# SUSE-SU-2025:0847-1: Security update for 3 packages SUSE-SU-2025:0847-1, released March 12, 2025, fixes 83 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/suse-su-2025-0847-1 - Platform: Linux - Released: Mar 12, 2025 - Priority: Urgent (Closes CVE-2024-53177, rated Critical) - CVEs: 83, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:0847-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.6 | 6.4.0-150600.8.31.1 | | [kernel-source-azure](https://patchblox.com/security/data/product/linux/kernel-source-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | | [kernel-source-azure](https://patchblox.com/security/data/product/linux/kernel-source-azure.md) | sles 15.6 | 6.4.0-150600.8.31.1 | | [kernel-syms-azure](https://patchblox.com/security/data/product/linux/kernel-syms-azure.md) | opensuse-leap 15.6 | 6.4.0-150600.8.31.1 | | [kernel-syms-azure](https://patchblox.com/security/data/product/linux/kernel-syms-azure.md) | sles 15.6 | 6.4.0-150600.8.31.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-53177](https://patchblox.com/security/data/cve/CVE-2024-53177.md) | Urgent | kernel-64kb: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896). | 9.8 | 0.0055 | | | [CVE-2025-21795](https://patchblox.com/security/data/cve/CVE-2025-21795.md) | High | kernel: kernel: NFSD: fix hang in nfsd4_shutdown_callback | 7.8 | 0.0067 | | | [CVE-2025-21692](https://patchblox.com/security/data/cve/CVE-2025-21692.md) | High | kernel-64kb: net: sched: fix ets qdisc OOB Indexing (bsc#1237028). | 7.8 | 0.0062 | | | [CVE-2024-46858](https://patchblox.com/security/data/cve/CVE-2024-46858.md) | High | kernel-64kb: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088). | 7.0 | 0.0059 | | | [CVE-2024-50029](https://patchblox.com/security/data/cve/CVE-2024-50029.md) | High | kernel-64kb: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949). | 7.8 | 0.0037 | | | [CVE-2024-49950](https://patchblox.com/security/data/cve/CVE-2024-49950.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0037 | | | [CVE-2024-53239](https://patchblox.com/security/data/cve/CVE-2024-53239.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0029 | | | [CVE-2025-21647](https://patchblox.com/security/data/cve/CVE-2025-21647.md) | High | kernel-64kb: sched: sch_cake: add bounds checks to host bulk flow fairness counts (bsc#1236133). | 7.8 | 0.0028 | | | [CVE-2024-56633](https://patchblox.com/security/data/cve/CVE-2024-56633.md) | High | kernel-64kb: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485). | 7.8 | 0.0028 | | | [CVE-2024-49884](https://patchblox.com/security/data/cve/CVE-2024-49884.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0028 | | | [CVE-2024-44974](https://patchblox.com/security/data/cve/CVE-2024-44974.md) | High | dtb-aarch64: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235). | 7.8 | 0.0027 | | | [CVE-2024-57979](https://patchblox.com/security/data/cve/CVE-2024-57979.md) | High | kernel-64kb: kABI workaround for pps changes (bsc#1238521). | 7.8 | 0.0027 | | | [CVE-2024-53173](https://patchblox.com/security/data/cve/CVE-2024-53173.md) | High | kernel-azure: Security update for the Linux Kernel | 7.8 | 0.0027 | | | [CVE-2024-50073](https://patchblox.com/security/data/cve/CVE-2024-50073.md) | High | tty: n_gsm: Fix use-after-free in gsm_cleanup_mux | 7.8 | 0.0026 | | | [CVE-2024-41055](https://patchblox.com/security/data/cve/CVE-2024-41055.md) | High | dtb-aarch64: Security update for the Linux Kernel | 7.8 | 0.0026 | | | [CVE-2024-53147](https://patchblox.com/security/data/cve/CVE-2024-53147.md) | High | kernel-uek: ELSA-2025-20480: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0025 | | | [CVE-2024-47701](https://patchblox.com/security/data/cve/CVE-2024-47701.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2024-56548](https://patchblox.com/security/data/cve/CVE-2024-56548.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0025 | | | [CVE-2024-50036](https://patchblox.com/security/data/cve/CVE-2024-50036.md) | High | kernel-64kb: net: do not delay dst_entries_add() in dst_release() (bsc#1231912). | 7.0 | 0.0025 | | | [CVE-2024-50115](https://patchblox.com/security/data/cve/CVE-2024-50115.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0025 | | | [CVE-2024-56605](https://patchblox.com/security/data/cve/CVE-2024-56605.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0024 | | | [CVE-2025-21715](https://patchblox.com/security/data/cve/CVE-2025-21715.md) | High | kernel-64kb: net: davicom: fix UAF in dm9000_drv_remove (bsc#1237889). | 7.8 | 0.0024 | | | [CVE-2024-56658](https://patchblox.com/security/data/cve/CVE-2024-56658.md) | High | kernel-64kb: net: defer final 'struct net' free in netns dismantle (bsc#1235441). | 7.8 | 0.0024 | | | [CVE-2025-21687](https://patchblox.com/security/data/cve/CVE-2025-21687.md) | High | kernel-64kb: vfio/platform: check the bounds of read/write syscalls (bsc#1237045). | 7.8 | 0.0024 | | | [CVE-2025-21669](https://patchblox.com/security/data/cve/CVE-2025-21669.md) | High | kernel-64kb: vsock/virtio: discard packets if the transport changes (bsc#1236683). | 7.1 | 0.0023 | | | [CVE-2025-21700](https://patchblox.com/security/data/cve/CVE-2025-21700.md) | High | kernel-64kb: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159). | 7.8 | 0.0023 | | | [CVE-2025-21790](https://patchblox.com/security/data/cve/CVE-2025-21790.md) | High | kernel-modules-core: kernel: vxlan: check vxlan_vnigroup_init() return value | 7.8 | 0.0023 | | | [CVE-2025-21680](https://patchblox.com/security/data/cve/CVE-2025-21680.md) | High | kernel-64kb: pktgen: Avoid out-of-bounds access in get_imix_entries (bsc#1236700). | 7.8 | 0.0023 | | | [CVE-2025-21728](https://patchblox.com/security/data/cve/CVE-2025-21728.md) | High | kernel-64kb: bpf: Send signals asynchronously if !preemptible (bsc#1237879). | 7.8 | 0.0021 | | | [CVE-2025-21719](https://patchblox.com/security/data/cve/CVE-2025-21719.md) | High | kernel-64kb: ipmr: do not call mr_mfc_uses_dev() for unres entries (bsc#1238860). | 7.1 | 0.0021 | | | [CVE-2024-26810](https://patchblox.com/security/data/cve/CVE-2024-26810.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask o... | 7.8 | 0.0020 | | | [CVE-2025-21724](https://patchblox.com/security/data/cve/CVE-2025-21724.md) | High | kernel-64kb: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (bsc#1238863). | 7.8 | 0.0019 | | | [CVE-2024-50294](https://patchblox.com/security/data/cve/CVE-2024-50294.md) | High | kernel-64kb: rxrpc: Fix missing locking causing hanging calls (bsc#1233483). | 7.8 | 0.0017 | | | [CVE-2024-40980](https://patchblox.com/security/data/cve/CVE-2024-40980.md) | Routine | dtb-aarch64: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937). | 5.5 | 0.0076 | | | [CVE-2024-53226](https://patchblox.com/security/data/cve/CVE-2024-53226.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0073 | | | [CVE-2024-50185](https://patchblox.com/security/data/cve/CVE-2024-50185.md) | Routine | kernel-64kb: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109). | 5.5 | 0.0056 | | | [CVE-2024-53176](https://patchblox.com/security/data/cve/CVE-2024-53176.md) | Routine | kernel-64kb: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894). | 5.5 | 0.0056 | | | [CVE-2024-53178](https://patchblox.com/security/data/cve/CVE-2024-53178.md) | Routine | kernel-64kb: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895). | 6.3 | 0.0054 | | | [CVE-2024-57882](https://patchblox.com/security/data/cve/CVE-2024-57882.md) | Routine | kernel-64kb: mptcp: fix TCP options overflow | 5.5 | 0.0052 | | | [CVE-2024-45009](https://patchblox.com/security/data/cve/CVE-2024-45009.md) | Routine | dtb-aarch64: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438). | 5.5 | 0.0052 | | | [CVE-2024-50085](https://patchblox.com/security/data/cve/CVE-2024-50085.md) | Routine | kernel-64kb: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508). | 5.5 | 0.0048 | | | [CVE-2025-21673](https://patchblox.com/security/data/cve/CVE-2025-21673.md) | Routine | smb: client: fix double free of TCP_Server_Info::hostname | 5.5 | 0.0042 | | | [CVE-2025-21725](https://patchblox.com/security/data/cve/CVE-2025-21725.md) | Routine | kernel-64kb: smb: client: fix oops due to unset link speed (bsc#1238877). | 5.5 | 0.0040 | | | [CVE-2024-56539](https://patchblox.com/security/data/cve/CVE-2024-56539.md) | Routine | kernel-coco: Security update for the Linux Kernel | 5.5 | 0.0030 | | | [CVE-2025-21697](https://patchblox.com/security/data/cve/CVE-2025-21697.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0026 | | | [CVE-2024-50142](https://patchblox.com/security/data/cve/CVE-2024-50142.md) | Routine | kernel-64kb: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028). | 5.5 | 0.0026 | | | [CVE-2025-21699](https://patchblox.com/security/data/cve/CVE-2025-21699.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0025 | | | [CVE-2024-56720](https://patchblox.com/security/data/cve/CVE-2024-56720.md) | Routine | kernel-64kb: bpf, sockmap: Several fixes to bpf_msg_pop_data (bsc#1235592). | 5.5 | 0.0024 | | | [CVE-2024-57948](https://patchblox.com/security/data/cve/CVE-2024-57948.md) | Routine | kernel-coco_debug: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2025-21638](https://patchblox.com/security/data/cve/CVE-2025-21638.md) | Routine | kernel-64kb: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115). | 5.5 | 0.0024 | | | [CVE-2025-21640](https://patchblox.com/security/data/cve/CVE-2025-21640.md) | Routine | kernel-64kb: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123). | 5.5 | 0.0024 | | | [CVE-2024-56579](https://patchblox.com/security/data/cve/CVE-2024-56579.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0024 | | | [CVE-2025-21754](https://patchblox.com/security/data/cve/CVE-2025-21754.md) | Routine | kernel-64kb: btrfs: fix assertion failure when splitting ordered extent after transaction abort (bsc#1238496). | 5.5 | 0.0023 | | | [CVE-2025-21639](https://patchblox.com/security/data/cve/CVE-2025-21639.md) | Routine | kernel-64kb: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122). | 5.5 | 0.0023 | | | [CVE-2025-21689](https://patchblox.com/security/data/cve/CVE-2025-21689.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0023 | | | [CVE-2025-21799](https://patchblox.com/security/data/cve/CVE-2025-21799.md) | Routine | kernel-64kb: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() (bsc#1238739). | 5.5 | 0.0023 | | | [CVE-2025-21666](https://patchblox.com/security/data/cve/CVE-2025-21666.md) | Routine | kernel-64kb: vsock: prevent null-ptr-deref in vsock_*[has_data\|has_space] (bsc#1236680). | 5.5 | 0.0023 | | | [CVE-2025-21670](https://patchblox.com/security/data/cve/CVE-2025-21670.md) | Routine | kernel-64kb: vsock/bpf: return early if transport is not assigned (bsc#1236685). | 5.5 | 0.0023 | | | [CVE-2025-21668](https://patchblox.com/security/data/cve/CVE-2025-21668.md) | Routine | kernel-64kb: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (bsc#1236682). | 5.5 | 0.0023 | | | [CVE-2025-21675](https://patchblox.com/security/data/cve/CVE-2025-21675.md) | Routine | kernel-64kb: net/mlx5: Clear port select structure when fail to create (bsc#1236694). | 5.5 | 0.0023 | | | [CVE-2024-56647](https://patchblox.com/security/data/cve/CVE-2024-56647.md) | Routine | kernel-64kb: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435). | 5.5 | 0.0022 | | | [CVE-2024-45010](https://patchblox.com/security/data/cve/CVE-2024-45010.md) | Routine | dtb-aarch64: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439). | 5.5 | 0.0022 | | | [CVE-2025-21636](https://patchblox.com/security/data/cve/CVE-2025-21636.md) | Routine | kernel-64kb: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy (bsc#1236113). | 5.5 | 0.0022 | | | [CVE-2025-21705](https://patchblox.com/security/data/cve/CVE-2025-21705.md) | Routine | kernel-64kb: mptcp: handle fastopen disconnect correctly (bsc#1238525). | 5.5 | 0.0022 | | | [CVE-2024-56592](https://patchblox.com/security/data/cve/CVE-2024-56592.md) | Routine | kernel-64kb: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244). | 5.5 | 0.0022 | | | [CVE-2025-21667](https://patchblox.com/security/data/cve/CVE-2025-21667.md) | Routine | iomap: avoid avoid truncating 64-bit offset to 32 bits | 5.5 | 0.0022 | | | [CVE-2025-21681](https://patchblox.com/security/data/cve/CVE-2025-21681.md) | Routine | kernel-64kb: openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1236702). | 5.5 | 0.0022 | | | [CVE-2023-52924](https://patchblox.com/security/data/cve/CVE-2023-52924.md) | Routine | kernel-zfcpdump-core: RHSA-2024:2394: kernel security, bug fix, and enhancement update (Important) | 5.5 | 0.0022 | | | [CVE-2025-21665](https://patchblox.com/security/data/cve/CVE-2025-21665.md) | Routine | kernel-64kb: filemap: avoid truncating 64-bit offset to 32 bits (bsc#1236684). | 5.5 | 0.0022 | | | [CVE-2025-21690](https://patchblox.com/security/data/cve/CVE-2025-21690.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0022 | | | [CVE-2025-21637](https://patchblox.com/security/data/cve/CVE-2025-21637.md) | Routine | kernel-64kb: sctp: sysctl: udp_port: avoid using current->nsproxy (bsc#1236114). | 5.5 | 0.0021 | | | [CVE-2025-21802](https://patchblox.com/security/data/cve/CVE-2025-21802.md) | Routine | kernel-64kb: net: hns3: fix oops when unload drivers paralleling (bsc#1238751). | 5.5 | 0.0021 | | | [CVE-2023-52925](https://patchblox.com/security/data/cve/CVE-2023-52925.md) | Routine | dtb-aarch64: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-21684](https://patchblox.com/security/data/cve/CVE-2025-21684.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0021 | | | [CVE-2025-21716](https://patchblox.com/security/data/cve/CVE-2025-21716.md) | Routine | kernel-64kb: vxlan: Fix uninit-value in vxlan_vnifilter_dump() (bsc#1237891). | 5.5 | 0.0021 | | | [CVE-2025-21733](https://patchblox.com/security/data/cve/CVE-2025-21733.md) | Routine | kernel-64kb: tracing/osnoise: Fix resetting of tracepoints (bsc#1238494). | 5.5 | 0.0020 | | | [CVE-2025-21688](https://patchblox.com/security/data/cve/CVE-2025-21688.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 4.7 | 0.0018 | | | [CVE-2024-53123](https://patchblox.com/security/data/cve/CVE-2024-53123.md) | Routine | kernel-64kb: mptcp: error out earlier on disconnect (bsc#1234070). | 5.5 | 0.0018 | | | [CVE-2025-21767](https://patchblox.com/security/data/cve/CVE-2025-21767.md) | Routine | kernel-64kb: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context (bsc#1238509). | 5.5 | 0.0018 | | | [CVE-2024-26708](https://patchblox.com/security/data/cve/CVE-2024-26708.md) | Routine | dtb-aarch64: mptcp: fix inconsistent state on fastopen race (bsc#1222672). | 5.5 | 0.0017 | | | [CVE-2024-57889](https://patchblox.com/security/data/cve/CVE-2024-57889.md) | Routine | kernel-64kb: Security update for the Linux Kernel | 5.5 | 0.0017 | | | [CVE-2024-56568](https://patchblox.com/security/data/cve/CVE-2024-56568.md) | Routine | kernel-64kb: iommu/arm-smmu: Defer probe of clients after smmu device bound (bsc#1235032). | 5.5 | 0.0016 | | | [CVE-2024-57994](https://patchblox.com/security/data/cve/CVE-2024-57994.md) | Routine | kernel-64kb: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() (bsc#1237901). | 5.5 | 0.0016 | | --- Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.