CVE-2024-26859
Medium · 4.7CVSS
4.7
EPSS
0.2%
Published
Apr 17, 2024
CISA due date
—
Cloudanix analysis
Schedule a fix
SSVC: Track
A timing problem in certain network card error-handling code can make servers using that hardware crash without warning.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- High
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in bnx2x driver during EEH error recovery allows concurrent access to already-freed SGE pages in bnx2x_free_rx_sge, resulting in NULL pointer dereference and kernel crash.
Why it matters to the business
Unexpected system crashes and reboots on servers using Broadcom NetXtreme II adapters during PCI error recovery, causing service disruption and potential data loss in high-availability environments.
How an attack unfolds
An attacker or environmental condition triggers a transmit timeout or EEH slot reset; two kernel threads race through bnx2x_tx_timeout and bnx2x_io_slot_reset, both calling paths that free the same rx_page_ring entries, leading one thread to dereference a page pointer that was cleared by the other.
How to fix it
Apply the upstream fix that adds verification of page pool allocations before freeing in bnx2x_free_rx_sge; update to a kernel containing commit d1f0e4bae11ce12f4d1f6482b380e48f345a8dd3 or later equivalent vendor patch.
How to confirm the fix worked
Confirm the patch is present by inspecting bnx2x_free_rx_sge for the added page-pool validation check; reproduce EEH slot_reset under load and verify absence of NULL dereference oops in dmesg.
Typical attack path
- Trigger transmit timeout or inject EEH error on affected NIC
- bnx2x_tx_timeout schedules bnx2x_sp_rtnl_task leading to bnx2x_nic_unload
- Concurrently EEH handler invokes bnx2x_io_slot_reset
- Both paths invoke bnx2x_free_rx_sge_range without synchronization
- One thread reads page pointer after the other has set it to NULL post-dma_unmap
- Kernel dereferences NULL causing oops and panic
How to detect it
Search kernel logs for bnx2x_io_slot_reset combined with subsequent NULL pointer dereference oops referencing bnx2x_free_rx_sge; correlate with EEH event traces and call stacks showing concurrent reset and timeout paths.
What your security team should do
- Prioritize kernel updates on systems with bnx2x hardware within maintenance windows
- Monitor vendor advisories for backported fixes in supported distributions
- Test EEH error injection in staging environments before production rollout
- Consider NIC replacement with non-bnx2x adapters if updates cannot be applied promptly
The record
In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system crash during EEH error handling During EEH error recovery, the bnx2x driver's transmit timeout logic could cause a race condition when handling reset tasks. The bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() SGEs are freed using bnx2x_free_rx_sge_range(). However, this could overlap with the EEH driver's attempt to reset the device using bnx2x_io_slot_reset(), which also tries to free SGEs. This race condition can result in system crashes due to accessing freed memory locations in bnx2x_free_rx_sge() 799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, 800 struct bnx2x_fastpath *fp, u16 index) 801 { 802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index]; 803 struct page *page = sw_buf->page; .... where sw_buf was set to NULL after the call to dma_unmap_page() by the preceding thread. EEH: Beginning: 'slot_reset' PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... bnx2x 0011:01:00.0: enabling device (0140 -> 0142) bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc0080000025065fc Oops: Kernel access of bad area, sig: 11 [#1] ..... Call Trace: [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 To solve this issue, we need to verify page pool allocations before freeing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-abi-stablelists | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-core | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-cross-headers | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-debug | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-debug-core | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-debug-devel | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules-extra | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-devel | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-doc | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-headers | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-modules | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-modules-extra | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-rt | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-core | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-core | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-devel | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-devel | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-kvm | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-modules | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-rt-modules-extra | 0 | 4.18.0-553.8.1.rt7.349.el8_10 |
| AlmaLinux:8 | kernel-tools | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs-devel | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-core | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | perf | 0 | 4.18.0-553.8.1.el8_10 |
| AlmaLinux:8 | python3-perf | 0 | 4.18.0-553.8.1.el8_10 |
| Debian:10 | linux | 0 | 4.19.316-1 |
| Debian:10 | linux-5.10 | 0 | 5.10.216-1~deb10u1 |
| Debian:11 | linux | 0 | 5.10.216-1 |
| Debian:12 | linux | 0 | 6.1.85-1 |
| Debian:13 | linux | 0 | 6.7.12-1 |
| Linux | Kernel | 4.2.0 | 4.19.311 |
| Red Hat:enterprise_linux:8::baseos | bpftool | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | bpftool-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-abi-stablelists | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-cross-headers | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debug-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debuginfo-common-aarch64 | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debuginfo-common-ppc64le | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debuginfo-common-s390x | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-debuginfo-common-x86_64 | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-doc | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-headers | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-tools | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-tools-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-tools-libs | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-tools-libs-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | kernel-zfcpdump-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | perf | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | perf-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | python3-perf | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::baseos | python3-perf-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | bpftool | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | bpftool-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-abi-stablelists | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-cross-headers | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debug-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debuginfo-common-aarch64 | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debuginfo-common-ppc64le | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debuginfo-common-s390x | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-debuginfo-common-x86_64 | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-doc | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-headers | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-tools | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-tools-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-tools-libs | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-tools-libs-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump-core | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump-devel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump-modules | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | kernel-zfcpdump-modules-extra | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | perf | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | perf-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | python3-perf | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::crb | python3-perf-debuginfo | 0 | 0:4.18.0-553.8.1.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-core | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-core | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-debuginfo | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-devel | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-kvm | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-modules | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debug-modules-extra | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debuginfo | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-debuginfo-common-x86_64 | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-devel | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-kvm | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-modules | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::nfv | kernel-rt-modules-extra | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-core | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-core | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-debuginfo | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-devel | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-kvm | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-modules | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debug-modules-extra | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debuginfo | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-debuginfo-common-x86_64 | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-devel | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-kvm | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-modules | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Red Hat:enterprise_linux:8::realtime | kernel-rt-modules-extra | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| Rocky Linux:8 | kernel | 0 | 0:4.18.0-553.8.1.el8_10 |
| Rocky Linux:8 | kernel-rt | 0 | 0:4.18.0-553.8.1.rt7.349.el8_10 |
| SUSE:Linux Enterprise High Availability Extension 12 SP5 | kernel-default | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_56 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_16 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_15 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.68.1.150500.6.31.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-64kb | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.68.1.150500.6.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-zfcpdump | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-syms-azure | 0 | 5.14.21-150500.33.57.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-rt | 0 | 4.12.14-10.182.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-rt_debug | 0 | 4.12.14-10.182.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-source-rt | 0 | 4.12.14-10.182.1 |
| SUSE:Linux Enterprise Real Time 12 SP5 | kernel-syms-rt | 0 | 4.12.14-10.182.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-default | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-source | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-source-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-syms | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server 12 SP5 | kernel-syms-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-default | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-syms | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | kernel-syms-azure | 0 | 4.12.14-16.182.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | kernel-docs | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | kernel-obs-build | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP5 | kernel-default | 0 | 4.12.14-122.216.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.68.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt_debug | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-source-rt | 0 | 5.14.21-150500.13.58.1 |
| SUSE:Real Time Module 15 SP5 | kernel-syms-rt | 0 | 5.14.21-150500.13.58.1 |
| Ubuntu:14.04:LTS | linux | 0 | 3.11.0-12.19 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
Related vulnerabilities
- CVE-2025-68301 In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix… Also affects bpftool
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects bpftool
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects bpftool
- CVE-2025-40248 In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore… Also affects bpftool
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects bpftool
- CVE-2025-40154 In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel… Also affects bpftool
- CVE-2025-40096 In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix… Also affects bpftool
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects bpftool