Security update for kernel-livepatch-MICRO-6-0-RT_Update_7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20829-1 Final 1 1 2025-10-07T15:38:32Z current 2025-10-07T15:38:32Z 2025-10-07T15:38:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for kernel-livepatch-MICRO-6-0-RT_Update_7 This update for kernel-livepatch-MICRO-6-0-RT_Update_7 fixes the following issues: - CVE-2025-38089: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (bsc#1245509) - CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-kernel-146 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520829-1/ Link for SUSE-SU-2025:20829-1 https://lists.suse.com/pipermail/sle-updates/2025-October/042156.html E-Mail link for SUSE-SU-2025:20829-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1245509 SUSE Bug 1245509 https://bugzilla.suse.com/1247315 SUSE Bug 1247315 https://www.suse.com/security/cve/CVE-2025-38089/ SUSE CVE CVE-2025-38089 page https://www.suse.com/security/cve/CVE-2025-38477/ SUSE CVE CVE-2025-38477 page SUSE Linux Micro 6.0 kernel-livepatch-6_4_0-30-rt-7-1.3 kernel-livepatch-6_4_0-30-rt-7-1.3 as a component of SUSE Linux Micro 6.0 In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash. CVE-2025-38089 SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-rt-7-1.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520829-1/ https://www.suse.com/security/cve/CVE-2025-38089.html CVE-2025-38089 https://bugzilla.suse.com/1245508 SUSE Bug 1245508 https://bugzilla.suse.com/1245509 SUSE Bug 1245509 In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. CVE-2025-38477 SUSE Linux Micro 6.0:kernel-livepatch-6_4_0-30-rt-7-1.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520829-1/ https://www.suse.com/security/cve/CVE-2025-38477.html CVE-2025-38477 https://bugzilla.suse.com/1247314 SUSE Bug 1247314 https://bugzilla.suse.com/1247315 SUSE Bug 1247315