# SUSE-SU-2025:0564-1: Security update for 4 packages

SUSE-SU-2025:0564-1, released February 17, 2025, fixes 54 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2025-0564-1
- Platform: Linux
- Released: Feb 17, 2025
- Priority: High (Closes CVE-2024-46858, high severity)
- CVEs: 54, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:0564-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-coco](https://patchblox.com/security/data/product/linux/kernel-coco.md) | sles 15.6 | 6.4.0-15061.15.coco15sp6.1 |
| [kernel-coco_debug](https://patchblox.com/security/data/product/linux/kernel-coco-debug.md) | sles 15.6 | 6.4.0-15061.15.coco15sp6.1 |
| [kernel-source-coco](https://patchblox.com/security/data/product/linux/kernel-source-coco.md) | sles 15.6 | 6.4.0-15061.15.coco15sp6.1 |
| [kernel-syms-coco](https://patchblox.com/security/data/product/linux/kernel-syms-coco.md) | sles 15.6 | 6.4.0-15061.15.coco15sp6.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-46858](https://patchblox.com/security/data/cve/CVE-2024-46858.md) | High | kernel-64kb: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088). | 7.0 | 0.0059 |  |
| [CVE-2024-56633](https://patchblox.com/security/data/cve/CVE-2024-56633.md) | High | kernel-64kb: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485). | 7.8 | 0.0028 |  |
| [CVE-2024-53203](https://patchblox.com/security/data/cve/CVE-2024-53203.md) | High | kernel-64kb: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (bsc#1235001). | 7.8 | 0.0027 |  |
| [CVE-2024-56650](https://patchblox.com/security/data/cve/CVE-2024-56650.md) | High | kernel-64kb: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235430). | 7.1 | 0.0027 |  |
| [CVE-2024-56608](https://patchblox.com/security/data/cve/CVE-2024-56608.md) | High | kernel-64kb: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' (bsc#1235487). | 7.8 | 0.0026 |  |
| [CVE-2025-21655](https://patchblox.com/security/data/cve/CVE-2025-21655.md) | High | kernel-64kb: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (bsc#1236163). | 7.8 | 0.0025 |  |
| [CVE-2024-56600](https://patchblox.com/security/data/cve/CVE-2024-56600.md) | High | kernel-64kb: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235217). | 7.8 | 0.0025 |  |
| [CVE-2024-56601](https://patchblox.com/security/data/cve/CVE-2024-56601.md) | High | kernel-64kb: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235230). | 7.8 | 0.0025 |  |
| [CVE-2024-56693](https://patchblox.com/security/data/cve/CVE-2024-56693.md) | High | kernel-64kb: brd: defer automatic disk creation until module initialization succeeds (bsc#1235418). | 7.8 | 0.0025 |  |
| [CVE-2024-56658](https://patchblox.com/security/data/cve/CVE-2024-56658.md) | High | kernel-64kb: net: defer final 'struct net' free in netns dismantle (bsc#1235441). | 7.8 | 0.0024 |  |
| [CVE-2025-21669](https://patchblox.com/security/data/cve/CVE-2025-21669.md) | High | kernel-64kb: vsock/virtio: discard packets if the transport changes (bsc#1236683). | 7.1 | 0.0023 |  |
| [CVE-2024-57917](https://patchblox.com/security/data/cve/CVE-2024-57917.md) | High | kernel-64kb: topology: Keep the cpumask unchanged when printing cpumap (bsc#1236127). | 7.8 | 0.0022 |  |
| [CVE-2025-21652](https://patchblox.com/security/data/cve/CVE-2025-21652.md) | High | kernel-64k: kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). | 7.8 | 0.0021 |  |
| [CVE-2024-40980](https://patchblox.com/security/data/cve/CVE-2024-40980.md) | Routine | dtb-aarch64: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937). | 5.5 | 0.0076 |  |
| [CVE-2024-49978](https://patchblox.com/security/data/cve/CVE-2024-49978.md) | Routine | gso: fix udp gso fraglist segmentation after pull from frag_list | 5.5 | 0.0066 |  |
| [CVE-2024-57802](https://patchblox.com/security/data/cve/CVE-2024-57802.md) | Routine | kernel-64kb: netrom: check buffer length before accessing it (bsc#1235941). | 5.5 | 0.0061 |  |
| [CVE-2024-50251](https://patchblox.com/security/data/cve/CVE-2024-50251.md) | Routine | kernel-64kb: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248). | 6.2 | 0.0053 |  |
| [CVE-2024-57882](https://patchblox.com/security/data/cve/CVE-2024-57882.md) | Routine | kernel-64kb: mptcp: fix TCP options overflow | 5.5 | 0.0052 |  |
| [CVE-2025-21676](https://patchblox.com/security/data/cve/CVE-2025-21676.md) | Routine | kernel-64kb: net: fec: handle page_pool_dev_alloc_pages error (bsc#1236696). | 5.5 | 0.0045 |  |
| [CVE-2025-21673](https://patchblox.com/security/data/cve/CVE-2025-21673.md) | Routine | smb: client: fix double free of TCP_Server_Info::hostname | 5.5 | 0.0042 |  |
| [CVE-2025-21663](https://patchblox.com/security/data/cve/CVE-2025-21663.md) | Routine | kernel-64kb: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (bsc#1236260). | 5.5 | 0.0042 |  |
| [CVE-2024-49948](https://patchblox.com/security/data/cve/CVE-2024-49948.md) | Routine | kernel-64kb: net: add more sanity checks to qdisc_pkt_len_init() (bsc#1232161). | 5.5 | 0.0029 |  |
| [CVE-2024-53187](https://patchblox.com/security/data/cve/CVE-2024-53187.md) | Routine | kernel-64kb: io_uring: check for overflows in io_pin_pages (bsc#1234947). | 5.5 | 0.0028 |  |
| [CVE-2024-56715](https://patchblox.com/security/data/cve/CVE-2024-56715.md) | Routine | kernel-64kb: ionic: Fix netdev notifier unregister on failure (bsc#1235612). | 5.5 | 0.0026 |  |
| [CVE-2024-50142](https://patchblox.com/security/data/cve/CVE-2024-50142.md) | Routine | kernel-64kb: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028). | 5.5 | 0.0026 |  |
| [CVE-2024-50304](https://patchblox.com/security/data/cve/CVE-2024-50304.md) | Routine | kernel-64kb: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522). | 5.5 | 0.0025 |  |
| [CVE-2024-56707](https://patchblox.com/security/data/cve/CVE-2024-56707.md) | Routine | kernel-64kb: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (bsc#1235545). | 5.5 | 0.0024 |  |
| [CVE-2025-21664](https://patchblox.com/security/data/cve/CVE-2025-21664.md) | Routine | kernel-64kb: dm thin: make get_first_thin use rcu-safe list first function (bsc#1236262). | 5.5 | 0.0024 |  |
| [CVE-2025-21678](https://patchblox.com/security/data/cve/CVE-2025-21678.md) | Routine | kernel-64kb: gtp: Destroy device along with udp socket's netns dismantle (bsc#1236698). | 5.5 | 0.0024 |  |
| [CVE-2025-21682](https://patchblox.com/security/data/cve/CVE-2025-21682.md) | Routine | eth: bnxt: always recalculate features after XDP clearing, fix null-deref | 5.5 | 0.0023 |  |
| [CVE-2025-21666](https://patchblox.com/security/data/cve/CVE-2025-21666.md) | Routine | kernel-64kb: vsock: prevent null-ptr-deref in vsock_*[has_data\|has_space] (bsc#1236680). | 5.5 | 0.0023 |  |
| [CVE-2025-21670](https://patchblox.com/security/data/cve/CVE-2025-21670.md) | Routine | kernel-64kb: vsock/bpf: return early if transport is not assigned (bsc#1236685). | 5.5 | 0.0023 |  |
| [CVE-2025-21668](https://patchblox.com/security/data/cve/CVE-2025-21668.md) | Routine | kernel-64kb: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682). | 5.5 | 0.0023 |  |
| [CVE-2025-21675](https://patchblox.com/security/data/cve/CVE-2025-21675.md) | Routine | kernel-64kb: net/mlx5: Clear port select structure when fail to create (bsc#1236694). | 5.5 | 0.0023 |  |
| [CVE-2024-56610](https://patchblox.com/security/data/cve/CVE-2024-56610.md) | Routine | kernel-64kb: kcsan: Turn report_filterlist_lock into a raw_spinlock (bsc#1235390). | 5.5 | 0.0022 |  |
| [CVE-2024-56679](https://patchblox.com/security/data/cve/CVE-2024-56679.md) | Routine | kernel-64kb: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (bsc#1235498). | 5.5 | 0.0022 |  |
| [CVE-2024-57931](https://patchblox.com/security/data/cve/CVE-2024-57931.md) | Routine | kernel-64kb: selinux: ignore unknown extended permissions (bsc#1236192). | 5.5 | 0.0022 |  |
| [CVE-2024-56665](https://patchblox.com/security/data/cve/CVE-2024-56665.md) | Routine | bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog | 5.5 | 0.0022 |  |
| [CVE-2024-57884](https://patchblox.com/security/data/cve/CVE-2024-57884.md) | Routine | kernel-64kb: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (bsc#1235948). | 5.5 | 0.0022 |  |
| [CVE-2024-50258](https://patchblox.com/security/data/cve/CVE-2024-50258.md) | Routine | kernel-64kb: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221). | 5.5 | 0.0022 |  |
| [CVE-2024-56592](https://patchblox.com/security/data/cve/CVE-2024-56592.md) | Routine | kernel-64kb: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244). | 5.5 | 0.0022 |  |
| [CVE-2025-21667](https://patchblox.com/security/data/cve/CVE-2025-21667.md) | Routine | iomap: avoid avoid truncating 64-bit offset to 32 bits | 5.5 | 0.0022 |  |
| [CVE-2025-21681](https://patchblox.com/security/data/cve/CVE-2025-21681.md) | Routine | kernel-64kb: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702). | 5.5 | 0.0022 |  |
| [CVE-2025-21665](https://patchblox.com/security/data/cve/CVE-2025-21665.md) | Routine | kernel-64kb: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684). | 5.5 | 0.0022 |  |
| [CVE-2024-56728](https://patchblox.com/security/data/cve/CVE-2024-56728.md) | Routine | kernel-64kb: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (bsc#1235656). | 5.5 | 0.0021 |  |
| [CVE-2025-21653](https://patchblox.com/security/data/cve/CVE-2025-21653.md) | Routine | kernel-64kb: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (bsc#1236161). | 5.5 | 0.0021 |  |
| [CVE-2024-57938](https://patchblox.com/security/data/cve/CVE-2024-57938.md) | Routine | kernel-azure: net/sctp: Prevent autoclose integer overflow in sctp_association_init() (bsc#1236182). | 5.5 | 0.0021 |  |
| [CVE-2024-56726](https://patchblox.com/security/data/cve/CVE-2024-56726.md) | Routine | kernel-uek: ELSA-2025-20095: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0021 |  |
| [CVE-2024-56727](https://patchblox.com/security/data/cve/CVE-2024-56727.md) | Routine | kernel-livepatch-SLE15-SP6_Update_8: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (bsc#1235583). | 5.5 | 0.0021 |  |
| [CVE-2024-56763](https://patchblox.com/security/data/cve/CVE-2024-56763.md) | Routine | kernel-64kb: tracing: Prevent bad count for tracing_cpumask_write (bsc#1235638). | 5.5 | 0.0021 |  |
| [CVE-2024-56725](https://patchblox.com/security/data/cve/CVE-2024-56725.md) | Routine | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 5.5 | 0.0021 |  |
| [CVE-2024-53123](https://patchblox.com/security/data/cve/CVE-2024-53123.md) | Routine | kernel-64kb: mptcp: error out earlier on disconnect (bsc#1234070). | 5.5 | 0.0018 |  |
| [CVE-2025-21674](https://patchblox.com/security/data/cve/CVE-2025-21674.md) | Routine | kernel-64kb: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (bsc#1236688). | 5.5 | 0.0018 |  |
| [CVE-2024-57946](https://patchblox.com/security/data/cve/CVE-2024-57946.md) | Routine | kernel-64kb: virtio-blk: do not keep queue frozen during system suspend (bsc#1236247). | 5.5 | 0.0017 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.