SUSE-SU-2026:24486-1: Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). - CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). - CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). - CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). - CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
Other sources
This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues: The following security issues were fixed: CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837). CVE-2026-63968: ipv6: fix possible infinite loop in fib6selectpath() (bsc#1272521). CVE-2026-64217: netfs: Fix overrun check in netfsextractuseriter() (bsc#1272874). CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712). CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693). CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399). CVE-2026-89544: SUNRPC: fix gssxdecoptionarray error path bugs (bsc#1280760). CVE-2026-89551: SUNRPC: xdrbuftrim: clamp buf->len to avoid underflow (bsc#1280728). CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget (bsc#1280285). CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285686).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-livepatch-MICRO-6-0_Update_25to a version that resolves this vulnerability.Fixed in 7-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-48-default-7-1.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 6_4_0-48-default-debuginfo-7-1.1 - Upgrade
Upgrade
suse/kernel-livepatch-MICROto a version that resolves this vulnerability.Fixed in 6-0_Update_25-debugsource-7-1.1 - Upgrade
Upgrade
SUSE Linux Enterprise Kernelto a version that resolves this vulnerability.Fixed in 6.4.0-48.1Patch SUSE-SLE-Micro-6.0-kernel-731
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems should prioritize applying this update?
Systems running the SUSE Linux Enterprise Kernel 6.4.0-48.1 should prioritize the update, particularly where virtiofs, IPv4 or IPv6 networking, SCTP, IPVS, XFRM, SUNRPC, NFS, or NFSD functionality is in use. The advisory rates the update high severity (7).
Do the listed issues require particular kernel subsystems to be in use?
Yes. The fixes are in specific subsystems including virtiofs, IPv4 and IPv6 networking, SCTP, IPVS, XFRM, netfs, SUNRPC, NFS, and NFSD. Exposure therefore depends on whether the affected subsystem and relevant functionality are enabled and used on the system.
What should be done if the update cannot be installed immediately?
The provided advisory does not specify mitigations or workarounds. Until the kernel update can be applied, assess and limit use or network exposure of affected services and features where operationally feasible, especially NFS/NFSD, SUNRPC, SCTP, IPVS, virtiofs, and related network functionality.