Description
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not accept ACK of bytes we never sent
This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
SND.NXT). All incoming segments whose ACK value doesn't satisfy the
above condition MUST be discarded and an ACK sent back. It needs to
be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a
duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK
acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an
ACK, drop the segment, and return". The "ignored" above implies that
the processing of the incoming data segment continues, which means
the ACK value is treated as acceptable. This mitigation makes the
ACK check more stringent since any ACK < SND.UNA wouldn't be
accepted, instead only ACKs that are in the range ((SND.UNA -
MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.
This can be refined for new (and possibly spoofed) flows,
by not accepting ACK for bytes that were never sent.
This greatly improves TCP security at a little cost.
I added a Fixes: tag to make sure this patch will reach stable trees,
even if the 'blamed' patch was adhering to the RFC.
tp->bytes_acked was added in linux-4.2
Following packetdrill test (courtesy of Yepeng Pan) shows
the issue at hand:
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0
// ---------------- Handshake ------------------- //
// when window scale is set to 14 the window size can be extended to
// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet
// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)
// ,though this ack number acknowledges some data never
// sent by the server.
+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
+0 > S. 0:0(0) ack 1 <...>
+0 < . 1:1(0) ack 1 win 65535
+0 accept(3, ..., ...) = 4
// For the established connection, we send an ACK packet,
// the ack packet uses ack number 1 - 1073725300 + 2^32,
// where 2^32 is used to wrap around.
// Note: we used 1073725300 instead of 1073725440 to avoid possible
// edge cases.
// 1 - 1073725300 + 2^32 = 3221241997
// Oops, old kernels happily accept this packet.
+0 < . 1:1001(1000) ack 3221241997 win 65535
// After the kernel fix the following will be replaced by a challenge ACK,
// and prior malicious frame would be dropped.
+0 > . 1:1(0) ack 1001
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.0.58 – < 3.1, 3.2.37 – < 3.3, 3.4.25 – < 3.5, 3.8 | 3.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.6.8-1 | — |
| Debian 13 | linux | 6.6.8-1 | — |
| Debian 12 | linux | 6.1.69-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1037.39 | — |
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-100.110 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1056.61 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1058.66 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1058.66.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1053.61 | — |
| Ubuntu 22.04 LTS | linux-gke +1 | 5.15.0-1052.57 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1038.44 | — |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1048.51 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1050.56 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1046.46 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.5 | 6.5.0-1014.14 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1025.25 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1012.12 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1053.59 | — |
| Ubuntu 22.04 LTS | linux-riscv +30 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1030.34 | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-173.191 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1120.130 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1056.61~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1126.133 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1058.66~20.04.2 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1080.87 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1124.133 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1053.61~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1087.91 | — |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1038.44~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-100.110~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1067.72 | — |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1048.51~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1050.56~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1032.33 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1108.115 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1025.25~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1119.128 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1053.59~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1104.116 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1051.55~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1039.43 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1048.50 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1056.63 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1056.61+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-100.110+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1055.63+fips2 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1120.130+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1126.133+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1094.104 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1124.133+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +5 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1120.130~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1126.133~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1124.133~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-173.191~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1067.72~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1119.128~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1104.116~18.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.3.0-427.13.1.el9_4 | RHSA-2024:2394 |
| RHEL 9 | rv +64 | 5.14.0-427.13.1.el9_4 | RHSA-2024:2394 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.8.1.rt7.349.el8_10 | RHSA-2024:4352 |
| RHEL 8 | perf +26 | 4.18.0-553.8.1.el8_10 | RHSA-2024:4211 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | bpftool | 7.0.0-284.95.1.el9_2 | RHSA-2024:10772 |
| RHEL 9.2 EUS | kernel-rt +14 | 5.14.0-284.95.1.rt14.380.el9_2 | RHSA-2024:10773 |
| RHEL 9.2 EUS | perf +48 | 5.14.0-284.95.1.el9_2 | RHSA-2024:10772 |
| RHEL 8.8 EUS | perf +26 | 4.18.0-477.70.1.el8_8 | RHSA-2024:6206 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.118.1.el8_6 | RHSA-2024:5281 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.118.1.el8_6 | RHSA-2024:5281 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.118.1.el8_6 | RHSA-2024:5281 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | kernel-rt +11 | 4.18.0-553.8.1.rt7.349.el8_10 | ALSA-2024:4352 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.8.1.el8_10 | ALSA-2024:4211 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel | 4.18.0-553.8.1.el8_10 | RLSA-2024:4211 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.8.1.rt7.349.el8_10 | RLSA-2024:4352 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-64kb | 6.4.0-150600.23.14.1 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:3984-1, SUSE-SU-2024:2896-1 |
| SLES 15 SP6 | kernel-coco +3 | 6.4.0-15061.9.coco15sp6.1 | SUSE-SU-2024:4387-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-docs +5 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:3984-1, SUSE-SU-2024:2896-1 |
| SLES 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.73.1 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLES 15 SP5 | kernel-azure +2 | 5.14.21-150500.33.60.1 | SUSE-SU-2024:3983-1, SUSE-SU-2024:2372-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLES 15 SP5 | kernel-docs | 5.14.21-150500.55.73.2 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLES 15 SP2 | kernel-default-base | 5.3.18-150200.24.197.1.150200.9.101.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLES 15 SP2 | kernel-docs +5 | 5.3.18-150200.24.197.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
Show 28 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | kernel-azure +2 | 4.12.14-16.191.1 | SUSE-SU-2024:2360-1 |
| SLES 12 SP5 | kernel-docs +4 | 4.12.14-122.222.1 | SUSE-SU-2025:0034-1, SUSE-SU-2024:2561-1 |
| SLES 11 SP4 | kernel-ec2 +5 | 3.0.101-108.159.1 | SUSE-SU-2024:2895-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLES for SAP 15 SP3 | kernel-docs +5 | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLES for SAP 15 SP2 | kernel-default-base | 5.3.18-150200.24.197.1.150200.9.101.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLES for SAP 15 SP2 | kernel-docs +5 | 5.3.18-150200.24.197.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLES for SAP 12 SP5 | kernel-azure +2 | 4.12.14-16.191.1 | SUSE-SU-2024:2360-1 |
| SLES for SAP 12 SP5 | kernel-syms +2 | 4.12.14-122.222.1 | SUSE-SU-2024:2561-1 |
| SLE Real Time 12 SP5 | kernel-rt +3 | 4.12.14-10.191.1 | SUSE-SU-2024:2381-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-24.1.21.4 | SUSE-SU-2025:20247-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_4 | 1-1.1 | SUSE-SU-2025:20246-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_4 | 1-1.2 | SUSE-SU-2025:20247-1 |
| SLE Micro 6.1 | kernel-rt +1 | 6.4.0-22.1 | SUSE-SU-2025:20246-1 |
| SLE Micro 6.1 | kernel-source +2 | 6.4.0-24.1 | SUSE-SU-2025:20247-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-17.1.1.51 | SUSE-SU-2025:20164-1, SUSE-SU-2025:20008-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_4 | 1-1.1 | SUSE-SU-2025:20163-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_4 | 1-1.2 | SUSE-SU-2025:20164-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-9.1 | SUSE-SU-2025:20163-1, SUSE-SU-2025:20028-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-18.1 | SUSE-SU-2025:20164-1, SUSE-SU-2025:20008-1 |
| SLE Micro 5.5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.61.1 | SUSE-SU-2024:3985-1, SUSE-SU-2024:2394-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.85.1 | SUSE-SU-2024:4082-1, SUSE-SU-2024:2385-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.85.1 | SUSE-SU-2024:4082-1, SUSE-SU-2024:2385-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.175.1 | SUSE-SU-2024:4081-1, SUSE-SU-2024:2384-1 |
| SLE Micro 5.1 | kernel-default | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Micro 5.1 | kernel-rt +1 | 5.3.18-150300.175.1 | SUSE-SU-2024:4081-1, SUSE-SU-2024:2384-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.14.2 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_1 | 1-150600.1.5.1 | SUSE-SU-2024:2973-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_5 | 1-150600.1.3.1 | SUSE-SU-2024:3986-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_2 | 1-150600.13.3.2 | SUSE-SU-2024:2571-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_6 | 1-150600.13.3.5 | SUSE-SU-2024:4318-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:4364-1, SUSE-SU-2024:2939-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_17 +2 | 1-150500.11.3.1 | SUSE-SU-2024:3985-1, SUSE-SU-2024:2939-1, SUSE-SU-2024:2394-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_21 | 1-150500.11.5.1 | SUSE-SU-2024:4364-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_28 | 1-150400.9.3.1 | SUSE-SU-2024:2495-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_33 | 1-150400.9.5.1 | SUSE-SU-2024:4131-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_46 +1 | 1-150300.7.3.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE Live Patching 15 SP2 | kernel-default | 5.3.18-150200.24.197.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLE Live Patching 15 SP2 | kernel-livepatch-SLE15-SP2_Update_50 +1 | 1-150200.5.3.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.222.1 | SUSE-SU-2024:4100-1, SUSE-SU-2024:2561-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_58 +1 | 1-8.3.1 | SUSE-SU-2024:4100-1, SUSE-SU-2024:2561-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SLE HPC 15 SP3 | kernel-64kb +6 | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SLE HPC 15 SP2 | kernel-default-base | 5.3.18-150200.24.197.1.150200.9.101.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SLE HPC 15 SP2 | kernel-docs +5 | 5.3.18-150200.24.197.1 | SUSE-SU-2024:4103-1, SUSE-SU-2024:2365-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:3986-1, SUSE-SU-2024:2973-1 |
| SUSE Real Time Module 15 SP5 | kernel-rt +3 | 5.14.21-150500.13.61.1 | SUSE-SU-2024:3985-1, SUSE-SU-2024:2394-1 |
| SUSE Manager Server 4.3 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SUSE Manager Server 4.3 | kernel-syms +3 | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SUSE Manager Proxy 4.3 | kernel-default-base | 5.14.21-150400.24.125.1.150400.24.60.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SUSE Manager Proxy 4.3 | kernel-syms +2 | 5.14.21-150400.24.125.1 | SUSE-SU-2024:4131-1, SUSE-SU-2024:2495-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +6 | 5.3.18-150300.59.167.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.167.1.150300.18.98.1 | SUSE-SU-2024:4140-1, SUSE-SU-2024:2362-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | dtb-aarch64 +1 | 6.4.0-150600.23.14.1 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:3984-1, SUSE-SU-2024:2896-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-docs +8 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:4318-1, SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:3986-1, SUSE-SU-2024:2973-1 |
| openSUSE Leap 15.6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:3984-1, SUSE-SU-2024:2896-1 |
| openSUSE Leap 15.5 | dtb-aarch64 +9 | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-azure +2 | 5.14.21-150500.33.60.1 | SUSE-SU-2024:3983-1, SUSE-SU-2024:2372-1 |
| openSUSE Leap 15.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-docs | 5.14.21-150500.55.73.2 | SUSE-SU-2024:2939-1 |
| openSUSE Leap 15.5 | kernel-rt +3 | 5.14.21-150500.13.61.1 | SUSE-SU-2024:3985-1, SUSE-SU-2024:2394-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | kernel-default | 5.14.21-150500.55.73.1 | SUSE-SU-2024:2939-1 |
| openSUSE Leap Micro 5.5 | kernel-default-base | 5.14.21-150500.55.73.1.150500.6.33.8 | SUSE-SU-2024:2939-1 |
| openSUSE Leap Micro 5.5 | kernel-rt | 5.14.21-150500.13.76.1 | SUSE-SU-2024:3985-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.72-96.166 | 1.0-0.amzn2023 | ALAS2023-2024-488 |
| Amazon Linux 2023 | perf +14 | 6.1.72-96.166.amzn2023 | ALAS2023-2024-488 |
| Amazon Linux 2 | kernel-livepatch-4.14.334-252.552 | 1.0-0.amzn2 | ALAS2-2024-2391 |
| Amazon Linux 2 | perf +8 | 4.14.334-252.552.amzn2 | ALAS2-2024-2391 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-553.8.1.el8_10 | ELSA-2024-4211 |
| Oracle Linux 7 | kernel-uek +5 | 4.1.12-124.89.4.el7uek | ELSA-2024-12606 |
Advisories 50
- ALSA-2024:4211 Important: kernel security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:4352 Important: kernel-rt security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:2394 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:4352 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:4211 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:10773 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:10772 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:5281 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2024-1259 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifischen Angriff BSI CERT-Bund (WID) · Oct 7, 2026
- RHSA-2024:6206 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- ALAS2023-2024-488 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 3, 2026
- SUSE-SU-2025:20163-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20246-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20164-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20008-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20247-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20028-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-25-226-15 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-613116 SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1 Siemens ProductCERT · Feb 24, 2026
- WID-SEC-2024-1251 Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Feb 16, 2026
- RLSA-2024:4352 Important: kernel-rt security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:4211 Important: kernel security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2025:0034-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3985-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2973-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2362-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4081-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4103-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2561-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2394-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4318-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4140-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4131-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2384-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2895-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2939-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3984-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2360-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3986-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4364-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2896-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2365-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4082-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2381-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4387-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2495-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4100-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2372-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3983-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2385-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57
- https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a
- https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0
- https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a
- https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc
- https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440
- https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757
- https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27