SUSE update for the Linux Kernel RT (Live Patch 4 for SLE 15 SP6)

Published: 2025-04-28

Risk	High
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2024-53082 CVE-2024-53237 CVE-2024-56650 CVE-2024-8805
CWE-ID	CWE-20 CWE-416 CWE-125 CWE-284
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software	SUSE Linux Enterprise Live Patching Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system kernel-livepatch-6_4_0-150600_10_14-rt Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_5-rt Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_8-rt-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_8-rt Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP6-RT_Update_4-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_14-rt-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_8-rt Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP6-RT_Update_3-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_11-rt Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP6-RT_Update_2-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_5-rt-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_11-rt-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-6_4_0-150600_10_8-rt-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP6-RT_Update_0-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP6-RT_Update_1-debugsource Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU100749

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53082

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the virtnet_probe() function in drivers/net/virtio_net.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel RT (Live Patch 4 for SLE 15 SP6) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Live Patching: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-livepatch-6_4_0-150600_10_14-rt: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt-debuginfo: before 14-150600.3.1

kernel-livepatch-6_4_0-150600_10_8-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_4-debugsource: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_14-rt-debuginfo: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_3-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_2-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt-debuginfo: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_8-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_0-debugsource: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_1-debugsource: before 13-150600.2.1

CPE2.3

External links

https://www.suse.com/support/update/announcement/2025/suse-su-20251385-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU102069

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53237

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __match_tty() and hci_conn_del_sysfs() functions in net/bluetooth/hci_sysfs.c. A local user can escalate privileges on the system.

Mitigation

Update the affected package the Linux Kernel RT (Live Patch 4 for SLE 15 SP6) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Live Patching: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-livepatch-6_4_0-150600_10_14-rt: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt-debuginfo: before 14-150600.3.1

kernel-livepatch-6_4_0-150600_10_8-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_4-debugsource: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_14-rt-debuginfo: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_3-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_2-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt-debuginfo: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_8-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_0-debugsource: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_1-debugsource: before 13-150600.2.1

CPE2.3

External links

https://www.suse.com/support/update/announcement/2025/suse-su-20251385-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU102078

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56650

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the led_tg_check() function in net/netfilter/xt_LED.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Update the affected package the Linux Kernel RT (Live Patch 4 for SLE 15 SP6) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Live Patching: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-livepatch-6_4_0-150600_10_14-rt: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt-debuginfo: before 14-150600.3.1

kernel-livepatch-6_4_0-150600_10_8-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_4-debugsource: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_14-rt-debuginfo: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_3-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_2-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt-debuginfo: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_8-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_0-debugsource: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_1-debugsource: before 13-150600.2.1

CPE2.3

External links

https://www.suse.com/support/update/announcement/2025/suse-su-20251385-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU97651

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-8805

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the implementation of the HID over GATT Profile. A remote attacker on the local network can bypass implemented security restrictions and execute arbitrary code on the target system.

Mitigation

Update the affected package the Linux Kernel RT (Live Patch 4 for SLE 15 SP6) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Live Patching: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

kernel-livepatch-6_4_0-150600_10_14-rt: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt-debuginfo: before 14-150600.3.1

kernel-livepatch-6_4_0-150600_10_8-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_4-debugsource: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_10_14-rt-debuginfo: before 8-150600.2.1

kernel-livepatch-6_4_0-150600_8-rt: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_3-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_2-debugsource: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_5-rt-debuginfo: before 13-150600.2.1

kernel-livepatch-6_4_0-150600_10_11-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-6_4_0-150600_10_8-rt-debuginfo: before 9-150600.2.1

kernel-livepatch-SLE15-SP6-RT_Update_0-debugsource: before 14-150600.3.1

kernel-livepatch-SLE15-SP6-RT_Update_1-debugsource: before 13-150600.2.1

CPE2.3

External links

https://www.suse.com/support/update/announcement/2025/suse-su-20251385-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.