# SUSE-SU-2025:03382-1: kernel-livepatch-SLE15-SP7-RT_Update_4 security update

SUSE-SU-2025:03382-1, released September 26, 2025, fixes 103 CVEs in kernel-livepatch-SLE15-SP7-RT_Update_4 (version 1-150700.1.3.2). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-03382-1
- Platform: Linux
- Released: Sep 26, 2025
- Priority: High (Closes CVE-2023-3867, high severity)
- CVEs: 103, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:03382-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-livepatch-SLE15-SP7-RT_Update_4](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-rt-update-4.md) | sles 15.7 | 1-150700.1.3.2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2023-3867](https://patchblox.com/security/data/cve/CVE-2023-3867.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.1 | 0.0627 |  |
| [CVE-2024-49996](https://patchblox.com/security/data/cve/CVE-2024-49996.md) | High | kernel-64kb: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089). | 7.8 | 0.0078 |  |
| [CVE-2025-38566](https://patchblox.com/security/data/cve/CVE-2025-38566.md) | High | sunrpc: fix handling of server side tls alerts | 8.1 | 0.0067 |  |
| [CVE-2025-38439](https://patchblox.com/security/data/cve/CVE-2025-38439.md) | High | bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT | 7.8 | 0.0058 |  |
| [CVE-2025-38146](https://patchblox.com/security/data/cve/CVE-2025-38146.md) | High | net: openvswitch: Fix the dead loop of MPLS parse | 7.8 | 0.0049 |  |
| [CVE-2025-38472](https://patchblox.com/security/data/cve/CVE-2025-38472.md) | High | netfilter: nf_conntrack: fix crash due to removal of uninitialised entry | 7.5 | 0.0046 |  |
| [CVE-2025-38075](https://patchblox.com/security/data/cve/CVE-2025-38075.md) | High | scsi: target: iscsi: Fix timeout on deleted connection | 7.0 | 0.0046 |  |
| [CVE-2025-38563](https://patchblox.com/security/data/cve/CVE-2025-38563.md) | High | perf/core: Prevent VMA split of buffer mappings | 7.8 | 0.0044 |  |
| [CVE-2025-38608](https://patchblox.com/security/data/cve/CVE-2025-38608.md) | High | bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | 7.1 | 0.0044 |  |
| [CVE-2025-38617](https://patchblox.com/security/data/cve/CVE-2025-38617.md) | High | net/packet: fix a race in packet_set_ring() and packet_notifier() | 7.0 | 0.0043 |  |
| [CVE-2025-38571](https://patchblox.com/security/data/cve/CVE-2025-38571.md) | High | sunrpc: fix client side handling of tls alerts | 8.1 | 0.0037 |  |
| [CVE-2025-38490](https://patchblox.com/security/data/cve/CVE-2025-38490.md) | High | net: libwx: remove duplicate page_pool_put_full_page() | 9.8 | 0.0036 |  |
| [CVE-2025-37885](https://patchblox.com/security/data/cve/CVE-2025-37885.md) | High | KVM: x86: Reset IRTE to host control if *new* route isn't postable | 7.8 | 0.0032 |  |
| [CVE-2025-38601](https://patchblox.com/security/data/cve/CVE-2025-38601.md) | High | wifi: ath11k: clear initialized flag for deinit-ed srng lists | 7.0 | 0.0027 |  |
| [CVE-2025-38512](https://patchblox.com/security/data/cve/CVE-2025-38512.md) | High | wifi: prevent A-MSDU attacks in mesh networks | 7.8 | 0.0025 |  |
| [CVE-2025-38585](https://patchblox.com/security/data/cve/CVE-2025-38585.md) | High | staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() | 7.8 | 0.0025 |  |
| [CVE-2025-38491](https://patchblox.com/security/data/cve/CVE-2025-38491.md) | High | mptcp: make fallback action and fallback decision atomic | 7.0 | 0.0024 |  |
| [CVE-2025-38201](https://patchblox.com/security/data/cve/CVE-2025-38201.md) | High | netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX | 7.8 | 0.0024 |  |
| [CVE-2025-38103](https://patchblox.com/security/data/cve/CVE-2025-38103.md) | High | HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() | 7.1 | 0.0023 |  |
| [CVE-2025-38582](https://patchblox.com/security/data/cve/CVE-2025-38582.md) | High | RDMA/hns: Fix double destruction of rsv_qp | 7.8 | 0.0023 |  |
| [CVE-2025-38184](https://patchblox.com/security/data/cve/CVE-2025-38184.md) | High | tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer | 7.0 | 0.0022 |  |
| [CVE-2025-38464](https://patchblox.com/security/data/cve/CVE-2025-38464.md) | High | tipc: Fix use-after-free in tipc_conn_close(). | 7.8 | 0.0022 |  |
| [CVE-2025-38605](https://patchblox.com/security/data/cve/CVE-2025-38605.md) | High | wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() | 7.0 | 0.0021 |  |
| [CVE-2025-38656](https://patchblox.com/security/data/cve/CVE-2025-38656.md) | High | wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() | 7.8 | 0.0021 |  |
| [CVE-2025-38459](https://patchblox.com/security/data/cve/CVE-2025-38459.md) | High | atm: clip: Fix infinite recursive call of clip_push(). | 7.8 | 0.0021 |  |
| [CVE-2025-38565](https://patchblox.com/security/data/cve/CVE-2025-38565.md) | High | perf/core: Exit early on perf_mmap() fail | 7.8 | 0.0020 |  |
| [CVE-2025-38572](https://patchblox.com/security/data/cve/CVE-2025-38572.md) | High | ipv6: reject malicious packets in ipv6_gso_segment() | 7.8 | 0.0020 |  |
| [CVE-2025-38445](https://patchblox.com/security/data/cve/CVE-2025-38445.md) | High | md/raid1: Fix stack memory use after return in raid1_reshape | 7.1 | 0.0020 |  |
| [CVE-2025-38125](https://patchblox.com/security/data/cve/CVE-2025-38125.md) | High | net: stmmac: make sure that ptp_rate is not 0 before configuring EST | 7.0 | 0.0020 |  |
| [CVE-2025-38555](https://patchblox.com/security/data/cve/CVE-2025-38555.md) | High | usb: gadget : fix use-after-free in composite_dev_cleanup() | 7.8 | 0.0020 |  |
| [CVE-2025-38529](https://patchblox.com/security/data/cve/CVE-2025-38529.md) | High | comedi: aio_iiro_16: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38530](https://patchblox.com/security/data/cve/CVE-2025-38530.md) | High | comedi: pcl812: Fix bit shift out of bounds | 7.1 | 0.0020 |  |
| [CVE-2025-38458](https://patchblox.com/security/data/cve/CVE-2025-38458.md) | High | atm: clip: Fix NULL pointer dereference in vcc_sendmsg() | 7.0 | 0.0020 |  |
| [CVE-2025-38581](https://patchblox.com/security/data/cve/CVE-2025-38581.md) | High | crypto: ccp - Fix crash when rebind ccp device for ccp.ko | 7.0 | 0.0019 |  |
| [CVE-2025-38160](https://patchblox.com/security/data/cve/CVE-2025-38160.md) | High | clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() | 7.0 | 0.0019 |  |
| [CVE-2025-38245](https://patchblox.com/security/data/cve/CVE-2025-38245.md) | High | atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). | 7.8 | 0.0019 |  |
| [CVE-2025-38560](https://patchblox.com/security/data/cve/CVE-2025-38560.md) | High | x86/sev: Evict cache lines during SNP memory validation | 7.5 | 0.0019 |  |
| [CVE-2025-38538](https://patchblox.com/security/data/cve/CVE-2025-38538.md) | High | dmaengine: nbpfaxi: Fix memory corruption in probe() | 7.8 | 0.0019 |  |
| [CVE-2025-38568](https://patchblox.com/security/data/cve/CVE-2025-38568.md) | High | net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing | 7.8 | 0.0019 |  |
| [CVE-2025-38499](https://patchblox.com/security/data/cve/CVE-2025-38499.md) | High | clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns | 8.2 | 0.0019 |  |
| [CVE-2025-38535](https://patchblox.com/security/data/cve/CVE-2025-38535.md) | High | phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode | 7.8 | 0.0019 |  |
| [CVE-2025-38618](https://patchblox.com/security/data/cve/CVE-2025-38618.md) | High | vsock: Do not allow binding to VMADDR_PORT_ANY | 7.8 | 0.0018 |  |
| [CVE-2025-38548](https://patchblox.com/security/data/cve/CVE-2025-38548.md) | High | hwmon: (corsair-cpro) Validate the size of the received input buffer | 7.8 | 0.0018 |  |
| [CVE-2025-38208](https://patchblox.com/security/data/cve/CVE-2025-38208.md) | High | smb: client: add NULL check in automount_fullpath | 7.0 | 0.0018 |  |
| [CVE-2025-38500](https://patchblox.com/security/data/cve/CVE-2025-38500.md) | High | xfrm: interface: fix use-after-free after changing collect_md xfrm interface | 7.8 | 0.0018 |  |
| [CVE-2025-38587](https://patchblox.com/security/data/cve/CVE-2025-38587.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.0 | 0.0018 |  |
| [CVE-2025-38609](https://patchblox.com/security/data/cve/CVE-2025-38609.md) | High | PM / devfreq: Check governor before using governor->name | 7.8 | 0.0018 |  |
| [CVE-2025-38550](https://patchblox.com/security/data/cve/CVE-2025-38550.md) | High | ipv6: mcast: Delay put pmc->idev in mld_del_delrec() | 7.8 | 0.0017 |  |
| [CVE-2025-38668](https://patchblox.com/security/data/cve/CVE-2025-38668.md) | High | regulator: core: fix NULL dereference on unbind due to stale coupling data | 7.0 | 0.0017 |  |
| [CVE-2025-38670](https://patchblox.com/security/data/cve/CVE-2025-38670.md) | High | arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() | 7.1 | 0.0017 |  |
| [CVE-2025-38521](https://patchblox.com/security/data/cve/CVE-2025-38521.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0017 |  |
| [CVE-2025-38543](https://patchblox.com/security/data/cve/CVE-2025-38543.md) | High | drm/tegra: nvdec: Fix dma_alloc_coherent error check | 7.1 | 0.0017 |  |
| [CVE-2025-38665](https://patchblox.com/security/data/cve/CVE-2025-38665.md) | High | can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode | 7.0 | 0.0016 |  |
| [CVE-2025-38440](https://patchblox.com/security/data/cve/CVE-2025-38440.md) | High | kernel-64kb: net/mlx5e: Fix race between DIM disable and net_dim() (bsc#1247290). | 7.0 | 0.0014 |  |
| [CVE-2023-4130](https://patchblox.com/security/data/cve/CVE-2023-4130.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix wrong next length validation of ea bu... | 5.5 | 0.0051 |  |
| [CVE-2024-58239](https://patchblox.com/security/data/cve/CVE-2024-58239.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.9 | 0.0036 |  |
| [CVE-2023-4515](https://patchblox.com/security/data/cve/CVE-2023-4515.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0033 |  |
| [CVE-2025-38524](https://patchblox.com/security/data/cve/CVE-2025-38524.md) | Routine | rxrpc: Fix recv-recv race of completed call | 4.7 | 0.0032 |  |
| [CVE-2024-26661](https://patchblox.com/security/data/cve/CVE-2024-26661.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 |  |
| [CVE-2025-38591](https://patchblox.com/security/data/cve/CVE-2025-38591.md) | Routine | bpf: Reject narrower access to pointer ctx fields | 5.5 | 0.0022 |  |
| [CVE-2025-38190](https://patchblox.com/security/data/cve/CVE-2025-38190.md) | Routine | atm: Revert atm_account_tx() if copy_from_iter_full() fails. | 5.5 | 0.0021 |  |
| [CVE-2025-38185](https://patchblox.com/security/data/cve/CVE-2025-38185.md) | Routine | atm: atmtcp: Free invalid length skb in atmtcp_c_send(). | 5.5 | 0.0020 |  |
| [CVE-2025-38006](https://patchblox.com/security/data/cve/CVE-2025-38006.md) | Routine | net: mctp: Don't access ifa_index when missing | 5.5 | 0.0020 |  |
| [CVE-2025-38612](https://patchblox.com/security/data/cve/CVE-2025-38612.md) | Routine | staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() | 5.5 | 0.0019 |  |
| [CVE-2025-38441](https://patchblox.com/security/data/cve/CVE-2025-38441.md) | Routine | kernel-64kb: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (bsc#1247167). | 5.5 | 0.0019 |  |
| [CVE-2025-38604](https://patchblox.com/security/data/cve/CVE-2025-38604.md) | Routine | wifi: rtl818x: Kill URBs before clearing tx status queue | 5.5 | 0.0019 |  |
| [CVE-2025-38360](https://patchblox.com/security/data/cve/CVE-2025-38360.md) | Routine | kernel-64kb: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078). | 5.5 | 0.0019 |  |
| [CVE-2024-58238](https://patchblox.com/security/data/cve/CVE-2024-58238.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0019 |  |
| [CVE-2025-38205](https://patchblox.com/security/data/cve/CVE-2025-38205.md) | Routine | drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 | 5.5 | 0.0018 |  |
| [CVE-2025-38576](https://patchblox.com/security/data/cve/CVE-2025-38576.md) | Routine | powerpc/eeh: Make EEH driver device hotplug safe | 5.5 | 0.0018 |  |
| [CVE-2025-38513](https://patchblox.com/security/data/cve/CVE-2025-38513.md) | Routine | wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() | 5.5 | 0.0018 |  |
| [CVE-2025-38516](https://patchblox.com/security/data/cve/CVE-2025-38516.md) | Routine | pinctrl: qcom: msm: mark certain pins as invalid for interrupts | 5.5 | 0.0018 |  |
| [CVE-2025-38528](https://patchblox.com/security/data/cve/CVE-2025-38528.md) | Routine | bpf: Reject %p% format string in bprintf-like helpers | 5.5 | 0.0018 |  |
| [CVE-2025-38540](https://patchblox.com/security/data/cve/CVE-2025-38540.md) | Routine | HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras | 5.5 | 0.0018 |  |
| [CVE-2025-38546](https://patchblox.com/security/data/cve/CVE-2025-38546.md) | Routine | atm: clip: Fix memory leak of struct clip_vcc. | 5.5 | 0.0018 |  |
| [CVE-2025-38635](https://patchblox.com/security/data/cve/CVE-2025-38635.md) | Routine | clk: davinci: Add NULL check in davinci_lpsc_clk_register() | 5.5 | 0.0018 |  |
| [CVE-2025-38663](https://patchblox.com/security/data/cve/CVE-2025-38663.md) | Routine | nilfs2: reject invalid file types when reading inodes | 5.5 | 0.0018 |  |
| [CVE-2025-38444](https://patchblox.com/security/data/cve/CVE-2025-38444.md) | Routine | raid10: cleanup memleak at raid10_make_request | 5.5 | 0.0018 |  |
| [CVE-2025-38602](https://patchblox.com/security/data/cve/CVE-2025-38602.md) | Routine | iwlwifi: Add missing check for alloc_ordered_workqueue | 5.5 | 0.0018 |  |
| [CVE-2025-38251](https://patchblox.com/security/data/cve/CVE-2025-38251.md) | Routine | atm: clip: prevent NULL deref in clip_push() | 5.5 | 0.0018 |  |
| [CVE-2025-38588](https://patchblox.com/security/data/cve/CVE-2025-38588.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0018 |  |
| [CVE-2025-38610](https://patchblox.com/security/data/cve/CVE-2025-38610.md) | Routine | powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() | 5.5 | 0.0018 |  |
| [CVE-2025-38531](https://patchblox.com/security/data/cve/CVE-2025-38531.md) | Routine | iio: common: st_sensors: Fix use of uninitialize device structs | 5.5 | 0.0018 |  |
| [CVE-2025-38583](https://patchblox.com/security/data/cve/CVE-2025-38583.md) | Routine | clk: xilinx: vcu: unregister pll_post only if registered correctly | 5.5 | 0.0018 |  |
| [CVE-2025-38630](https://patchblox.com/security/data/cve/CVE-2025-38630.md) | Routine | fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref | 5.5 | 0.0017 |  |
| [CVE-2024-46733](https://patchblox.com/security/data/cve/CVE-2024-46733.md) | Routine | kernel-64kb: btrfs: fix qgroup reserve leaks in cow_file_range (bsc#1230708). | 5.5 | 0.0017 |  |
| [CVE-2025-38511](https://patchblox.com/security/data/cve/CVE-2025-38511.md) | Routine | kernel-livepatch-SLE15-SP7-RT_Update_0: drm/xe/pf: Clear all LMTT pages on alloc (bsc#1248176). | 5.5 | 0.0017 |  |
| [CVE-2025-38515](https://patchblox.com/security/data/cve/CVE-2025-38515.md) | Routine | drm/sched: Increment job count before swapping tail spsc queue | 5.5 | 0.0017 |  |
| [CVE-2025-38624](https://patchblox.com/security/data/cve/CVE-2025-38624.md) | Routine | PCI: pnv_php: Clean up allocated IRQs on unplug | 5.5 | 0.0017 |  |
| [CVE-2025-38671](https://patchblox.com/security/data/cve/CVE-2025-38671.md) | Routine | i2c: qup: jump out of the loop in case of timeout | 5.5 | 0.0017 |  |
| [CVE-2025-38644](https://patchblox.com/security/data/cve/CVE-2025-38644.md) | Routine | wifi: mac80211: reject TDLS operations when station is not associated | 5.5 | 0.0017 |  |
| [CVE-2025-38510](https://patchblox.com/security/data/cve/CVE-2025-38510.md) | Routine | kasan: remove kasan_find_vm_area() to prevent possible deadlock | 5.5 | 0.0017 |  |
| [CVE-2025-38634](https://patchblox.com/security/data/cve/CVE-2025-38634.md) | Routine | power: supply: cpcap-charger: Fix null check for power_supply_get_by_name | 5.5 | 0.0017 |  |
| [CVE-2025-38646](https://patchblox.com/security/data/cve/CVE-2025-38646.md) | Routine | wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band | 6.5 | 0.0017 |  |
| [CVE-2025-38621](https://patchblox.com/security/data/cve/CVE-2025-38621.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 |  |
| [CVE-2025-38503](https://patchblox.com/security/data/cve/CVE-2025-38503.md) | Routine | btrfs: fix assertion when building free space tree | 5.5 | 0.0016 |  |
| [CVE-2025-38537](https://patchblox.com/security/data/cve/CVE-2025-38537.md) | Routine | net: phy: Don't register LEDs for genphy | 5.5 | 0.0016 |  |
| [CVE-2025-38541](https://patchblox.com/security/data/cve/CVE-2025-38541.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0016 |  |
| [CVE-2025-38632](https://patchblox.com/security/data/cve/CVE-2025-38632.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0014 |  |
| [CVE-2025-38650](https://patchblox.com/security/data/cve/CVE-2025-38650.md) | Routine | hfsplus: remove mutex_lock check in hfsplus_free_extents | 5.5 | 0.0014 |  |
| [CVE-2025-38520](https://patchblox.com/security/data/cve/CVE-2025-38520.md) | Routine | drm/amdkfd: Don't call mmput from MMU notifier callback | 5.5 | 0.0013 |  |
| [CVE-2025-38506](https://patchblox.com/security/data/cve/CVE-2025-38506.md) | Routine | kernel-azure: KVM: Allow CPU to reschedule while setting per-page memory attributes (bsc#1248186). | 5.5 | 0.0013 |  |
| [CVE-2025-38553](https://patchblox.com/security/data/cve/CVE-2025-38553.md) | Routine | net/sched: Restrict conditions for adding duplicating netems to qdisc tree | 5.5 | n/a |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.