SUSE-IU-2025:1204-1: Security update of suse/sl-micro/6.1/rt-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Apr 26 07:13:53 UTC 2025
SUSE Image Update Advisory: suse/sl-micro/6.1/rt-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2025:1204-1
Image Tags : suse/sl-micro/6.1/rt-os-container:2.2.0 , suse/sl-micro/6.1/rt-os-container:2.2.0-4.25 , suse/sl-micro/6.1/rt-os-container:latest
Image Release : 4.25
Severity : important
Type : security
References : 1224013 1224757 1228659 1231910 1234074 1234157 1234698 1235550
1235870 1237874 1237882 1238052 1238565 1238746 1238970 1238990
1239066 1239475 1239684 1239906 1239925 1240167 1240168 1240171
1240176 1240184 1240185 1240375 1240575 1240581 1240582 1240583
1240584 1240585 1240587 1240590 1240591 1240592 1240594 1240595
1240596 1240600 1240612 1240616 1240639 1240643 1240647 1240691
1240700 1240701 1240703 1240708 1240714 1240715 1240716 1240718
1240719 1240720 1240722 1240727 1240739 1240742 1240779 1240783
1240784 1240795 1240796 1240797 1240799 1240801 1240806 1240808
1240812 1240813 1240815 1240816 1240819 1240821 1240825 1240829
1240873 1240937 1240938 1240940 1240942 1240943 1240978 1240979
1241038 CVE-2024-27415 CVE-2024-50038 CVE-2024-53124 CVE-2024-53139
CVE-2024-58018 CVE-2024-58071 CVE-2025-21729 CVE-2025-21755 CVE-2025-21806
CVE-2025-21836 CVE-2025-21863 CVE-2025-21873 CVE-2025-21875 CVE-2025-21881
CVE-2025-21884 CVE-2025-21887 CVE-2025-21889 CVE-2025-21894 CVE-2025-21895
CVE-2025-21905 CVE-2025-21906 CVE-2025-21908 CVE-2025-21909 CVE-2025-21910
CVE-2025-21912 CVE-2025-21913 CVE-2025-21914 CVE-2025-21915 CVE-2025-21916
CVE-2025-21917 CVE-2025-21918 CVE-2025-21922 CVE-2025-21923 CVE-2025-21924
CVE-2025-21927 CVE-2025-21928 CVE-2025-21930 CVE-2025-21934 CVE-2025-21935
CVE-2025-21936 CVE-2025-21937 CVE-2025-21941 CVE-2025-21943 CVE-2025-21948
CVE-2025-21950 CVE-2025-21951 CVE-2025-21953 CVE-2025-21956 CVE-2025-21957
CVE-2025-21960 CVE-2025-21961 CVE-2025-21966 CVE-2025-21968 CVE-2025-21969
CVE-2025-21970 CVE-2025-21971 CVE-2025-21972 CVE-2025-21975 CVE-2025-21978
CVE-2025-21979 CVE-2025-21981 CVE-2025-21991 CVE-2025-21992 CVE-2025-21993
CVE-2025-21995 CVE-2025-21996 CVE-2025-22001 CVE-2025-22003 CVE-2025-22007
CVE-2025-22008 CVE-2025-22009 CVE-2025-22010 CVE-2025-22013 CVE-2025-22014
CVE-2025-2312
-----------------------------------------------------------------
The container suse/sl-micro/6.1/rt-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: kernel-15
Released: Fri Apr 25 11:37:28 2025
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1224013,1224757,1228659,1231910,1234074,1234157,1234698,1235550,1235870,1237874,1237882,1238052,1238565,1238746,1238970,1238990,1239066,1239475,1239684,1239906,1239925,1240167,1240168,1240171,1240176,1240184,1240185,1240375,1240575,1240581,1240582,1240583,1240584,1240585,1240587,1240590,1240591,1240592,1240594,1240595,1240596,1240600,1240612,1240616,1240639,1240643,1240647,1240691,1240700,1240701,1240703,1240708,1240714,1240715,1240716,1240718,1240719,1240720,1240722,1240727,1240739,1240742,1240779,1240783,1240784,1240795,1240796,1240797,1240799,1240801,1240806,1240808,1240812,1240813,1240815,1240816,1240819,1240821,1240825,1240829,1240873,1240937,1240938,1240940,1240942,1240943,1240978,1240979,1241038,CVE-2024-27415,CVE-2024-50038,CVE-2024-53124,CVE-2024-53139,CVE-2024-58018,CVE-2024-58071,CVE-2025-21729,CVE-2025-21755,CVE-2025-21806,CVE-2025-21836,CVE-2025-21863,CVE-2025-21873,CVE-2025-21875,CVE-2025-21881,CVE-2025-21884,CVE-2025-21887,CVE-2025-21889,CVE-2025-21894,CVE
-2025-21895,CVE-2025-21905,CVE-2025-21906,CVE-2025-21908,CVE-2025-21909,CVE-2025-21910,CVE-2025-21912,CVE-2025-21913,CVE-2025-21914,CVE-2025-21915,CVE-2025-21916,CVE-2025-21917,CVE-2025-21918,CVE-2025-21922,CVE-2025-21923,CVE-2025-21924,CVE-2025-21927,CVE-2025-21928,CVE-2025-21930,CVE-2025-21934,CVE-2025-21935,CVE-2025-21936,CVE-2025-21937,CVE-2025-21941,CVE-2025-21943,CVE-2025-21948,CVE-2025-21950,CVE-2025-21951,CVE-2025-21953,CVE-2025-21956,CVE-2025-21957,CVE-2025-21960,CVE-2025-21961,CVE-2025-21966,CVE-2025-21968,CVE-2025-21969,CVE-2025-21970,CVE-2025-21971,CVE-2025-21972,CVE-2025-21975,CVE-2025-21978,CVE-2025-21979,CVE-2025-21981,CVE-2025-21991,CVE-2025-21992,CVE-2025-21993,CVE-2025-21995,CVE-2025-21996,CVE-2025-22001,CVE-2025-22003,CVE-2025-22007,CVE-2025-22008,CVE-2025-22009,CVE-2025-22010,CVE-2025-22013,CVE-2025-22014,CVE-2025-2312
The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
- CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
- CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
- CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
- CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
- CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
- CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
- CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
- CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
- CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
- CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
- CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
- CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
- CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
- CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
- CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
- CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
- CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
- CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
- CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
- CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
- CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
- CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
- CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
- CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
- CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
- CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
- CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
- CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
- CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
- CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
- CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
- CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
- CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
- CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
- CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).
The following non-security bugs were fixed:
- ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (stable-fixes).
- ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (git-fixes).
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (git-fixes).
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (git-fixes).
- ASoC: imx-card: Add NULL check in imx_card_probe() (git-fixes).
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns (git-fixes).
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment (git-fixes).
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (git-fixes).
- HID: hid-plantronics: Add mic mute mapping and generalize quirks (stable-fixes).
- HID: i2c-hid: improve i2c_hid_get_report error message (stable-fixes).
- Input: pm8941-pwrkey - fix dev_dbg() output in pm8941_pwrkey_irq() (git-fixes).
- Input: synaptics - hide unused smbus_pnp_ids[] array (git-fixes).
- PCI: Fix BAR resizing when VF BARs are assigned (git-fixes).
- PCI: Fix reference leak in pci_register_host_bridge() (git-fixes).
- PCI: histb: Fix an error handling path in histb_pcie_probe() (git-fixes).
- acpi: nfit: fix narrowing conversion in acpi_nfit_ctl (git-fixes).
- affs: do not write overlarge OFS data block size fields (git-fixes).
- affs: generate OFS sequence numbers starting at 1 (git-fixes).
- arch_topology: Make register_cpu_capacity_sysctl() tolerant to late (bsc#1238052)
- arch_topology: init capacity_freq_ref to 0 (bsc#1238052)
- arm64/amu: Use capacity_ref_freq() to set AMU ratio (bsc#1238052)
- arm64: Do not call NULL in do_compat_alignment_fixup() (git-fixes)
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (bsc#1238052)
- arm64: Update AMU-based freq scale factor on entering idle (bsc#1238052)
- arm64: Utilize for_each_cpu_wrap for reference lookup (bsc#1238052)
- arm64: amu: Delay allocating cpumask for AMU FIE support (bsc#1238052)
- arm64: mm: Correct the update of max_pfn (git-fixes)
- bpf: Check size for BTF-based ctx access of pointer members (git-fixes).
- bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() (git-fixes).
- bpf: avoid holding freeze_mutex during mmap operation (git-fixes).
- bpf: fix potential error return (git-fixes).
- bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic (git-fixes).
- counter: fix privdata alignment (git-fixes).
- counter: microchip-tcb-capture: Fix undefined counter channel state on probe (git-fixes).
- counter: stm32-lptimer-cnt: fix error handling when enabling (git-fixes).
- cpufreq/cppc: Set the frequency used for computing the capacity (bsc#1238052)
- cpufreq: Allow arch_freq_get_on_cpu to return an error (bsc#1238052)
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (bsc#1238052)
Keep the feature disabled by default on x86_64
- drm/amd/pm/smu11: Prevent division by zero (git-fixes).
- drm/amd/pm: Prevent division by zero (git-fixes).
- drm/amd: Keep display off while going into S4 (stable-fixes).
- drm/amdgpu/dma_buf: fix page_link check (git-fixes).
- drm/amdgpu/gfx11: fix num_mec (git-fixes).
- drm/dp_mst: Add a helper to queue a topology probe (stable-fixes).
- drm/dp_mst: Factor out function to queue a topology probe work (stable-fixes).
- drm/i915/huc: Fix fence not released on early probe errors (git-fixes).
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops (git-fixes).
- drm/sti: remove duplicate object names (git-fixes).
- exfat: fix the infinite loop in exfat_find_last_cluster() (git-fixes).
- firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success (git-fixes).
- gpio: tegra186: fix resource handling in ACPI probe path (git-fixes).
- hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} (stable-fixes).
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets (git-fixes).
- libperf cpumap: Be tolerant of newline at the end of a cpumask (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Ensure empty cpumap is NULL from alloc (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Grow array of read CPUs in smaller increments (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Hide/reduce scope of MAX_NR_CPUS (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Remove use of perf_cpu_map__read() (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Rename perf_cpu_map__default_new() to
perf_cpu_map__new_online_cpus() and prefer sysfs (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Rename perf_cpu_map__dummy_new() to perf_cpu_map__new_any_cpu() (bsc#1234698 jsc#PED-12309).
- libperf cpumap: Rename perf_cpu_map__empty() to perf_cpu_map__has_any_cpu_or_is_empty() (bsc#1234698 jsc#PED-12309).
- mmc: sdhci-pxav3: set NEED_RSP_BUSY capability (stable-fixes).
- mtd: inftlcore: Add error check for inftl_read_oob() (git-fixes).
- mtd: rawnand: Add status chack in r852_ready() (git-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FE990B composition (stable-fixes).
- net: usb: qmi_wwan: add Telit Cinterion FN990B composition (stable-fixes).
- nfs: clear SB_RDONLY before getting superblock (bsc#1238565).
- nfs: ignore SB_RDONLY when remounting nfs (bsc#1238565).
- nfsd: put dl_stid if fail to queue dl_recall (git-fixes).
- ntb: Force physically contiguous allocation of rx ring buffers (git-fixes).
- ntb: intel: Fix using link status DB's (git-fixes).
- ntb: use 64-bit arithmetic for the MSI doorbell mask (git-fixes).
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (git-fixes).
- ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() (git-fixes).
- ntb_perf: Fix printk format (git-fixes).
- objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (git-fixes).
- objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() (git-fixes).
- objtool: Fix segfault in ignore_unreachable_insn() (git-fixes).
- perf cpumap: Reduce transitive dependencies on libperf MAX_NR_CPUS (bsc#1234698 jsc#PED-12309).
- perf pmu: Remove use of perf_cpu_map__read() (bsc#1234698 jsc#PED-12309).
- perf tools: annotate asm_pure_loop.S (bsc#1239906).
- perf: Increase MAX_NR_CPUS to 4096 (bsc#1234698 jsc#PED-12309).
- platform/x86/intel/vsec: Add Diamond Rapids support (stable-fixes).
- platform/x86: ISST: Correct command storage data length (git-fixes).
- platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet (stable-fixes).
- powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() (git-fixes).
- powercap: intel_rapl_tpmi: Fix System Domain probing (git-fixes).
- powercap: intel_rapl_tpmi: Fix bogus register reading (git-fixes).
- powercap: intel_rapl_tpmi: Ignore minor version change (git-fixes).
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (bsc#1224013).
- s390/cio: Fix CHPID 'configure' attribute caching (git-fixes bsc#1240979).
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (git-fixes bsc#1240978).
- sched/topology: Add a new arch_scale_freq_ref() method (bsc#1238052)
- security, lsm: Introduce security_mptcp_add_subflow() (bsc#1240375).
- selftests/bpf: Add test for narrow ctx load for pointer args (git-fixes).
- selinux: Implement mptcp_add_subflow hook (bsc#1240375).
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (git-fixes).
- smb: client: fix open_cached_dir retries with 'hard' mount option (bsc#1240616).
- staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES (git-fixes).
- topology: Set capacity_freq_ref in all cases (bsc#1238052)
- tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
- tpm: tis: Double the timeout B to 4s (bsc#1235870).
- tpm_tis: Move CRC check to generic send routine (bsc#1235870).
- tpm_tis: Use responseRetry to recover from data transfer errors (bsc#1235870).
- tty: serial: 8250: Add Brainboxes XC devices (stable-fixes).
- tty: serial: 8250: Add some more device IDs (stable-fixes).
- tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers (git-fixes).
- tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register (git-fixes).
- ucsi_ccg: Do not show failed to get FW build information error (git-fixes).
- usb: dwc3: Set SUSPENDENABLE soon after phy init (git-fixes).
- usb: xhci: correct debug message page size calculation (git-fixes).
- usbnet:fix NPE during rx_complete (git-fixes).
- wifi: ath11k: fix memory leak in ath11k_xxx_remove() (git-fixes).
- wifi: brcmfmac: keep power during suspend if board requires it (stable-fixes).
- wifi: iwlwifi: fw: allocate chained SG tables for dump (stable-fixes).
- wifi: iwlwifi: mvm: use the right version of the rate API (stable-fixes).
- wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state (stable-fixes).
- xhci: Fix null pointer dereference during S4 resume when resetting ep0 (bsc#1235550).
- xhci: Reconfigure endpoint 0 max packet size only during endpoint reset (bsc#1235550).
- xhci: fix possible null pointer deref during xhci urb enqueue (bsc#1235550).
The following package changes have been done:
- kernel-rt-6.4.0-30.1 updated
More information about the sle-container-updates
mailing list