SUSE-SU-2026:24482-1: Security update for the Linux Kernel RT (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-MICRO-6-0-RT_Update_27to a version that resolves this vulnerability.Fixed in 6-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-50-rt-debuginfo-6-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-50-rt-6-1.1 - Upgrade
Upgrade
suse/kernel-livepatch-MICROto a version that resolves this vulnerability.Fixed in 6-0-RT_Update_27-debugsource-6-1.1 - Upgrade
Upgrade
SUSE Linux Enterprise Kernelto a version that resolves this vulnerability.Fixed in 6.4.0-50.2Patch SUSE-SLE-Micro-6.0-kernel-726
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which kernel subsystems should be prioritized when assessing exposure?
The fixes span virtiofs, IPv4 and IPv6 networking, XFRM, SCTP, IPVS, SUNRPC, netfs, and NFS server functionality. Systems using these features should be reviewed first against the listed CVEs.
Does the advisory specify an attack vector, required privileges, or whether default configurations are affected?
No. The provided advisory lists the corrected kernel issues but does not describe exploitation prerequisites, affected default configurations, or whether the issues are remotely exploitable.
What remediation is identified by the advisory?
The advisory identifies the SUSE Linux Enterprise Kernel 6.4.0-50.2 update as containing fixes for the listed security issues. Verify that this kernel update has been applied in the relevant SUSE Linux Enterprise environments.