# SUSE-SU-2025:03633-1: Security update for 3 packages

SUSE-SU-2025:03633-1, released October 17, 2025, fixes 194 CVEs across 3 products. One of them is being exploited (CVE-2025-39682); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-03633-1
- Platform: Linux
- Released: Oct 17, 2025
- Priority: Patch now (Closes CVE-2025-39682, exploited (CISA KEV))
- CVEs: 194, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:03633-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.7 | 6.4.0-150700.20.15.2 |
| [kernel-source-azure](https://patchblox.com/security/data/product/linux/kernel-source-azure.md) | sles 15.7 | 6.4.0-150700.20.15.2 |
| [kernel-syms-azure](https://patchblox.com/security/data/product/linux/kernel-syms-azure.md) | sles 15.7 | 6.4.0-150700.20.15.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-39682](https://patchblox.com/security/data/cve/CVE-2025-39682.md) | Patch now | tls: fix handling of zero-length records on the rx_list | 9.8 | 0.0320 | CISA KEV |
| [CVE-2023-3867](https://patchblox.com/security/data/cve/CVE-2023-3867.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 7.1 | 0.0627 |  |
| [CVE-2025-38488](https://patchblox.com/security/data/cve/CVE-2025-38488.md) | High | kernel-livepatch-SLE15-SP7-RT_Update_0: This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.5 fixes various security issues  The following security... | 7.8 | 0.0077 |  |
| [CVE-2025-38566](https://patchblox.com/security/data/cve/CVE-2025-38566.md) | High | sunrpc: fix handling of server side tls alerts | 8.1 | 0.0063 |  |
| [CVE-2025-38439](https://patchblox.com/security/data/cve/CVE-2025-38439.md) | High | bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT | 7.8 | 0.0058 |  |
| [CVE-2025-38146](https://patchblox.com/security/data/cve/CVE-2025-38146.md) | High | net: openvswitch: Fix the dead loop of MPLS parse | 7.8 | 0.0049 |  |
| [CVE-2025-38472](https://patchblox.com/security/data/cve/CVE-2025-38472.md) | High | netfilter: nf_conntrack: fix crash due to removal of uninitialised entry | 7.5 | 0.0046 |  |
| [CVE-2025-38075](https://patchblox.com/security/data/cve/CVE-2025-38075.md) | High | scsi: target: iscsi: Fix timeout on deleted connection | 7.0 | 0.0046 |  |
| [CVE-2025-38527](https://patchblox.com/security/data/cve/CVE-2025-38527.md) | High | smb: client: fix use-after-free in cifs_oplock_break | 7.8 | 0.0046 |  |
| [CVE-2025-38676](https://patchblox.com/security/data/cve/CVE-2025-38676.md) | High | iommu/amd: Avoid stack buffer overflow from kernel cmdline | 7.8 | 0.0042 |  |
| [CVE-2025-38608](https://patchblox.com/security/data/cve/CVE-2025-38608.md) | High | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0041 |  |
| [CVE-2025-38590](https://patchblox.com/security/data/cve/CVE-2025-38590.md) | High | net/mlx5e: Remove skb secpath if xfrm state is not found | 7.5 | 0.0041 |  |
| [CVE-2025-38660](https://patchblox.com/security/data/cve/CVE-2025-38660.md) | High | [ceph] parse_longname(): strrchr() expects NUL-terminated string | 7.1 | 0.0041 |  |
| [CVE-2025-38563](https://patchblox.com/security/data/cve/CVE-2025-38563.md) | High | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0040 |  |
| [CVE-2025-38617](https://patchblox.com/security/data/cve/CVE-2025-38617.md) | High | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0040 |  |
| [CVE-2025-39703](https://patchblox.com/security/data/cve/CVE-2025-39703.md) | High | net, hsr: reject HSR frame if skb can't hold tag | 7.0 | 0.0039 |  |
| [CVE-2025-38574](https://patchblox.com/security/data/cve/CVE-2025-38574.md) | High | pptp: ensure minimal skb length in pptp_xmit() | 7.8 | 0.0039 |  |
| [CVE-2025-40300](https://patchblox.com/security/data/cve/CVE-2025-40300.md) | High | x86/vmscape: Add conditional IBPB mitigation | 7.3 | 0.0038 |  |
| [CVE-2025-38490](https://patchblox.com/security/data/cve/CVE-2025-38490.md) | High | net: libwx: remove duplicate page_pool_put_full_page() | 9.8 | 0.0036 |  |
| [CVE-2025-38571](https://patchblox.com/security/data/cve/CVE-2025-38571.md) | High | sunrpc: fix client side handling of tls alerts | 8.1 | 0.0035 |  |
| [CVE-2025-38533](https://patchblox.com/security/data/cve/CVE-2025-38533.md) | High | net: libwx: fix the using of Rx buffer DMA | 7.8 | 0.0033 |  |
| [CVE-2025-37885](https://patchblox.com/security/data/cve/CVE-2025-37885.md) | High | KVM: x86: Reset IRTE to host control if *new* route isn't postable | 7.8 | 0.0032 |  |
| [CVE-2025-38678](https://patchblox.com/security/data/cve/CVE-2025-38678.md) | High | netfilter: nf_tables: reject duplicate device on updates | 7.1 | 0.0029 |  |
| [CVE-2023-5633](https://patchblox.com/security/data/cve/CVE-2023-5633.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.8 | 0.0028 |  |
| [CVE-2025-38601](https://patchblox.com/security/data/cve/CVE-2025-38601.md) | High | wifi: ath11k: clear initialized flag for deinit-ed srng lists | 7.0 | 0.0025 |  |
| [CVE-2025-38512](https://patchblox.com/security/data/cve/CVE-2025-38512.md) | High | wifi: prevent A-MSDU attacks in mesh networks | 7.8 | 0.0025 |  |
| [CVE-2025-38201](https://patchblox.com/security/data/cve/CVE-2025-38201.md) | High | netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX | 7.8 | 0.0024 |  |
| [CVE-2025-38491](https://patchblox.com/security/data/cve/CVE-2025-38491.md) | High | mptcp: make fallback action and fallback decision atomic | 7.0 | 0.0024 |  |
| [CVE-2025-38466](https://patchblox.com/security/data/cve/CVE-2025-38466.md) | High | perf: Revert to requiring CAP_SYS_ADMIN for uprobes | 7.8 | 0.0023 |  |
| [CVE-2025-38103](https://patchblox.com/security/data/cve/CVE-2025-38103.md) | High | HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() | 7.1 | 0.0023 |  |
| [CVE-2025-38184](https://patchblox.com/security/data/cve/CVE-2025-38184.md) | High | tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer | 7.0 | 0.0022 |  |
| [CVE-2025-38585](https://patchblox.com/security/data/cve/CVE-2025-38585.md) | High | staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() | 7.8 | 0.0022 |  |
| [CVE-2025-38464](https://patchblox.com/security/data/cve/CVE-2025-38464.md) | High | tipc: Fix use-after-free in tipc_conn_close(). | 7.8 | 0.0022 |  |
| [CVE-2025-38582](https://patchblox.com/security/data/cve/CVE-2025-38582.md) | High | RDMA/hns: Fix double destruction of rsv_qp | 7.8 | 0.0022 |  |
| [CVE-2025-38595](https://patchblox.com/security/data/cve/CVE-2025-38595.md) | High | xen: fix UAF in dmabuf_exp_from_pages() | 7.8 | 0.0022 |  |
| [CVE-2025-39677](https://patchblox.com/security/data/cve/CVE-2025-39677.md) | High | net/sched: Fix backlog accounting in qdisc_dequeue_internal | 7.0 | 0.0021 |  |
| [CVE-2025-38616](https://patchblox.com/security/data/cve/CVE-2025-38616.md) | High | tls: handle data disappearing from under the TLS ULP | 7.1 | 0.0021 |  |
| [CVE-2025-38656](https://patchblox.com/security/data/cve/CVE-2025-38656.md) | High | wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() | 7.8 | 0.0021 |  |
| [CVE-2025-38459](https://patchblox.com/security/data/cve/CVE-2025-38459.md) | High | atm: clip: Fix infinite recursive call of clip_push(). | 7.8 | 0.0021 |  |
| [CVE-2025-38722](https://patchblox.com/security/data/cve/CVE-2025-38722.md) | High | habanalabs: fix UAF in export_dmabuf() | 7.8 | 0.0021 |  |
| [CVE-2025-22022](https://patchblox.com/security/data/cve/CVE-2025-22022.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.8 | 0.0020 |  |
| [CVE-2025-38445](https://patchblox.com/security/data/cve/CVE-2025-38445.md) | High | md/raid1: Fix stack memory use after return in raid1_reshape | 7.1 | 0.0020 |  |
| [CVE-2025-38125](https://patchblox.com/security/data/cve/CVE-2025-38125.md) | High | net: stmmac: make sure that ptp_rate is not 0 before configuring EST | 7.0 | 0.0020 |  |
| [CVE-2025-38529](https://patchblox.com/security/data/cve/CVE-2025-38529.md) | High | comedi: aio_iiro_16: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38530](https://patchblox.com/security/data/cve/CVE-2025-38530.md) | High | comedi: pcl812: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38119](https://patchblox.com/security/data/cve/CVE-2025-38119.md) | High | scsi: core: ufs: Fix a hang in the error handler | 7.0 | 0.0020 |  |
| [CVE-2025-38605](https://patchblox.com/security/data/cve/CVE-2025-38605.md) | High | wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() | 7.0 | 0.0020 |  |
| [CVE-2025-38458](https://patchblox.com/security/data/cve/CVE-2025-38458.md) | High | atm: clip: Fix NULL pointer dereference in vcc_sendmsg() | 7.0 | 0.0020 |  |
| [CVE-2025-39691](https://patchblox.com/security/data/cve/CVE-2025-39691.md) | High | fs/buffer: fix use-after-free when call bh_read() helper | 7.8 | 0.0019 |  |
| [CVE-2025-38351](https://patchblox.com/security/data/cve/CVE-2025-38351.md) | High | KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush | 7.5 | 0.0019 |  |
| [CVE-2025-38565](https://patchblox.com/security/data/cve/CVE-2025-38565.md) | High | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0019 |  |
| [CVE-2025-38572](https://patchblox.com/security/data/cve/CVE-2025-38572.md) | High | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0019 |  |
| [CVE-2025-38456](https://patchblox.com/security/data/cve/CVE-2025-38456.md) | High | ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() | 7.8 | 0.0019 |  |
| [CVE-2025-38701](https://patchblox.com/security/data/cve/CVE-2025-38701.md) | High | ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | 7.0 | 0.0019 |  |
| [CVE-2025-38245](https://patchblox.com/security/data/cve/CVE-2025-38245.md) | High | atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). | 7.8 | 0.0019 |  |
| [CVE-2025-38538](https://patchblox.com/security/data/cve/CVE-2025-38538.md) | High | dmaengine: nbpfaxi: Fix memory corruption in probe() | 7.8 | 0.0019 |  |
| [CVE-2025-38499](https://patchblox.com/security/data/cve/CVE-2025-38499.md) | High | clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns | 8.2 | 0.0019 |  |
| [CVE-2025-38535](https://patchblox.com/security/data/cve/CVE-2025-38535.md) | High | phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode | 7.8 | 0.0019 |  |
| [CVE-2025-38555](https://patchblox.com/security/data/cve/CVE-2025-38555.md) | High | usb: gadget : fix use-after-free in composite_dev_cleanup() | 7.8 | 0.0019 |  |
| [CVE-2025-38614](https://patchblox.com/security/data/cve/CVE-2025-38614.md) | High | eventpoll: Fix semi-unbounded recursion | 7.5 | 0.0019 |  |
| [CVE-2025-39766](https://patchblox.com/security/data/cve/CVE-2025-39766.md) | High | net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit | 8.1 | 0.0018 |  |
| [CVE-2025-38581](https://patchblox.com/security/data/cve/CVE-2025-38581.md) | High | crypto: ccp - Fix crash when rebind ccp device for ccp.ko | 7.0 | 0.0018 |  |
| [CVE-2025-38684](https://patchblox.com/security/data/cve/CVE-2025-38684.md) | High | net/sched: ets: use old 'nbands' while purging unused classes | 7.0 | 0.0018 |  |
| [CVE-2025-38732](https://patchblox.com/security/data/cve/CVE-2025-38732.md) | High | netfilter: nf_reject: don't leak dst refcount for loopback packets | 7.0 | 0.0018 |  |
| [CVE-2025-38548](https://patchblox.com/security/data/cve/CVE-2025-38548.md) | High | hwmon: (corsair-cpro) Validate the size of the received input buffer | 7.8 | 0.0018 |  |
| [CVE-2025-38584](https://patchblox.com/security/data/cve/CVE-2025-38584.md) | High | padata: Fix pd UAF once and for all | 7.8 | 0.0018 |  |
| [CVE-2025-38618](https://patchblox.com/security/data/cve/CVE-2025-38618.md) | High | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 |  |
| [CVE-2025-38160](https://patchblox.com/security/data/cve/CVE-2025-38160.md) | High | clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() | 7.0 | 0.0018 |  |
| [CVE-2025-38208](https://patchblox.com/security/data/cve/CVE-2025-38208.md) | High | smb: client: add NULL check in automount_fullpath | 7.0 | 0.0018 |  |
| [CVE-2025-39823](https://patchblox.com/security/data/cve/CVE-2025-39823.md) | High | KVM: x86: use array_index_nospec with indices that come from guest | 7.8 | 0.0018 |  |
| [CVE-2025-38560](https://patchblox.com/security/data/cve/CVE-2025-38560.md) | High | x86/sev: Evict cache lines during SNP memory validation | 7.5 | 0.0018 |  |
| [CVE-2025-38216](https://patchblox.com/security/data/cve/CVE-2025-38216.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.8 | 0.0018 |  |
| [CVE-2025-38593](https://patchblox.com/security/data/cve/CVE-2025-38593.md) | High | Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' | 7.8 | 0.0018 |  |
| [CVE-2025-38568](https://patchblox.com/security/data/cve/CVE-2025-38568.md) | High | net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing | 7.8 | 0.0018 |  |
| [CVE-2025-38703](https://patchblox.com/security/data/cve/CVE-2025-38703.md) | High | drm/xe: Make dma-fences compliant with the safe access rules | 7.8 | 0.0018 |  |
| [CVE-2025-39738](https://patchblox.com/security/data/cve/CVE-2025-39738.md) | High | btrfs: do not allow relocation of partially dropped subvolumes | 7.8 | 0.0018 |  |
| [CVE-2025-39749](https://patchblox.com/security/data/cve/CVE-2025-39749.md) | High | rcu: Protect ->defer_qs_iw_pending from data race | 7.0 | 0.0017 |  |
| [CVE-2025-38550](https://patchblox.com/security/data/cve/CVE-2025-38550.md) | High | ipv6: mcast: Delay put pmc->idev in mld_del_delrec() | 7.8 | 0.0017 |  |
| [CVE-2025-38730](https://patchblox.com/security/data/cve/CVE-2025-38730.md) | High | io_uring/net: commit partial buffers on retry | 7.8 | 0.0017 |  |
| [CVE-2025-39835](https://patchblox.com/security/data/cve/CVE-2025-39835.md) | High | xfs: do not propagate ENODATA disk errors into xattr code | 7.8 | 0.0017 |  |
| [CVE-2025-38679](https://patchblox.com/security/data/cve/CVE-2025-38679.md) | High | media: venus: Fix OOB read due to missing payload bound check | 7.1 | 0.0017 |  |
| [CVE-2025-38556](https://patchblox.com/security/data/cve/CVE-2025-38556.md) | High | HID: core: Harden s32ton() against conversion to 0 bits | 8.0 | 0.0017 |  |
| [CVE-2025-38668](https://patchblox.com/security/data/cve/CVE-2025-38668.md) | High | regulator: core: fix NULL dereference on unbind due to stale coupling data | 7.0 | 0.0017 |  |
| [CVE-2025-38500](https://patchblox.com/security/data/cve/CVE-2025-38500.md) | High | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0017 |  |
| [CVE-2025-38587](https://patchblox.com/security/data/cve/CVE-2025-38587.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.0 | 0.0017 |  |
| [CVE-2025-39718](https://patchblox.com/security/data/cve/CVE-2025-39718.md) | High | vsock/virtio: Validate length in packet header before skb_put() | 7.8 | 0.0017 |  |
| [CVE-2025-38670](https://patchblox.com/security/data/cve/CVE-2025-38670.md) | High | arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() | 7.1 | 0.0017 |  |
| [CVE-2025-38609](https://patchblox.com/security/data/cve/CVE-2025-38609.md) | High | PM / devfreq: Check governor before using governor->name | 7.8 | 0.0017 |  |
| [CVE-2025-38521](https://patchblox.com/security/data/cve/CVE-2025-38521.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.1 | 0.0017 |  |
| [CVE-2025-38543](https://patchblox.com/security/data/cve/CVE-2025-38543.md) | High | drm/tegra: nvdec: Fix dma_alloc_coherent error check | 7.1 | 0.0017 |  |
| [CVE-2025-39744](https://patchblox.com/security/data/cve/CVE-2025-39744.md) | High | rcu: Fix rcu_read_unlock() deadloop due to IRQ work | 7.1 | 0.0016 |  |
| [CVE-2025-38710](https://patchblox.com/security/data/cve/CVE-2025-38710.md) | High | gfs2: Validate i_depth for exhash directories | 7.0 | 0.0016 |  |
| [CVE-2025-39865](https://patchblox.com/security/data/cve/CVE-2025-39865.md) | High | tee: fix NULL pointer dereference in tee_shm_put | 7.0 | 0.0016 |  |
| [CVE-2025-39838](https://patchblox.com/security/data/cve/CVE-2025-39838.md) | High | cifs: prevent NULL pointer dereference in UTF16 conversion | 7.0 | 0.0016 |  |
| [CVE-2025-39746](https://patchblox.com/security/data/cve/CVE-2025-39746.md) | High | wifi: ath10k: shutdown driver when hardware is unreliable | 7.0 | 0.0016 |  |
| [CVE-2025-39711](https://patchblox.com/security/data/cve/CVE-2025-39711.md) | High | media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls | 7.8 | 0.0016 |  |
| [CVE-2025-38665](https://patchblox.com/security/data/cve/CVE-2025-38665.md) | High | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 |  |
| [CVE-2025-38709](https://patchblox.com/security/data/cve/CVE-2025-38709.md) | High | loop: Avoid updating block size under exclusive owner | 7.0 | 0.0016 |  |
| [CVE-2025-39922](https://patchblox.com/security/data/cve/CVE-2025-39922.md) | High | kernel-default: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.1 | 0.0015 |  |
| [CVE-2025-38440](https://patchblox.com/security/data/cve/CVE-2025-38440.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 7.0 | 0.0014 |  |
| [CVE-2025-39825](https://patchblox.com/security/data/cve/CVE-2025-39825.md) | High | smb: client: fix race with concurrent opens in rename(2) | 7.6 | 0.0012 |  |
| [CVE-2023-4130](https://patchblox.com/security/data/cve/CVE-2023-4130.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0051 |  |
| [CVE-2025-38526](https://patchblox.com/security/data/cve/CVE-2025-38526.md) | Routine | ice: add NULL check in eswitch lag check | 5.5 | 0.0041 |  |
| [CVE-2025-38514](https://patchblox.com/security/data/cve/CVE-2025-38514.md) | Routine | rxrpc: Fix oops due to non-existence of prealloc backlog struct | 6.5 | 0.0039 |  |
| [CVE-2025-39770](https://patchblox.com/security/data/cve/CVE-2025-39770.md) | Routine | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM | 5.7 | 0.0038 |  |
| [CVE-2024-58239](https://patchblox.com/security/data/cve/CVE-2024-58239.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.9 | 0.0036 |  |
| [CVE-2023-4515](https://patchblox.com/security/data/cve/CVE-2023-4515.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0033 |  |
| [CVE-2025-38524](https://patchblox.com/security/data/cve/CVE-2025-38524.md) | Routine | rxrpc: Fix recv-recv race of completed call | 4.7 | 0.0032 |  |
| [CVE-2025-39857](https://patchblox.com/security/data/cve/CVE-2025-39857.md) | Routine | net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() | 5.8 | 0.0031 |  |
| [CVE-2024-58090](https://patchblox.com/security/data/cve/CVE-2024-58090.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0023 |  |
| [CVE-2024-26661](https://patchblox.com/security/data/cve/CVE-2024-26661.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0023 |  |
| [CVE-2025-38591](https://patchblox.com/security/data/cve/CVE-2025-38591.md) | Routine | bpf: Reject narrower access to pointer ctx fields | 5.5 | 0.0021 |  |
| [CVE-2025-38190](https://patchblox.com/security/data/cve/CVE-2025-38190.md) | Routine | atm: Revert atm_account_tx() if copy_from_iter_full() fails. | 5.5 | 0.0021 |  |
| [CVE-2025-38597](https://patchblox.com/security/data/cve/CVE-2025-38597.md) | Routine | drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port | 5.5 | 0.0021 |  |
| [CVE-2025-38705](https://patchblox.com/security/data/cve/CVE-2025-38705.md) | Routine | drm/amd/pm: fix null pointer access | 5.5 | 0.0020 |  |
| [CVE-2025-39705](https://patchblox.com/security/data/cve/CVE-2025-39705.md) | Routine | drm/amd/display: fix a Null pointer dereference vulnerability | 5.5 | 0.0020 |  |
| [CVE-2025-38408](https://patchblox.com/security/data/cve/CVE-2025-38408.md) | Routine | genirq/irq_sim: Initialize work context pointers properly | 5.5 | 0.0020 |  |
| [CVE-2025-38185](https://patchblox.com/security/data/cve/CVE-2025-38185.md) | Routine | atm: atmtcp: Free invalid length skb in atmtcp_c_send(). | 5.5 | 0.0020 |  |
| [CVE-2025-38006](https://patchblox.com/security/data/cve/CVE-2025-38006.md) | Routine | net: mctp: Don't access ifa_index when missing | 5.5 | 0.0020 |  |
| [CVE-2025-38441](https://patchblox.com/security/data/cve/CVE-2025-38441.md) | Routine | kernel-debug-modules: The kernel packages contain the Linux kernel, the core of any Linux operating system | 5.5 | 0.0019 |  |
| [CVE-2025-38418](https://patchblox.com/security/data/cve/CVE-2025-38418.md) | Routine | remoteproc: core: Release rproc->clean_table after rproc_attach() fails | 5.5 | 0.0019 |  |
| [CVE-2025-38419](https://patchblox.com/security/data/cve/CVE-2025-38419.md) | Routine | remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() | 5.5 | 0.0019 |  |
| [CVE-2025-38639](https://patchblox.com/security/data/cve/CVE-2025-38639.md) | Routine | netfilter: xt_nfacct: don't assume acct name is null-terminated | 5.5 | 0.0019 |  |
| [CVE-2025-39830](https://patchblox.com/security/data/cve/CVE-2025-39830.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: HWS, Fix memory leak in hws_pool_buddy... | 5.5 | 0.0019 |  |
| [CVE-2025-39834](https://patchblox.com/security/data/cve/CVE-2025-39834.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: HWS, Fix memory leak in hws_action_get... | 5.5 | 0.0019 |  |
| [CVE-2025-38643](https://patchblox.com/security/data/cve/CVE-2025-38643.md) | Routine | wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() | 5.5 | 0.0019 |  |
| [CVE-2025-38622](https://patchblox.com/security/data/cve/CVE-2025-38622.md) | Routine | net: drop UFO packets in udp_rcv_segment() | 5.5 | 0.0018 |  |
| [CVE-2025-38664](https://patchblox.com/security/data/cve/CVE-2025-38664.md) | Routine | ice: Fix a null pointer dereference in ice_copy_and_init_pkg() | 5.5 | 0.0018 |  |
| [CVE-2025-39681](https://patchblox.com/security/data/cve/CVE-2025-39681.md) | Routine | x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper | 5.5 | 0.0018 |  |
| [CVE-2025-38205](https://patchblox.com/security/data/cve/CVE-2025-38205.md) | Routine | drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 | 5.5 | 0.0018 |  |
| [CVE-2025-38513](https://patchblox.com/security/data/cve/CVE-2025-38513.md) | Routine | wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() | 5.5 | 0.0018 |  |
| [CVE-2025-38516](https://patchblox.com/security/data/cve/CVE-2025-38516.md) | Routine | pinctrl: qcom: msm: mark certain pins as invalid for interrupts | 5.5 | 0.0018 |  |
| [CVE-2025-38528](https://patchblox.com/security/data/cve/CVE-2025-38528.md) | Routine | bpf: Reject %p% format string in bprintf-like helpers | 5.5 | 0.0018 |  |
| [CVE-2025-38540](https://patchblox.com/security/data/cve/CVE-2025-38540.md) | Routine | HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras | 5.5 | 0.0018 |  |
| [CVE-2025-38546](https://patchblox.com/security/data/cve/CVE-2025-38546.md) | Routine | atm: clip: Fix memory leak of struct clip_vcc. | 5.5 | 0.0018 |  |
| [CVE-2025-38612](https://patchblox.com/security/data/cve/CVE-2025-38612.md) | Routine | staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() | 5.5 | 0.0018 |  |
| [CVE-2025-38635](https://patchblox.com/security/data/cve/CVE-2025-38635.md) | Routine | clk: davinci: Add NULL check in davinci_lpsc_clk_register() | 5.5 | 0.0018 |  |
| [CVE-2025-38663](https://patchblox.com/security/data/cve/CVE-2025-38663.md) | Routine | nilfs2: reject invalid file types when reading inodes | 5.5 | 0.0018 |  |
| [CVE-2025-38444](https://patchblox.com/security/data/cve/CVE-2025-38444.md) | Routine | raid10: cleanup memleak at raid10_make_request | 5.5 | 0.0018 |  |
| [CVE-2025-38251](https://patchblox.com/security/data/cve/CVE-2025-38251.md) | Routine | atm: clip: prevent NULL deref in clip_push() | 5.5 | 0.0018 |  |
| [CVE-2025-38263](https://patchblox.com/security/data/cve/CVE-2025-38263.md) | Routine | bcache: fix NULL pointer in cache_set_flush() | 5.5 | 0.0018 |  |
| [CVE-2025-38604](https://patchblox.com/security/data/cve/CVE-2025-38604.md) | Routine | wifi: rtl818x: Kill URBs before clearing tx status queue | 5.5 | 0.0018 |  |
| [CVE-2025-38402](https://patchblox.com/security/data/cve/CVE-2025-38402.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0018 |  |
| [CVE-2025-38531](https://patchblox.com/security/data/cve/CVE-2025-38531.md) | Routine | iio: common: st_sensors: Fix use of uninitialize device structs | 5.5 | 0.0018 |  |
| [CVE-2025-38721](https://patchblox.com/security/data/cve/CVE-2025-38721.md) | Routine | netfilter: ctnetlink: fix refcount leak on table dump | 5.5 | 0.0018 |  |
| [CVE-2025-38630](https://patchblox.com/security/data/cve/CVE-2025-38630.md) | Routine | fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref | 5.5 | 0.0017 |  |
| [CVE-2025-38640](https://patchblox.com/security/data/cve/CVE-2025-38640.md) | Routine | bpf: Disable migration in nf_hook_run_bpf(). | 5.5 | 0.0017 |  |
| [CVE-2024-58238](https://patchblox.com/security/data/cve/CVE-2024-58238.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-39764](https://patchblox.com/security/data/cve/CVE-2025-39764.md) | Routine | netfilter: ctnetlink: remove refcounting in expectation dumpers | 5.5 | 0.0017 |  |
| [CVE-2025-38234](https://patchblox.com/security/data/cve/CVE-2025-38234.md) | Routine | sched/rt: Fix race in push_rt_task | 5.5 | 0.0017 |  |
| [CVE-2025-38659](https://patchblox.com/security/data/cve/CVE-2025-38659.md) | Routine | gfs2: No more self recovery | 5.5 | 0.0017 |  |
| [CVE-2025-39787](https://patchblox.com/security/data/cve/CVE-2025-39787.md) | Routine | soc: qcom: mdt_loader: Ensure we don't read past the ELF header | 5.5 | 0.0017 |  |
| [CVE-2024-46733](https://patchblox.com/security/data/cve/CVE-2024-46733.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38511](https://patchblox.com/security/data/cve/CVE-2025-38511.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38576](https://patchblox.com/security/data/cve/CVE-2025-38576.md) | Routine | powerpc/eeh: Make EEH driver device hotplug safe | 5.5 | 0.0017 |  |
| [CVE-2025-39842](https://patchblox.com/security/data/cve/CVE-2025-39842.md) | Routine | ocfs2: prevent release journal inode after journal shutdown | 5.5 | 0.0017 |  |
| [CVE-2025-38515](https://patchblox.com/security/data/cve/CVE-2025-38515.md) | Routine | drm/sched: Increment job count before swapping tail spsc queue | 5.5 | 0.0017 |  |
| [CVE-2025-38623](https://patchblox.com/security/data/cve/CVE-2025-38623.md) | Routine | PCI: pnv_php: Fix surprise plug detection and recovery | 5.5 | 0.0017 |  |
| [CVE-2025-38624](https://patchblox.com/security/data/cve/CVE-2025-38624.md) | Routine | PCI: pnv_php: Clean up allocated IRQs on unplug | 5.5 | 0.0017 |  |
| [CVE-2025-38602](https://patchblox.com/security/data/cve/CVE-2025-38602.md) | Routine | iwlwifi: Add missing check for alloc_ordered_workqueue | 5.5 | 0.0017 |  |
| [CVE-2025-38671](https://patchblox.com/security/data/cve/CVE-2025-38671.md) | Routine | i2c: qup: jump out of the loop in case of timeout | 5.5 | 0.0017 |  |
| [CVE-2025-38588](https://patchblox.com/security/data/cve/CVE-2025-38588.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38610](https://patchblox.com/security/data/cve/CVE-2025-38610.md) | Routine | powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() | 5.5 | 0.0017 |  |
| [CVE-2025-38628](https://patchblox.com/security/data/cve/CVE-2025-38628.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38644](https://patchblox.com/security/data/cve/CVE-2025-38644.md) | Routine | wifi: mac80211: reject TDLS operations when station is not associated | 5.5 | 0.0017 |  |
| [CVE-2025-38255](https://patchblox.com/security/data/cve/CVE-2025-38255.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38510](https://patchblox.com/security/data/cve/CVE-2025-38510.md) | Routine | kasan: remove kasan_find_vm_area() to prevent possible deadlock | 5.5 | 0.0017 |  |
| [CVE-2025-38583](https://patchblox.com/security/data/cve/CVE-2025-38583.md) | Routine | clk: xilinx: vcu: unregister pll_post only if registered correctly | 5.5 | 0.0017 |  |
| [CVE-2025-38634](https://patchblox.com/security/data/cve/CVE-2025-38634.md) | Routine | power: supply: cpcap-charger: Fix null check for power_supply_get_by_name | 5.5 | 0.0017 |  |
| [CVE-2025-38645](https://patchblox.com/security/data/cve/CVE-2025-38645.md) | Routine | net/mlx5: Check device memory pointer before usage | 5.5 | 0.0017 |  |
| [CVE-2025-38646](https://patchblox.com/security/data/cve/CVE-2025-38646.md) | Routine | wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band | 6.5 | 0.0017 |  |
| [CVE-2025-38621](https://patchblox.com/security/data/cve/CVE-2025-38621.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0017 |  |
| [CVE-2025-38503](https://patchblox.com/security/data/cve/CVE-2025-38503.md) | Routine | btrfs: fix assertion when building free space tree | 5.5 | 0.0016 |  |
| [CVE-2025-38537](https://patchblox.com/security/data/cve/CVE-2025-38537.md) | Routine | net: phy: Don't register LEDs for genphy | 5.5 | 0.0016 |  |
| [CVE-2025-38544](https://patchblox.com/security/data/cve/CVE-2025-38544.md) | Routine | rxrpc: Fix bug due to prealloc collision | 5.5 | 0.0016 |  |
| [CVE-2025-39678](https://patchblox.com/security/data/cve/CVE-2025-39678.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0016 |  |
| [CVE-2025-39695](https://patchblox.com/security/data/cve/CVE-2025-39695.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/rxe: Flush delayed SKBs while releasing RXE... | 5.5 | 0.0016 |  |
| [CVE-2025-38541](https://patchblox.com/security/data/cve/CVE-2025-38541.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0016 |  |
| [CVE-2025-39747](https://patchblox.com/security/data/cve/CVE-2025-39747.md) | Routine | drm/msm: Add error handling for krealloc in metadata setup | 5.5 | 0.0016 |  |
| [CVE-2025-39807](https://patchblox.com/security/data/cve/CVE-2025-39807.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/mediatek: Add error handling for old state C... | 5.5 | 0.0016 |  |
| [CVE-2025-39811](https://patchblox.com/security/data/cve/CVE-2025-39811.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/xe/vm: Clear the scratch_pt pointer on error... | 5.5 | 0.0016 |  |
| [CVE-2025-39707](https://patchblox.com/security/data/cve/CVE-2025-39707.md) | Routine | drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities | 5.5 | 0.0015 |  |
| [CVE-2025-39890](https://patchblox.com/security/data/cve/CVE-2025-39890.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix memory leak in ath12k_service_... | 5.5 | 0.0015 |  |
| [CVE-2025-39816](https://patchblox.com/security/data/cve/CVE-2025-39816.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/kbuf: always use READ_ONCE() to read ri... | 6.1 | 0.0015 |  |
| [CVE-2023-53261](https://patchblox.com/security/data/cve/CVE-2023-53261.md) | Routine | coresight: Fix memory leak in acpi_buffer->pointer | 5.5 | 0.0015 |  |
| [CVE-2025-38632](https://patchblox.com/security/data/cve/CVE-2025-38632.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 4.7 | 0.0014 |  |
| [CVE-2025-39754](https://patchblox.com/security/data/cve/CVE-2025-39754.md) | Routine | mm/smaps: fix race between smaps_hugetlb_range and migration | 5.5 | 0.0014 |  |
| [CVE-2025-38650](https://patchblox.com/security/data/cve/CVE-2025-38650.md) | Routine | hfsplus: remove mutex_lock check in hfsplus_free_extents | 5.5 | 0.0014 |  |
| [CVE-2025-39782](https://patchblox.com/security/data/cve/CVE-2025-39782.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  jbd2: prevent softlockup in jbd2_log_do_checkpoi... | 5.5 | 0.0013 |  |
| [CVE-2025-38520](https://patchblox.com/security/data/cve/CVE-2025-38520.md) | Routine | drm/amdkfd: Don't call mmput from MMU notifier callback | 5.5 | 0.0013 |  |
| [CVE-2025-38506](https://patchblox.com/security/data/cve/CVE-2025-38506.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.   The following security bu... | 5.5 | 0.0013 |  |
| [CVE-2025-39773](https://patchblox.com/security/data/cve/CVE-2025-39773.md) | Routine | net: bridge: fix soft lockup in br_multicast_query_expired() | 5.5 | 0.0012 |  |
| [CVE-2025-39885](https://patchblox.com/security/data/cve/CVE-2025-39885.md) | Routine | ocfs2: fix recursive semaphore deadlock in fiemap call | 5.5 | 0.0012 |  |
| [CVE-2025-38553](https://patchblox.com/security/data/cve/CVE-2025-38553.md) | Routine | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a |  |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.