Critical Linux Kernel Security Update: Patch 4 Vulnerabilities in SLE 15 SP4 (Live Patch 38)

 

 Urgent SUSE Linux kernel security update fixes 4 critical vulnerabilities (CVE-2024-53125, CVE-2025-21702, CVE-2025-37752, CVE-2025-37797) affecting SLE 15 SP4, HPC, Micro, Real Time & openSUSE Leap 15.4. Prevent local privilege escalation & denial-of-service. Patch instructions & CVE details inside.

Is your SUSE Linux Enterprise (SLE) 15 SP4 or openSUSE Leap 15.4 system exposed to critical local attacks? A newly released Linux Kernel Live Patch (Update 38) addresses four significant security vulnerabilities rated "important". 

Timely patching is paramount for maintaining system integrity and preventing privilege escalation or service disruption. This update is essential for administrators managing enterprise Linux environments, cloud infrastructure, and high-performance computing clusters.

(H2) Vulnerability Overview: High-Risk Kernel Flaws Patched

This security maintenance update (Announcement ID: SUSE-SU-2025:02611-1) specifically targets the Linux Kernel version 5.14.21-150400_24_158. It resolves critical flaws that could be exploited by local attackers with existing low-privilege access:

1. CVE-2025-37797 (CVSS 7.8): A Use-After-Free (UAF) vulnerability in the net_sched: hfsc (Hierarchical Fair Service Curve) scheduler's class handling. Exploitation could lead to kernel memory corruption, crashes, or potential privilege escalation (bsc#1245793).

2. CVE-2025-37752 (CVSS 7.0): An issue in net_sched: sch_sfq (Stochastic Fairness Queueing) where improper limit validation could be manipulated, potentially causing instability or denial-of-service (bsc#1245776).

3. CVE-2024-53125 (CVSS 7.8): A flaw in the BPF (Berkeley Packet Filter) subsystem where sync_linked_regs() failed to correctly preserve sub-register definitions (subreg_def). This could enable crafted BPF programs to bypass verifier checks, leading to kernel compromise (bsc#1245804).

4. CVE-2025-21702 (CVSS 7.8): A vulnerability in the pfifo_tail_enqueue queueing discipline where sending packets when sch->limit == 0 wasn't properly handled, potentially causing unexpected behavior or crashes (bsc#1245797).

Why This Update Matters: Mitigating Real-World Risks

These vulnerabilities primarily require local access (AV:L), but their impact is severe (C:H/I:H/A:H). In modern Linux deployments, especially cloud-native and containerized environments, local access vectors are increasingly relevant. 

Consider a compromised container instance exploiting a kernel UAF flaw (CVE-2025-37797) to break isolation and attack the host kernel. Or, an attacker with shell access on a shared HPC node leveraging the BPF flaw (CVE-2024-53125) to gain root privileges. 

Proactive kernel patching remains the most effective defense-in-depth strategy against such scenarios. SUSE's Live Patching technology minimizes downtime, making rapid deployment feasible even for critical Tier 1 systems.

Affected Products: Urgent Action Required

This kernel security update is critical for the following SUSE distributions and modules:

• openSUSE Leap 15.4

• SUSE Linux Enterprise High Performance Computing 15 SP4

• SUSE Linux Enterprise Live Patching 15-SP4

• SUSE Linux Enterprise Micro 5.3 & 5.4 (MicroOS often underpins container hosts)

• SUSE Linux Enterprise Real Time 15 SP4

• SUSE Linux Enterprise Server 15 SP4

• SUSE Linux Enterprise Server for SAP Applications 15 SP4

Patch Deployment Instructions

Apply this critical kernel patch immediately using SUSE's standard maintenance tools:

1. Recommended Method:

   • Use YaST Online Update for a guided, reliable update process.

   • Alternatively, use the command line: sudo zypper patch

2. Product-Specific Commands:

   • openSUSE Leap 15.4:

     bash

     sudo zypper in -t patch SUSE-2025-2611=1

   • SUSE Linux Enterprise Live Patching 15-SP4:

     bash

     sudo zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2025-2611=1

Package List & Verification

The update delivers the following core packages for relevant architectures (ppc64le, s390x, x86_64):

• kernel-livepatch-5_14_21-150400_24_158-default-3-150400.2.1

• kernel-livepatch-5_14_21-150400_24_158-default-debuginfo-3-150400.2.1

• kernel-livepatch-SLE15-SP4_Update_38-debugsource-3-150400.2.1

Always verify successful installation using zypper patches or rpm -qa | grep kernel-livepatch. Reboot is generally not required for live patches, but monitor system logs.

Essential References & CVE Details

For comprehensive technical analysis of each vulnerability, consult the official sources:

• CVE Details:

  • CVE-2024-53125: BPF sync_linked_regs() Flaw

  • CVE-2025-21702: pfifo_tail_enqueue Issue

  • CVE-2025-37752: sch_sfq Limit Validation

  • CVE-2025-37797: HFSC Class UAF Vulnerability

• SUSE Bug Reports:

  • bsc#1245776 (CVE-2025-37752)

  • bsc#1245793 (CVE-2025-37797)

  • bsc#1245797 (CVE-2025-21702)

  • bsc#1245804 (CVE-2024-53125)

Frequently Asked Questions (FAQ)

• Q: Is a reboot mandatory after applying this live patch?

• A: Typically, no. SUSE Live Patching applies fixes to the running kernel without a reboot. However, monitor system stability closely post-patch.

• Q: What is the primary risk if I delay patching?

• A: The main risks are local privilege escalation (allowing a user to gain root access) and kernel panic/crashes (denial-of-service), potentially compromising critical server or HPC workloads.

• Q: Are containerized environments (like K8s nodes running SLE Micro) affected?

  • A: Yes. The vulnerabilities reside in the host kernel. Any container host running an unpatched affected kernel version is vulnerable, regardless of the container workload.

• Q: Where can I find detailed CVSS breakdowns?

  • A: The official CVE links above (e.g., SUSE's CVE page) provide full CVSS vector strings and severity analyses.

Conclusion: Prioritize Security Hardening

This SUSE kernel security update addresses critical vulnerabilities impacting core networking (HFSC, SFQ, pfifo) and system extensibility (BPF) components. Exploitation could severely compromise enterprise Linux security posture. 

Leveraging SUSE's Live Patching capability enables near-zero downtime remediation – a crucial advantage for maintaining SLA compliance in SAP, HPC, and real-time environments. Immediate patching is the definitive mitigation. 

System administrators should prioritize deploying Live Patch 38 across all affected SUSE Linux Enterprise 15 SP4 and openSUSE Leap 15.4 systems to maintain robust infrastructure security and operational continuity. Review your patch management strategy today!