CVE-2025-21729
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Feb 27, 2025
CISA due date
—
Cloudanix analysis
A timing problem in the Linux kernel's wireless networking code could let an attacker crash computers or potentially take them over during normal WiFi operations.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in rtw89 WiFi driver allows cancel_hw_scan to pass a check on an unprotected scanning flag, after which hw_scan completion unsets the flag and frees hw_scan_req, resulting in null pointer dereference and use-after-free during scan offload operations.
Why it matters to the business
Systems using affected Linux kernel WiFi drivers may experience crashes or potential privilege escalation during wireless network operations, leading to downtime, data loss, or unauthorized code execution; widespread kernel usage increases exposure across servers and endpoints, with remediation urgency elevated by related kernel flaws actively used by threat actors.
How an attack unfolds
An attacker triggers concurrent scan cancellation and completion paths (for example via connection or authentication flows) to win the race on the unprotected flag, causing the driver to dereference a freed pointer or access null memory in rtw89_fw_h2c_scan_offload_be and related functions, potentially leading to kernel panic or controlled memory corruption for privilege escalation.
How to fix it
Update to Linux kernel commit 2403cb3c235d5e339b580cc3a825493769fadca8 or later stable releases that protect the scanning flag check under mutex; for pyyaml dependents update to version 4.1 where applicable.
How to confirm the fix worked
Verify kernel source contains the mutex-protected check around the scanning flag before cancel_hw_scan proceeds; test by exercising concurrent scan start/cancel paths under KASAN or similar memory debugging; confirm absence of the original race window in rtw89_ops_cancel_hw_scan and hw_scan completion handlers.
Typical attack path
- Trigger wireless scan via cfg80211 or mac80211 APIs
- Concurrently invoke cancel_hw_scan while scan completion handler runs
- Win race on unprotected scanning flag to reach freed hw_scan_req
- Execute rtw89_hw_scan_abort leading to null dereference or use-after-free in firmware command path
- Escalate via kernel memory corruption or crash for denial of service
How to detect it
Inspect kernel logs for KASAN null-ptr-deref reports mentioning rtw89_fw_h2c_scan_offload_be, rtw89_hw_scan_offload, or rtw89_hw_scan_abort during cfg80211_conn_work or ieee80211_scan_cancel; search process trees for worker threads invoking scan abort paths and correlate with wireless authentication or connection events.
- rtw89_fw_h2c_scan_offload_be+0xc33
- KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
- rtw89_hw_scan_abort
- ieee80211_scan_cancel
- cfg80211_conn_work
What your security team should do
- Prioritize kernel upgrades to the fixed commit on all systems using rtw89 WiFi hardware
- Monitor for related kernel privilege escalation activity given multiple similar flaws exploited by threat actors
- Apply defense-in-depth such as disabling unnecessary WiFi or using hardened kernel configurations until patched
- Review EPSS trend and ecosystem prevalence to schedule testing and rollout within standard change windows
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex. KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | kernel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-abi-stablelists | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-cross-headers | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-uki-virt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-doc | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-headers | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools-libs | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools-libs-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-uki-virt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-uki-virt-addons | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | libperf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | perf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | python3-perf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | rtla | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | rv | 0 | 5.14.0-611.5.1.el9_7 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.13-1 |
| Linux | Kernel | 5.18.0 | 6.12.13 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_11 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_11 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_1 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.3.1.150700.17.2.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.3.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
Related vulnerabilities
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects kernel
- CVE-2025-68287 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race… Also affects kernel
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects kernel
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects kernel
- CVE-2025-40185 In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter… Also affects kernel
- CVE-2025-40176 In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending… Also affects kernel
- CVE-2025-40058 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow… Also affects kernel
- CVE-2025-39981 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix… Also affects kernel