Critical Linux Kernel Security Update: Live Patch 19 for SLE 15 SP5 Fixes 8 High-Risk Vulnerabilities

 

SUSE releases urgent Linux Kernel Live Patch 19 for SLE 15 SP5, addressing 8 critical CVEs (CVE-2024-56601, CVE-2024-53208, and more) with CVSS scores up to 8.5. Learn how to patch vulnerabilities in Bluetooth, net/sched, and dm-cache modules.

Why This Update Matters

The latest SUSE Linux Enterprise (SLE) 15 SP5 kernel patch resolves eight high-severity vulnerabilities that could lead to privilege escalation, denial of service, or remote code execution. Enterprises relying on Linux for critical infrastructure must prioritize this update to mitigate risks like:

• Use-after-free exploits in Bluetooth (CVE-2024-56605) and ISO sockets (CVE-2024-50124).

• Out-of-bounds memory access in dm-cache (CVE-2024-50279).

• Kernel slab corruption in key management (CVE-2024-50301).

Did you know? Over 60% of cloud workloads run on Linux. Unpatched kernels are prime targets for supply-chain attacks.

---

Affected Systems

This update impacts:

• SUSE Linux Enterprise Server 15 SP5

• SUSE Linux Enterprise Real Time 15 SP5

• openSUSE Leap 15.5

• SUSE Linux Enterprise for SAP Applications

(Full list in original advisory)

---

Vulnerability Breakdown

1. Bluetooth Module Risks (CVSS 8.5)

• CVE-2024-56601: Dangling pointer in inet_create() could allow local privilege escalation.

• CVE-2024-53208: Slab-use-after-free in MGMT API exposes systems to remote attacks.

2. Kernel Memory Corruption Flaws

• CVE-2024-50279: Dirty bitset overflow in dm-cache during resize operations.

• CVE-2024-50301: Key permission checks trigger slab-out-of-bounds reads.

*(See full CVSS 4.0/3.1 scoring tables in original advisory.)*

How to Patch

Recommended Methods

1. Automated Update:

   bash

   zypper patch SUSE-SU-2025:02171-1

2. Manual Patch for openSUSE Leap 15.5:

   bash

   zypper in -t patch SUSE-2025-2171=1

Note: Live patching reduces downtime but requires validation in staging environments.

Security Best Practices

• Monitor: Use auditd to track kernel-level anomalies.

• Isolate: Segment networks to limit Bluetooth attack surfaces.

• Verify: Check /var/log/zypp/history for successful patch deployment.

---

FAQ

Q: Is a reboot required after patching?

A: Not for live patches, but a reboot ensures full mitigation.

Q: Are containers affected?

A: Yes, if they share the host kernel. Update host OS immediately.