Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP7) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:03575-1 Final 1 1 2025-10-12T15:04:11Z current 2025-10-12T15:04:11Z 2025-10-12T15:04:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP7) This update for the Linux Kernel 6.4.0-150700_51 fixes several issues. The following security issues were fixed: - CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315). - CVE-2025-22023: usb: xhci: Don't skip on Stopped - Length Invalid (bsc#1246754). - CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-3575,SUSE-SLE-Module-Live-Patching-15-SP7-2025-3575 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202503575-1/ Link for SUSE-SU-2025:03575-1 https://lists.suse.com/pipermail/sle-updates/2025-October/042089.html E-Mail link for SUSE-SU-2025:03575-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1245509 SUSE Bug 1245509 https://bugzilla.suse.com/1246754 SUSE Bug 1246754 https://bugzilla.suse.com/1247315 SUSE Bug 1247315 https://www.suse.com/security/cve/CVE-2025-22023/ SUSE CVE CVE-2025-22023 page https://www.suse.com/security/cve/CVE-2025-38089/ SUSE CVE CVE-2025-38089 page https://www.suse.com/security/cve/CVE-2025-38477/ SUSE CVE CVE-2025-38477 page SUSE Linux Enterprise Live Patching 15 SP7 kernel-livepatch-6_4_0-150700_51-default-5-150700.3.12.2 kernel-livepatch-6_4_0-150700_51-default-5-150700.3.12.2 as a component of SUSE Linux Enterprise Live Patching 15 SP7 In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stopped") in v6.11, the driver didn't skip missed isochronous TDs when handling Stoppend and Stopped - Length Invalid events. Instead, it erroneously cleared the skip flag, which would cause the ring to get stuck, as future events won't match the missed TD which is never removed from the queue until it's cancelled. This buggy logic seems to have been in place substantially unchanged since the 3.x series over 10 years ago, which probably speaks first and foremost about relative rarity of this case in normal usage, but by the spec I see no reason why it shouldn't be possible. After d56b0b2ab142, TDs are immediately skipped when handling those Stopped events. This poses a potential problem in case of Stopped - Length Invalid, which occurs either on completed TDs (likely already given back) or Link and No-Op TRBs. Such event won't be recognized as matching any TD (unless it's the rare Link TRB inside a TD) and will result in skipping all pending TDs, giving them back possibly before they are done, risking isoc data loss and maybe UAF by HW. As a compromise, don't skip and don't clear the skip flag on this kind of event. Then the next event will skip missed TDs. A downside of not handling Stopped - Length Invalid on a Link inside a TD is that if the TD is cancelled, its actual length will not be updated to account for TRBs (silently) completed before the TD was stopped. I had no luck producing this sequence of completion events so there is no compelling demonstration of any resulting disaster. It may be a very rare, obscure condition. The sole motivation for this patch is that if such unlikely event does occur, I'd rather risk reporting a cancelled partially done isoc frame as empty than gamble with UAF. This will be fixed more properly by looking at Stopped event's TRB pointer when making skipping decisions, but such rework is unlikely to be backported to v6.12, which will stay around for a few years. CVE-2025-22023 SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_51-default-5-150700.3.12.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503575-1/ https://www.suse.com/security/cve/CVE-2025-22023.html CVE-2025-22023 https://bugzilla.suse.com/1241298 SUSE Bug 1241298 https://bugzilla.suse.com/1246754 SUSE Bug 1246754 In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash. CVE-2025-38089 SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_51-default-5-150700.3.12.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503575-1/ https://www.suse.com/security/cve/CVE-2025-38089.html CVE-2025-38089 https://bugzilla.suse.com/1245508 SUSE Bug 1245508 https://bugzilla.suse.com/1245509 SUSE Bug 1245509 In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. CVE-2025-38477 SUSE Linux Enterprise Live Patching 15 SP7:kernel-livepatch-6_4_0-150700_51-default-5-150700.3.12.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503575-1/ https://www.suse.com/security/cve/CVE-2025-38477.html CVE-2025-38477 https://bugzilla.suse.com/1247314 SUSE Bug 1247314 https://bugzilla.suse.com/1247315 SUSE Bug 1247315