL check in eswitch lag check | 5.5 | 0.0041 |  |
| [CVE-2025-38514](https://patchblox.com/security/data/cve/CVE-2025-38514.md) | Routine | rxrpc: Fix oops due to non-existence of prealloc backlog struct | 6.5 | 0.0039 |  |
| [CVE-2025-39770](https://patchblox.com/security/data/cve/CVE-2025-39770.md) | Routine | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM | 5.7 | 0.0038 |  |
| [CVE-2025-39857](https://patchblox.com/security/data/cve/CVE-2025-39857.md) | Routine | net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() | 5.8 | 0.0031 |  |
| [CVE-2024-58090](https://patchblox.com/security/data/cve/CVE-2024-58090.md) | Routine | kernel-64kb: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324). | 5.5 | 0.0023 |  |
| [CVE-2025-38597](https://patchblox.com/security/data/cve/CVE-2025-38597.md) | Routine | drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port | 5.5 | 0.0022 |  |
| [CVE-2025-38705](https://patchblox.com/security/data/cve/CVE-2025-38705.md) | Routine | drm/amd/pm: fix null pointer access | 5.5 | 0.0020 |  |
| [CVE-2025-39705](https://patchblox.com/security/data/cve/CVE-2025-39705.md) | Routine | drm/amd/display: fix a Null pointer dereference vulnerability | 5.5 | 0.0020 |  |
| [CVE-2025-38408](https://patchblox.com/security/data/cve/CVE-2025-38408.md) | Routine | genirq/irq_sim: Initialize work context pointers properly | 5.5 | 0.0020 |  |
| [CVE-2025-38418](https://patchblox.com/security/data/cve/CVE-2025-38418.md) | Routine | remoteproc: core: Release rproc->clean_table after rproc_attach() fails | 5.5 | 0.0019 |  |
| [CVE-2025-38419](https://patchblox.com/security/data/cve/CVE-2025-38419.md) | Routine | remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() | 5.5 | 0.0019 |  |
| [CVE-2025-38639](https://patchblox.com/security/data/cve/CVE-2025-38639.md) | Routine | netfilter: xt_nfacct: don't assume acct name is null-terminated | 5.5 | 0.0019 |  |
| [CVE-2025-39830](https://patchblox.com/security/data/cve/CVE-2025-39830.md) | Routine | kernel-64kb: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (bsc#1249974). | 5.5 | 0.0019 |  |
| [CVE-2025-39834](https://patchblox.com/security/data/cve/CVE-2025-39834.md) | Routine | kernel-64kb: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (bsc#1250021). | 5.5 | 0.0019 |  |
| [CVE-2025-38643](https://patchblox.com/security/data/cve/CVE-2025-38643.md) | Routine | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | 5.5 | 0.0019 |  |
| [CVE-2025-38622](https://patchblox.com/security/data/cve/CVE-2025-38622.md) | Routine | net: drop UFO packets in udp_rcv_segment() | 5.5 | 0.0018 |  |
| [CVE-2025-38664](https://patchblox.com/security/data/cve/CVE-2025-38664.md) | Routine | ice: Fix a null pointer dereference in ice_copy_and_init_pkg() | 5.5 | 0.0018 |  |
| [CVE-2025-39681](https://patchblox.com/security/data/cve/CVE-2025-39681.md) | Routine | x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper | 5.5 | 0.0018 |  |
| [CVE-2025-38263](https://patchblox.com/security/data/cve/CVE-2025-38263.md) | Routine | bcache: fix NULL pointer in cache_set_flush() | 5.5 | 0.0018 |  |
| [CVE-2025-38402](https://patchblox.com/security/data/cve/CVE-2025-38402.md) | Routine | kernel-64kb: idpf: return 0 size for RSS key if not supported (bsc#1247262). | 5.5 | 0.0018 |  |
| [CVE-2025-38721](https://patchblox.com/security/data/cve/CVE-2025-38721.md) | Routine | netfilter: ctnetlink: fix refcount leak on table dump | 5.5 | 0.0018 |  |
| [CVE-2025-38640](https://patchblox.com/security/data/cve/CVE-2025-38640.md) | Routine | bpf: Disable migration in nf_hook_run_bpf(). | 5.5 | 0.0017 |  |
| [CVE-2025-39764](https://patchblox.com/security/data/cve/CVE-2025-39764.md) | Routine | netfilter: ctnetlink: remove refcounting in expectation dumpers | 5.5 | 0.0017 |  |
| [CVE-2025-38234](https://patchblox.com/security/data/cve/CVE-2025-38234.md) | Routine | sched/rt: Fix race in push_rt_task | 5.5 | 0.0017 |  |
| [CVE-2025-38659](https://patchblox.com/security/data/cve/CVE-2025-38659.md) | Routine | gfs2: No more self recovery | 5.5 | 0.0017 |  |
| [CVE-2025-39787](https://patchblox.com/security/data/cve/CVE-2025-39787.md) | Routine | soc: qcom: mdt_loader: Ensure we don't read past the ELF header | 5.5 | 0.0017 |  |
| [CVE-2025-39842](https://patchblox.com/security/data/cve/CVE-2025-39842.md) | Routine | ocfs2: prevent release journal inode after journal shutdown | 5.5 | 0.0017 |  |
| [CVE-2025-38623](https://patchblox.com/security/data/cve/CVE-2025-38623.md) | Routine | PCI: pnv_php: Fix surprise plug detection and recovery | 5.5 | 0.0017 |  |
| [CVE-2025-38628](https://patchblox.com/security/data/cve/CVE-2025-38628.md) | Routine | kernel-64kb: vdpa/mlx5: Fix release of uninitialized resources on error path (bsc#1248616). | 5.5 | 0.0017 |  |
| [CVE-2025-38255](https://patchblox.com/security/data/cve/CVE-2025-38255.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2025-38645](https://patchblox.com/security/data/cve/CVE-2025-38645.md) | Routine | net/mlx5: Check device memory pointer before usage | 5.5 | 0.0017 |  |
| [CVE-2025-38544](https://patchblox.com/security/data/cve/CVE-2025-38544.md) | Routine | rxrpc: Fix bug due to prealloc collision | 5.5 | 0.0016 |  |
| [CVE-2025-39678](https://patchblox.com/security/data/cve/CVE-2025-39678.md) | Routine | kernel-64kb: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (bsc#1249290). | 5.5 | 0.0016 |  |
| [CVE-2025-39695](https://patchblox.com/security/data/cve/CVE-2025-39695.md) | Routine | kernel-zfcpdump: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2025-39747](https://patchblox.com/security/data/cve/CVE-2025-39747.md) | Routine | drm/msm: Add error handling for krealloc in metadata setup | 5.5 | 0.0016 |  |
| [CVE-2025-39807](https://patchblox.com/security/data/cve/CVE-2025-39807.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2025-39811](https://patchblox.com/security/data/cve/CVE-2025-39811.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2025-39707](https://patchblox.com/security/data/cve/CVE-2025-39707.md) | Routine | drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities | 5.5 | 0.0015 |  |
| [CVE-2025-39890](https://patchblox.com/security/data/cve/CVE-2025-39890.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0015 |  |
| [CVE-2025-39816](https://patchblox.com/security/data/cve/CVE-2025-39816.md) | Routine | kernel-default-base: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths (bsc#1249906). | 6.1 | 0.0015 |  |
| [CVE-2023-53261](https://patchblox.com/security/data/cve/CVE-2023-53261.md) | Routine | coresight: Fix memory leak in acpi_buffer->pointer | 5.5 | 0.0015 |  |
| [CVE-2025-39754](https://patchblox.com/security/data/cve/CVE-2025-39754.md) | Routine | mm/smaps: fix race between smaps_hugetlb_range and migration | 5.5 | 0.0014 |  |
| [CVE-2025-39782](https://patchblox.com/security/data/cve/CVE-2025-39782.md) | Routine | kernel-64kb: jbd2: prevent softlockup in jbd2_log_do_checkpoint() (bsc#1249526). | 5.5 | 0.0013 |  |
| [CVE-2025-39773](https://patchblox.com/security/data/cve/CVE-2025-39773.md) | Routine | net: bridge: fix soft lockup in br_multicast_query_expired() | 5.5 | 0.0012 |  |
| [CVE-2025-39885](https://patchblox.com/security/data/cve/CVE-2025-39885.md) | Routine | ocfs2: fix recursive semaphore deadlock in fiemap call | 5.5 | 0.0012 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.