FERRAMENTAS LINUX: Urgent SUSE Linux Kernel Security Update: Patch 7 Critical Vulnerabilities (CVE-2025-38494, CVE-2025-38495)

Critical SUSE Linux Kernel Live Patch 0 for SLE 15 SP7 addresses 7 major vulnerabilities, including high-severity CVEs in HID and networking. Learn about the CVE-2025-38494, CVE-2025-38495, and other flaws, their CVSS 7.0-8.5 scores, and how to secure your enterprise systems immediately.

Published: August 21, 2025
Author: SUSE Security Team
Rating: Important

SUSE has released a critical live patch update for the Linux Kernel (6.4.0-150700_51) on SLE 15 SP7, addressing seven significant security vulnerabilities.

This mandatory update mitigates risks ranging from local privilege escalation to denial-of-service attacks, with CVSS scores as high as 8.5. For system administrators managing enterprise Linux environments, applying this patch is a top priority to maintain system integrity and protect against potential exploits.

Failing to apply kernel security patches in a timely manner is a primary vector for system compromise. This update, identified as SUSE-SU-2025:02942-1, provides a seamless live patching solution, minimizing downtime while maximizing security.

But what specific threats does this patch neutralize, and how can you deploy it effectively across your SUSE infrastructure?

Detailed Analysis of Patched Vulnerabilities and Their Impact

The resolved vulnerabilities primarily affect core subsystems within the Linux kernel, including hardware interface handling (HID), cryptographic functions, and network scheduling. The consequences of exploitation could allow a local attacker to gain elevated privileges, crash the system, or corrupt memory.

The following critical security issues have been fixed:

CVE-2025-38494 & CVE-2025-38495 (CVSS: 8.5): HID Core Bypass and Buffer Flaws. These high-severity vulnerabilities within the Human Interface Device (HID) core could allow a malicious device or local user to bypass security controls and corrupt memory. The flaws, tracked internally as bsc#1247350 and bsc#1247351, involve improper handling of report buffers and bypassing hid_hw_raw_request checks, potentially leading to arbitrary code execution.

CVE-2025-38079 (CVSS: 7.3): Crypto Algorithm Double-Free Vulnerability. A double-free flaw was discovered in the algif_hash cryptographic API interface. This vulnerability, referenced in bsc#1245218, could be triggered during a hash acceptance process, leading to a memory corruption and a system crash, destabilizing cryptographic operations.

CVE-2025-38083 (CVSS: 7.8): Network Priority Scheduling Race Condition. In the net_sched subsystem, the prio_tune() function contained a race condition (bsc#1245350). An attacker could exploit this timing issue to cause a denial-of-service (kernel panic) or potentially other undefined behavior in the network packet scheduler.

CVE-2025-37797 (CVSS: 7.8): HFSC Scheduler Use-After-Free Risk. The Hierarchical Fair-Service Curve (HFSC) network scheduler contained a Use-After-Free (UAF) vulnerability in its class handling code (bsc#1245793). Exploitation could lead to a system crash or privilege escalation.

CVE-2025-37752 (CVSS: 7.0): SFQ Scheduler Limit Validation Issue. The Stochastic Fairness Queueing (SFQ) scheduler did not properly validate limits when tuned, a flaw documented in bsc#1245776. This could be used to trigger a denial-of-service state.

CVE-2025-21702 (CVSS: 7.8): Packet Enqueue Logic Error. The pfifo_tail_enqueue function would incorrectly attempt to enqueue a new packet even when the queue limit (sch->limit) was zero (bsc#1245797), leading to a kernel panic.

Affected SUSE Linux Enterprise Products

This security update is available for the following SUSE product versions:

SUSE Linux Enterprise Live Patching 15-SP7
SUSE Linux Enterprise Server 15 SP7
SUSE Linux Enterprise Server for SAP Applications 15 SP7
SUSE Linux Enterprise Real Time 15 SP7

Step-by-Step Guide: How to Apply This Kernel Security Patch

Applying this update promptly is crucial for maintaining your system's security posture. SUSE provides multiple robust methods for enterprise patch management, ensuring compatibility and reliability.

Patch Instructions:

For most environments, using the standard SUSE recommended tools is the most efficient method:

YaST Online Update: Launch YaST, navigate to "Online Update," and apply all available security patches.
Zypper Command Line: The universal command is zypper patch.

Alternatively, you can install this specific patch by running the command tailored for your product:

For SUSE Linux Enterprise Live Patching 15-SP7:

zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP7-2025-2942=1

Package List: The update includes the following packages for the x86_64, ppc64le, and s390x architectures:

kernel-livepatch-6_4_0-150700_51-default
kernel-livepatch-6_4_0-150700_51-default-debuginfo
kernel-livepatch-SLE15-SP7_Update_0-debugsource

Always remember to test patches in a staging environment before deploying them to production systems to ensure application compatibility.

The Critical Importance of Proactive Kernel Patching in Enterprise Security

Why is a kernel patch rated "Important" so urgent? The Linux kernel is the core of every distribution, mediating access between hardware and software.

A vulnerability in the kernel can undermine all other security measures. In today's threat landscape, automated scanners often exploit publicly disclosed vulnerabilities (CVEs) within hours.

Proactive patch management isn't just best practice; it's a fundamental requirement for compliance with frameworks like ISO 27001, SOC 2, and GDPR.

Live patching technology, as used in this update, exemplifies modern enterprise-grade maintenance. It allows organizations to apply critical security fixes to the kernel without rebooting, thereby maintaining unparalleled system availability—a key requirement for server uptime and SAP application environments.

Frequently Asked Questions (FAQ)

Q1: What is a Linux Kernel Live Patch?

A: A live patch is a technology that allows security updates to be applied to a running Linux kernel without requiring a system reboot. This is essential for maintaining high availability in enterprise and cloud environments.

Q2: Do I need to restart my server after applying this update?

A: No. This is specifically a Live Patch update, designed to be applied without a reboot. The changes take effect immediately.

Q3: How serious are these vulnerabilities?

A: Very. With CVSS scores ranging from 7.0 to 8.5, these vulnerabilities could lead to privilege escalation, denial-of-service, or system crashes. They should be addressed with high priority.

Q4: Where can I find the official references for these CVEs?

A: You can find the official SUSE security announcements and CVE details at the following links:

Conclusion: The SUSE-SU-2025:02942-1 security update is a non-negotiable mitigation for critical kernel-level threats.

By leveraging SUSE's live patching capabilities, administrators can swiftly secure their systems against these vulnerabilities without incurring downtime. Regularly updating your kernel is the most effective defense against evolving cyber threats.

Review your systems today and apply this patch to ensure continued operational security and compliance.