SUSE-SU-2026:24485-1: Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-MICRO-6-0_Update_26to a version that resolves this vulnerability.Fixed in 6-1.1 - Upgrade
Upgrade
suse/kernel-livepatch-MICROto a version that resolves this vulnerability.Fixed in 6-0_Update_26-debugsource-6-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-49-default-6-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-49-default-debuginfo-6-1.1 - Upgrade
Upgrade
SUSE Linux Enterprise Kernelto a version that resolves this vulnerability.Fixed in 6.4.0-49.1Patch SUSE-SLE-Micro-6.0-kernel-730
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which kernel subsystems are covered by this update?
The update includes fixes in virtiofs, IPv4 and IPv6 networking, netfs, XFRM, SCTP, IPVS, SUNRPC, and NFS server code. Systems using these kernel features are the most directly relevant candidates for triage.
Does the advisory identify the affected SUSE Linux Enterprise product versions or fixed package builds?
No. The provided advisory text identifies the update as SUSE Linux Enterprise Kernel 6.4.0-49.1, but does not provide affected product releases, prior vulnerable builds, or package-version comparison details.
What specific bug classes are addressed?
The listed fixes include a use-after-free in virtiofs, a possible infinite loop in IPv6 path selection, an overrun-check issue in netfs, integer overflow prevention in SCTP peer transport handling, and underflow-related length handling in SUNRPC. Other fixes address stale packet state, IPv4 option cleanup, and NFS XDR length calculation.