# SUSE-SU-2025:0955-1: Security update for 5 packages

SUSE-SU-2025:0955-1, released March 19, 2025, fixes 71 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-0955-1
- Platform: Linux
- Released: Mar 19, 2025
- Priority: Urgent (Closes CVE-2024-53177, rated Critical)
- CVEs: 71, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:0955-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-livepatch-SLE15-SP6-RT_Update_9](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp6-rt-update-9.md) | sles 15.6 | 1-150600.1.3.2 |
| [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.29.1 |
| [kernel-rt_debug](https://patchblox.com/security/data/product/linux/kernel-rt-debug-kernel-rt-debug.md) | opensuse-leap 15.6 | 6.4.0-150600.10.29.1 |
| [kernel-source-rt](https://patchblox.com/security/data/product/linux/kernel-source-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.29.1 |
| [kernel-syms-rt](https://patchblox.com/security/data/product/linux/kernel-syms-rt.md) | opensuse-leap 15.6 | 6.4.0-150600.10.29.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-53177](https://patchblox.com/security/data/cve/CVE-2024-53177.md) | Urgent | kernel-64kb: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896). | 9.8 | 0.0055 |  |
| [CVE-2025-21795](https://patchblox.com/security/data/cve/CVE-2025-21795.md) | High | kernel: kernel: NFSD: fix hang in nfsd4_shutdown_callback | 7.8 | 0.0067 |  |
| [CVE-2025-21692](https://patchblox.com/security/data/cve/CVE-2025-21692.md) | High | kernel-64kb: net: sched: fix ets qdisc OOB Indexing (bsc#1237028). | 7.8 | 0.0062 |  |
| [CVE-2024-50029](https://patchblox.com/security/data/cve/CVE-2024-50029.md) | High | kernel-64kb: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949). | 7.8 | 0.0037 |  |
| [CVE-2024-49950](https://patchblox.com/security/data/cve/CVE-2024-49950.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0037 |  |
| [CVE-2024-53239](https://patchblox.com/security/data/cve/CVE-2024-53239.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0029 |  |
| [CVE-2025-21647](https://patchblox.com/security/data/cve/CVE-2025-21647.md) | High | kernel-64kb: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133). | 7.8 | 0.0028 |  |
| [CVE-2024-56633](https://patchblox.com/security/data/cve/CVE-2024-56633.md) | High | kernel-64kb: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485). | 7.8 | 0.0028 |  |
| [CVE-2024-49884](https://patchblox.com/security/data/cve/CVE-2024-49884.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0028 |  |
| [CVE-2024-44974](https://patchblox.com/security/data/cve/CVE-2024-44974.md) | High | dtb-aarch64: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235). | 7.8 | 0.0027 |  |
| [CVE-2024-53173](https://patchblox.com/security/data/cve/CVE-2024-53173.md) | High | kernel-azure: Security update for the Linux Kernel | 7.8 | 0.0027 |  |
| [CVE-2024-50073](https://patchblox.com/security/data/cve/CVE-2024-50073.md) | High | tty: n_gsm: Fix use-after-free in gsm_cleanup_mux | 7.8 | 0.0026 |  |
| [CVE-2024-41055](https://patchblox.com/security/data/cve/CVE-2024-41055.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0026 |  |
| [CVE-2024-53147](https://patchblox.com/security/data/cve/CVE-2024-53147.md) | High | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0025 |  |
| [CVE-2024-47701](https://patchblox.com/security/data/cve/CVE-2024-47701.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 |  |
| [CVE-2024-56548](https://patchblox.com/security/data/cve/CVE-2024-56548.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 |  |
| [CVE-2024-50036](https://patchblox.com/security/data/cve/CVE-2024-50036.md) | High | kernel-64kb: net: do not delay dst_entries_add() in dst_release() (bsc#1231912). | 7.0 | 0.0025 |  |
| [CVE-2024-50115](https://patchblox.com/security/data/cve/CVE-2024-50115.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0025 |  |
| [CVE-2024-56605](https://patchblox.com/security/data/cve/CVE-2024-56605.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 |  |
| [CVE-2025-21715](https://patchblox.com/security/data/cve/CVE-2025-21715.md) | High | kernel-64kb: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889). | 7.8 | 0.0024 |  |
| [CVE-2025-21687](https://patchblox.com/security/data/cve/CVE-2025-21687.md) | High | kernel-64kb: vfio/platform: check the bounds of read/write syscalls (bsc#1237045). | 7.8 | 0.0024 |  |
| [CVE-2025-21700](https://patchblox.com/security/data/cve/CVE-2025-21700.md) | High | kernel-64kb: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159). | 7.8 | 0.0023 |  |
| [CVE-2025-21790](https://patchblox.com/security/data/cve/CVE-2025-21790.md) | High | kernel-modules-core: kernel: vxlan: check vxlan_vnigroup_init() return value | 7.8 | 0.0023 |  |
| [CVE-2025-21680](https://patchblox.com/security/data/cve/CVE-2025-21680.md) | High | kernel-64kb: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700). | 7.8 | 0.0023 |  |
| [CVE-2025-21728](https://patchblox.com/security/data/cve/CVE-2025-21728.md) | High | kernel-64kb: bpf: Send signals asynchronously if !preemptible (bsc#1237879). | 7.8 | 0.0021 |  |
| [CVE-2025-21719](https://patchblox.com/security/data/cve/CVE-2025-21719.md) | High | kernel-64kb: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860). | 7.1 | 0.0021 |  |
| [CVE-2024-26810](https://patchblox.com/security/data/cve/CVE-2024-26810.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  vfio/pci: Lock external INTx masking ops  Mask o... | 7.8 | 0.0020 |  |
| [CVE-2025-21724](https://patchblox.com/security/data/cve/CVE-2025-21724.md) | High | kernel-64kb: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863). | 7.8 | 0.0019 |  |
| [CVE-2024-50294](https://patchblox.com/security/data/cve/CVE-2024-50294.md) | High | kernel-64kb: rxrpc: Fix missing locking causing hanging calls (bsc#1233483). | 7.8 | 0.0017 |  |
| [CVE-2024-40980](https://patchblox.com/security/data/cve/CVE-2024-40980.md) | Routine | dtb-aarch64: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937). | 5.5 | 0.0076 |  |
| [CVE-2024-53226](https://patchblox.com/security/data/cve/CVE-2024-53226.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0073 |  |
| [CVE-2024-50185](https://patchblox.com/security/data/cve/CVE-2024-50185.md) | Routine | kernel-64kb: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109). | 5.5 | 0.0056 |  |
| [CVE-2024-53176](https://patchblox.com/security/data/cve/CVE-2024-53176.md) | Routine | kernel-64kb: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894). | 5.5 | 0.0056 |  |
| [CVE-2024-53178](https://patchblox.com/security/data/cve/CVE-2024-53178.md) | Routine | kernel-64kb: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895). | 6.3 | 0.0054 |  |
| [CVE-2024-45009](https://patchblox.com/security/data/cve/CVE-2024-45009.md) | Routine | dtb-aarch64: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438). | 5.5 | 0.0052 |  |
| [CVE-2024-50085](https://patchblox.com/security/data/cve/CVE-2024-50085.md) | Routine | kernel-64kb: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508). | 5.5 | 0.0048 |  |
| [CVE-2025-21673](https://patchblox.com/security/data/cve/CVE-2025-21673.md) | Routine | smb: client: fix double free of TCP_Server_Info::hostname | 5.5 | 0.0042 |  |
| [CVE-2025-21725](https://patchblox.com/security/data/cve/CVE-2025-21725.md) | Routine | kernel-64kb: smb: client: fix oops due to unset link speed (bsc#1238877). | 5.5 | 0.0040 |  |
| [CVE-2024-56539](https://patchblox.com/security/data/cve/CVE-2024-56539.md) | Routine | kernel-coco: Security update for the Linux Kernel | 5.5 | 0.0030 |  |
| [CVE-2025-21697](https://patchblox.com/security/data/cve/CVE-2025-21697.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0026 |  |
| [CVE-2024-50142](https://patchblox.com/security/data/cve/CVE-2024-50142.md) | Routine | kernel-64kb: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028). | 5.5 | 0.0026 |  |
| [CVE-2025-21699](https://patchblox.com/security/data/cve/CVE-2025-21699.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0025 |  |
| [CVE-2024-56720](https://patchblox.com/security/data/cve/CVE-2024-56720.md) | Routine | kernel-64kb: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592). | 5.5 | 0.0024 |  |
| [CVE-2024-57948](https://patchblox.com/security/data/cve/CVE-2024-57948.md) | Routine | kernel-coco_debug: Security update for the Linux Kernel | 5.5 | 0.0024 |  |
| [CVE-2025-21638](https://patchblox.com/security/data/cve/CVE-2025-21638.md) | Routine | kernel-64kb: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115). | 5.5 | 0.0024 |  |
| [CVE-2025-21640](https://patchblox.com/security/data/cve/CVE-2025-21640.md) | Routine | kernel-64kb: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123). | 5.5 | 0.0024 |  |
| [CVE-2024-56579](https://patchblox.com/security/data/cve/CVE-2024-56579.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0024 |  |
| [CVE-2025-21639](https://patchblox.com/security/data/cve/CVE-2025-21639.md) | Routine | kernel-64kb: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122). | 5.5 | 0.0023 |  |
| [CVE-2025-21689](https://patchblox.com/security/data/cve/CVE-2025-21689.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 |  |
| [CVE-2025-21799](https://patchblox.com/security/data/cve/CVE-2025-21799.md) | Routine | kernel-64kb: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() (bsc#1238739). | 5.5 | 0.0023 |  |
| [CVE-2025-21668](https://patchblox.com/security/data/cve/CVE-2025-21668.md) | Routine | kernel-64kb: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682). | 5.5 | 0.0023 |  |
| [CVE-2024-56647](https://patchblox.com/security/data/cve/CVE-2024-56647.md) | Routine | kernel-64kb: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435). | 5.5 | 0.0022 |  |
| [CVE-2024-45010](https://patchblox.com/security/data/cve/CVE-2024-45010.md) | Routine | dtb-aarch64: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439). | 5.5 | 0.0022 |  |
| [CVE-2025-21636](https://patchblox.com/security/data/cve/CVE-2025-21636.md) | Routine | kernel-64kb: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113). | 5.5 | 0.0022 |  |
| [CVE-2025-21705](https://patchblox.com/security/data/cve/CVE-2025-21705.md) | Routine | kernel-64kb: mptcp: handle fastopen disconnect correctly (bsc#1238525). | 5.5 | 0.0022 |  |
| [CVE-2025-21667](https://patchblox.com/security/data/cve/CVE-2025-21667.md) | Routine | iomap: avoid avoid truncating 64-bit offset to 32 bits | 5.5 | 0.0022 |  |
| [CVE-2025-21681](https://patchblox.com/security/data/cve/CVE-2025-21681.md) | Routine | kernel-64kb: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702). | 5.5 | 0.0022 |  |
| [CVE-2023-52924](https://patchblox.com/security/data/cve/CVE-2023-52924.md) | Routine | kernel-zfcpdump-core: RHSA-2024:2394: kernel security, bug fix, and enhancement update (Important) | 5.5 | 0.0022 |  |
| [CVE-2025-21665](https://patchblox.com/security/data/cve/CVE-2025-21665.md) | Routine | kernel-64kb: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684). | 5.5 | 0.0022 |  |
| [CVE-2025-21690](https://patchblox.com/security/data/cve/CVE-2025-21690.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 |  |
| [CVE-2025-21637](https://patchblox.com/security/data/cve/CVE-2025-21637.md) | Routine | kernel-64kb: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114). | 5.5 | 0.0021 |  |
| [CVE-2025-21802](https://patchblox.com/security/data/cve/CVE-2025-21802.md) | Routine | kernel-64kb: net: hns3: fix oops when unload drivers paralleling (bsc#1238751). | 5.5 | 0.0021 |  |
| [CVE-2023-52925](https://patchblox.com/security/data/cve/CVE-2023-52925.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-21684](https://patchblox.com/security/data/cve/CVE-2025-21684.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 |  |
| [CVE-2025-21716](https://patchblox.com/security/data/cve/CVE-2025-21716.md) | Routine | kernel-64kb: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891). | 5.5 | 0.0021 |  |
| [CVE-2025-21688](https://patchblox.com/security/data/cve/CVE-2025-21688.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0018 |  |
| [CVE-2024-53123](https://patchblox.com/security/data/cve/CVE-2024-53123.md) | Routine | kernel-64kb: mptcp: error out earlier on disconnect (bsc#1234070). | 5.5 | 0.0018 |  |
| [CVE-2025-21767](https://patchblox.com/security/data/cve/CVE-2025-21767.md) | Routine | kernel-64kb: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context (bsc#1238509). | 5.5 | 0.0018 |  |
| [CVE-2024-26708](https://patchblox.com/security/data/cve/CVE-2024-26708.md) | Routine | dtb-aarch64: mptcp: fix inconsistent state on fastopen race (bsc#1222672). | 5.5 | 0.0017 |  |
| [CVE-2024-57889](https://patchblox.com/security/data/cve/CVE-2024-57889.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2024-57994](https://patchblox.com/security/data/cve/CVE-2024-57994.md) | Routine | kernel-64kb: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901). | 5.5 | 0.0016 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.